Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-12-2024 17:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    3.1MB

  • MD5

    41f7104e635f418ec5a33d817b5324d9

  • SHA1

    7c9a3124d4bf236a560c6a865b0034f79a65f875

  • SHA256

    3301f21b0e9b43873293f712c6a8eccb7746c09207e0cedcfe836d060862c6f8

  • SHA512

    7dfd8e767be1b7904ff44b90cbc973a577f831db0dc81c44167838146a8912efe3631510fcf37451396206613419ca6d0fa0554a74af1764d50c056a3b66338e

  • SSDEEP

    49152:kVF+M26kfUw7yoxeBqOo7NjGOTIkets5JsE8p7OuEFWH:e4M26kfUwGoxeBqV7BVtZheKuEU

Score
10/10
amadeyasyncratlummastealcstormkittyvenomrat9c9aa5stokdiscoveryevasionpersistenceratstealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • VenomRAT 1 IoCs

    Detects VenomRAT.

    rat
  • Venomrat family
    venomrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 17 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3432
      • C:\Users\Admin\AppData\Local\Temp\file.exe
        "C:\Users\Admin\AppData\Local\Temp\file.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4864
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1104
          • C:\Users\Admin\AppData\Local\Temp\1013210001\B3vKvPi.exe
            "C:\Users\Admin\AppData\Local\Temp\1013210001\B3vKvPi.exe"
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:3908
            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\callmobile.exe
              C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\callmobile.exe
              5⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4820
          • C:\Users\Admin\AppData\Local\Temp\1013220001\gdxjQRY.exe
            "C:\Users\Admin\AppData\Local\Temp\1013220001\gdxjQRY.exe"
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2220
            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\everyonetechnollogyovlres.exe
              C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\everyonetechnollogyovlres.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1364
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /C timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\everyonetechnollogyovlres.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1144
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Delays execution with timeout.exe
                  PID:3804
            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oftendesignpropre.exe
              C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oftendesignpropre.exe
              5⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:4480
              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oftendesign.exe
                C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oftendesign.exe
                6⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Drops startup file
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2276
              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\offtendesign.exe
                C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\offtendesign.exe
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:2512
          • C:\Users\Admin\AppData\Local\Temp\1013229001\0tClIDb.exe
            "C:\Users\Admin\AppData\Local\Temp\1013229001\0tClIDb.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2932
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 1488
              5⤵
              • Program crash
              PID:3212
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 1508
              5⤵
              • Program crash
              PID:4476
          • C:\Users\Admin\AppData\Local\Temp\1013230001\119098284e.exe
            "C:\Users\Admin\AppData\Local\Temp\1013230001\119098284e.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1436
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 1512
              5⤵
              • Program crash
              PID:4284
          • C:\Users\Admin\AppData\Local\Temp\1013231001\2480fe37ef.exe
            "C:\Users\Admin\AppData\Local\Temp\1013231001\2480fe37ef.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:5076
          • C:\Users\Admin\AppData\Local\Temp\1013232001\e5562b3451.exe
            "C:\Users\Admin\AppData\Local\Temp\1013232001\e5562b3451.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:2056
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM firefox.exe /T
              5⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:956
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM chrome.exe /T
              5⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3600
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM msedge.exe /T
              5⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:532
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM opera.exe /T
              5⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:5020
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM brave.exe /T
              5⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2764
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
              5⤵
                PID:4816
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                  6⤵
                  • Checks processor information in registry
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  PID:4776
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b399fae-1c67-4687-831d-688d7c8b78c5} 4776 "\\.\pipe\gecko-crash-server-pipe.4776" gpu
                    7⤵
                      PID:3252
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2456 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {771e387f-7001-432c-bdb5-eab441996e32} 4776 "\\.\pipe\gecko-crash-server-pipe.4776" socket
                      7⤵
                        PID:4284
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2984 -childID 1 -isForBrowser -prefsHandle 2976 -prefMapHandle 2972 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c90fed6c-37c2-49cd-b833-d0ea3d17d137} 4776 "\\.\pipe\gecko-crash-server-pipe.4776" tab
                        7⤵
                          PID:1712
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3668 -childID 2 -isForBrowser -prefsHandle 3660 -prefMapHandle 2888 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {840e163e-7431-4404-8ea7-45de6062b8b9} 4776 "\\.\pipe\gecko-crash-server-pipe.4776" tab
                          7⤵
                            PID:3760
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4772 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4764 -prefMapHandle 4760 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f85455a8-9bfa-4936-bcf7-468a48318bf6} 4776 "\\.\pipe\gecko-crash-server-pipe.4776" utility
                            7⤵
                            • Checks processor information in registry
                            PID:5444
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5380 -childID 3 -isForBrowser -prefsHandle 5396 -prefMapHandle 4404 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d790d41-19d4-45ee-9700-c8048e5097fa} 4776 "\\.\pipe\gecko-crash-server-pipe.4776" tab
                            7⤵
                              PID:5896
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5568 -childID 4 -isForBrowser -prefsHandle 5432 -prefMapHandle 5524 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ce3a2dc-44e0-4f18-958a-686de4c5b0cd} 4776 "\\.\pipe\gecko-crash-server-pipe.4776" tab
                              7⤵
                                PID:5928
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5716 -childID 5 -isForBrowser -prefsHandle 5756 -prefMapHandle 5760 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {553fc556-922c-4ed9-9108-4ba6a053cfb5} 4776 "\\.\pipe\gecko-crash-server-pipe.4776" tab
                                7⤵
                                  PID:5952
                          • C:\Users\Admin\AppData\Local\Temp\1013233001\e22dade81e.exe
                            "C:\Users\Admin\AppData\Local\Temp\1013233001\e22dade81e.exe"
                            4⤵
                            • Modifies Windows Defender Real-time Protection settings
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Windows security modification
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5220
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                        2⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1428
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Wihnup" /tr '"C:\Users\Admin\AppData\Roaming\Wihnup.exe"' & exit
                          3⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:4140
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /create /f /sc onlogon /rl highest /tn "Wihnup" /tr '"C:\Users\Admin\AppData\Roaming\Wihnup.exe"'
                            4⤵
                            • System Location Discovery: System Language Discovery
                            • Scheduled Task/Job: Scheduled Task
                            PID:4532
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB9D5.tmp.bat""
                          3⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:3052
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout 3
                            4⤵
                            • System Location Discovery: System Language Discovery
                            • Delays execution with timeout.exe
                            PID:2016
                          • C:\Users\Admin\AppData\Roaming\Wihnup.exe
                            "C:\Users\Admin\AppData\Roaming\Wihnup.exe"
                            4⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:4256
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                        2⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5596
                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4464
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2932 -ip 2932
                      1⤵
                        PID:4012
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2932 -ip 2932
                        1⤵
                          PID:1708
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1436 -ip 1436
                          1⤵
                            PID:1248
                          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4800
                          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5720

                          Network

                          MITRE ATT&CK Enterprise v15

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Persistence

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Create or Modify System Process

                          1
                          T1543

                          Windows Service

                          1
                          T1543.003

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Privilege Escalation

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Create or Modify System Process

                          1
                          T1543

                          Windows Service

                          1
                          T1543.003

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Defense Evasion

                          Impair Defenses

                          2
                          T1562

                          Disable or Modify Tools

                          2
                          T1562.001

                          Modify Registry

                          4
                          T1112

                          Subvert Trust Controls

                          1
                          T1553

                          Install Root Certificate

                          1
                          T1553.004

                          Virtualization/Sandbox Evasion

                          2
                          T1497

                          Credential Access

                          Discovery

                          Query Registry

                          6
                          T1012

                          System Information Discovery

                          4
                          T1082

                          System Location Discovery

                          1
                          T1614

                          System Language Discovery

                          1
                          T1614.001

                          Virtualization/Sandbox Evasion

                          2
                          T1497

                          Lateral Movement

                          Collection

                          Command and Control

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\activity-stream.discovery_stream.json
                            Filesize

                            18KB

                            MD5

                            90a0d2cede6a8ec877b5643da52630d3

                            SHA1

                            f710e0ab9df3a6b04186f786a36cb0fc8a5b0741

                            SHA256

                            a1c89ee618fdc723b92533635bf8887afb26cb77ab4a5318ae5fc07102b246fc

                            SHA512

                            95475a8eb78e0662498f96440f2cf55471aa7201531136451def88b65c39c73025109ea0afd2196fd6512ba9494577a32c88a47b1cc3d8d1c41308e918156595

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                            Filesize

                            13KB

                            MD5

                            2900b1d70185d39370001edb947d6a25

                            SHA1

                            e6a07f7f47861afe565b2ba150ce471dde4b8976

                            SHA256

                            2047e8c1cedc6cf7640f6664bb58cdab031d04f653a39f9b424cc1421d4d6ed3

                            SHA512

                            dcca443a0c17f488634f1652248ceeccedc48344d9a13be3d0069a1efe0b33491ec08f05646a29bb49d77e15366a96e64bb15f127724650068595748e9af634b

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\F8CBD54DDA10F4286A41EC6A537240712D6C2308
                            Filesize

                            9KB

                            MD5

                            fe5e6fd9752f44a863ac1ee2ad55c954

                            SHA1

                            a15e9aabb4232b291737ab85429f20eafe25194b

                            SHA256

                            c59b29e5cea634a169163b6d8a4192de9a3d336e2772c176d9efc9169f78292e

                            SHA512

                            64f1f8c8d1fdc551d42102078c1b68847481e8411edccd8a979d3db75448375ab6335485d3125ff65aa640dd5d984d8d89f3519396ca60530d45be6dd557b136

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                            Filesize

                            15KB

                            MD5

                            96c542dec016d9ec1ecc4dddfcbaac66

                            SHA1

                            6199f7648bb744efa58acf7b96fee85d938389e4

                            SHA256

                            7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                            SHA512

                            cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1013210001\B3vKvPi.exe
                            Filesize

                            2.2MB

                            MD5

                            3541c1ac26eb5bbb87f01c20fd9f8824

                            SHA1

                            bf5d136c911491f59bdeb3bf37b8f1a155fd3a97

                            SHA256

                            b7cd929ce4d0fa849eeab8a216e1333f63c7d3530da674f163efab4dae3439d1

                            SHA512

                            babc17723d2389919acd96f977821d57bdd737f01a9598209efafa72ae0418e914a5d229f196d80cb5ba70ce82b0f340b18aa255bbe4ed77d821a432d5794a93

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1013220001\gdxjQRY.exe
                            Filesize

                            11.0MB

                            MD5

                            3a11b7a8fbf64b684369aeea7cd08e17

                            SHA1

                            6d2e049bdb475e47b6ed03547c5d20b286caaffd

                            SHA256

                            ccacaf0bd975ea2b7cb9e03986419ef04947ed39bfe3b18bae3577a3890ddada

                            SHA512

                            b3852c01797b02d8f387a72adbc997c66cd44164cf902851d30f3437cfc6bba4741b70b3a332de69d6776a84e43b207b7e1d3b6dd6582172313559b35f28ae79

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1013229001\0tClIDb.exe
                            Filesize

                            1.8MB

                            MD5

                            6367fb8a64f997be8d65536534bdd057

                            SHA1

                            3ee062142dde2330881566a63a92957037a0e6b3

                            SHA256

                            bdae46a5cb1f1b6b9864b5e944ed5b2e24622d7385a196e0293f7b9da59bda5e

                            SHA512

                            ace2dbba313180a64f70f49c7763fb9da23ef76b82548c8fa54a7d1e8d4810cad83726fe532459660e12e4f6a9210df09dd836ea28f1cc5a791a4873b95a274c

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1013230001\119098284e.exe
                            Filesize

                            1.8MB

                            MD5

                            dccc10f2a3e67d24320aa5abe819a2d9

                            SHA1

                            e3a57b1581b2b1e4bfaa994ad836f27803f1aee9

                            SHA256

                            ab51065a1271ffdd973c8c130f9f17fdb9d0631b3a9c9c39ce8f1840c43b0670

                            SHA512

                            f967d8dba9afd807021040b88e567bb4f264ca8994a1c6d2e6865baef9a66a2a336aacba5c7c4f90b504f442ae891ab67627377c919e40839a005aa2263f1f34

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1013231001\2480fe37ef.exe
                            Filesize

                            1.7MB

                            MD5

                            da3e48a074978cf8a3eeaa8e523a1b35

                            SHA1

                            959463b589892d5aad9ce625ce81b2339dbe8b22

                            SHA256

                            b0759e11c119210c0c58de1f33b83e5aa09b7db04769ef3252287f09fa5b83d1

                            SHA512

                            8605149816281fd07bf933274fdefb9e91ff8621091a27452348d663cf7e40b8855748ab0ad5ff592be60ec770ea941476be98a760a22d6d149055908338f584

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1013232001\e5562b3451.exe
                            Filesize

                            946KB

                            MD5

                            6872c10a10d2b102e179311094da805e

                            SHA1

                            d6c9d4ded030a1c76c523cbc3836441678d2bc15

                            SHA256

                            7f40b697f1684c203f7808caf9af431f3a4f87a69125b8da622c9f3507501e0a

                            SHA512

                            3c84653cbd5b00a8bcf6073e989b6100d2f448994770b7ac7c5944bf7a73353888a421f71c1d06f8cebf9e9a2566933b02e9961c3d98189b8a43ef5b450833a2

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1013233001\e22dade81e.exe
                            Filesize

                            2.7MB

                            MD5

                            9429e601600bc4600ea346cc12304513

                            SHA1

                            4d463110a6fc9bb3017b89ee5af99d597f012bca

                            SHA256

                            71dfde01e5e7a3f5266043149cc9e15f94d60335cf800ad353195df95a5ee2e4

                            SHA512

                            ee48a83c1632da738cbb4d80e9cfa78e09765e3327fcb320c1a422fa1aba64bec49aed200702ef31f47d7d8fcfc79df03c82eacc87da0049af85b0b28988100c

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\callmobile.exe
                            Filesize

                            2.3MB

                            MD5

                            ffabcc262fb699998b6191d7656c8805

                            SHA1

                            fd3ea79a8550b14e9cc75fb831fd7a141964a714

                            SHA256

                            f46e4a7de978baceec5f64cbc9fa1f1e772e864fa3310045cd19d77264698cde

                            SHA512

                            79b2e21a9111b16b0f67ae5d1cc40a25773b847d3f4cf78711a8dfd8b67c30beec332ed65ac008c9dca62c84de891eff20d7c6050bc868bce77a17fe56da61ba

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\everyonetechnollogyovlres.exe
                            Filesize

                            5.6MB

                            MD5

                            1903d7d11d73afa8dd27d21bf148fc2a

                            SHA1

                            b8388685baceaa5a88f00bcb8ff5083914ceb9c9

                            SHA256

                            389259edafb04ed410e74813e0378910c4eec9ca066a9c4b3e9928aa50b18136

                            SHA512

                            535bab32ac1de46eff9432bed6e9a4817ed85dd7a3452c7db2a3b4ac683d7c6b5be25208d0ac4df3189d8d8a278a293c81cf47612caaaaf0bf702643dfd66616

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oftendesignpropre.exe
                            Filesize

                            9.5MB

                            MD5

                            490864b581cfd93592b1d47e7c0b7c8f

                            SHA1

                            bb35ed819f628a1894caaad9d41566d51675a3d8

                            SHA256

                            3ddec7574b24a9d26a450c8cc725b347606ff33b9346a812d3012eb6f359d5f9

                            SHA512

                            40adb01f4714165019f8eae6595be9faea20584b63b839d17288ce3d4ce8c74fb340c565bf22c1c6586a13d657e4ed080e3923b1a07f8d7d85a04a2c75a488a3

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\offtendesign.exe
                            Filesize

                            5.5MB

                            MD5

                            85c8006a42a12b496e1a65e2198f0a49

                            SHA1

                            d738ad3676dbc8c2423cd738d4d4f001aee80a2f

                            SHA256

                            c3d81f54c4f75ff0a42b0dc356b323beefd945b6891c8f1c7fd83fd62084b4bf

                            SHA512

                            8c9e02fcd38df99bb4fb49018deee9386883df5bf6fcae29b39a791caa592ae7a9d12bb9c072135ecd014f530a7226b09387bb536945f40fc139bb538ef4ec34

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oftendesign.exe
                            Filesize

                            4.4MB

                            MD5

                            0f4bc1fb5d736a617a8733f62266945b

                            SHA1

                            2c99949405459f02fc2f9785c4edde830aecbe69

                            SHA256

                            c8222b9d3f4e6d8e2b9d9fc7a027bac9d826572da7f05ecc8ae8ba8e00f7ce91

                            SHA512

                            4b75bacd9244d082672ff9e84075d74e982a48797a9ada1121e5bce45bfb8b294ada379e57170588ec8b3a0607b8e32960034ff1163b9472451650deb4c73898

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\Tmp79BF.tmp
                            Filesize

                            2KB

                            MD5

                            cbc6b2ad4bf883ea7ecb41d8d86b0964

                            SHA1

                            3051043976773abfc145a23942b42e4c7cac5a1c

                            SHA256

                            c8844ba7ca7df3c75532044792065c3d2b742c389fc9fa1a6e2776ed425917af

                            SHA512

                            355b1e180d067abaab69f1f51cf0776dee7156156195094825a1ba7fac3bcf7ab303b5d68be373878f400cd34ec9061dc549706b8ad344e66ac8968daa7e812f

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            Filesize

                            3.1MB

                            MD5

                            41f7104e635f418ec5a33d817b5324d9

                            SHA1

                            7c9a3124d4bf236a560c6a865b0034f79a65f875

                            SHA256

                            3301f21b0e9b43873293f712c6a8eccb7746c09207e0cedcfe836d060862c6f8

                            SHA512

                            7dfd8e767be1b7904ff44b90cbc973a577f831db0dc81c44167838146a8912efe3631510fcf37451396206613419ca6d0fa0554a74af1764d50c056a3b66338e

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\tmpB9D5.tmp.bat
                            Filesize

                            150B

                            MD5

                            43d0aa6f5d83ad88fae2f5db1210b7ca

                            SHA1

                            a13fcf8d77d65cd64437be4fdb2d8337568eed40

                            SHA256

                            365c05c1d2f25314f2ca0d98cd53fd103a2a3a621667cef0a361995c6b4b2bb5

                            SHA512

                            d56590bfbbd27065b1c5e10eec0d109fb8bedf477e7c1dbc08c9365c513f544e0e4a6725f0c799f1e83c18b9220ddcea536e47a9a97c4d3bdc680afd1ef0fbf3

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                            Filesize

                            479KB

                            MD5

                            09372174e83dbbf696ee732fd2e875bb

                            SHA1

                            ba360186ba650a769f9303f48b7200fb5eaccee1

                            SHA256

                            c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                            SHA512

                            b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                            Filesize

                            13.8MB

                            MD5

                            0a8747a2ac9ac08ae9508f36c6d75692

                            SHA1

                            b287a96fd6cc12433adb42193dfe06111c38eaf0

                            SHA256

                            32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                            SHA512

                            59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk
                            Filesize

                            2KB

                            MD5

                            62cb4432ca301511f33d0ae8bb8ec28e

                            SHA1

                            1287d9f2c5149a0f27c4d23c8456ceb3683f1b28

                            SHA256

                            ff7962fc71ce138dbfafae94171204380a6dd530cd1d0ed1e2509e08918a49c8

                            SHA512

                            0f5091f5150a18cd15eec78dae5710de812ae282bd51dee81c9b0dc0e5c8472b15bac765c84533b2446d04f32b3c150cc392d330064f16192be5d9f4288fe2ca

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk
                            Filesize

                            2KB

                            MD5

                            4c39b6e278f73f6bd4531137b11cdfb7

                            SHA1

                            ccee7acb7aff8a99c1c21b1d4eee233a0fa6a096

                            SHA256

                            9599cea58dd2d9a36ff5d11301a7d2c5ac59de7999aaf886b8762f8dae631574

                            SHA512

                            420e7008b49ea356cb74e46cd45b4828f4215893ac74d704540f51279c9451e76bf1b62861bd59dd7b157e030a11a72affa302ca725491b715237db9fd5b8b76

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
                            Filesize

                            6KB

                            MD5

                            c0d2831bebcdd3e970ffaa1698aaeabd

                            SHA1

                            367d0865afe75910dc10c5ddb867b881d92febf8

                            SHA256

                            2a02c72f3b5a1668a8879de9e147683a0a2507a6a0b07a910fdb538d3ff4bc5e

                            SHA512

                            f324ddf5f51a9cf9adc1e61930493969c47b3f4e5e92250f44c7a097b1a7c01852985671740488999b87b3e86b205f23d07b87e71f7166c5efdacc092c31294d

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
                            Filesize

                            10KB

                            MD5

                            c2b6d24753d26d509eab30aeb7691ccb

                            SHA1

                            38ead86ece581d79250e741bb89cefccd2f63fd8

                            SHA256

                            d42e4e717ffdeafa2e903a314a93283e40470370f1ae7c1139b704a2a5189960

                            SHA512

                            b0b2bfabfa553b96ba875157daa4ae5de94e69861325dc7f5fda31c7e8bc300e813ecdf7c874039702ee864d0caa36562bc3dd496051f7ad8a4d6ef7e6d8774d

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
                            Filesize

                            18KB

                            MD5

                            afde19b73a89e78d7f9a3c06104cc660

                            SHA1

                            53561386f0c30bfc9fcd35f6919edff0b86f82b2

                            SHA256

                            165da4ae45dcb948037c1daefaac1e60fd18de0021d0a0c741c6b3772e6e97d8

                            SHA512

                            c3db42966478a8f469fe719208f382f6ce3667e98ed0aebca9db9c07318311d09d5b2ded5bc24b1c3427ac8aeb24c079ade70eb485ddde0587fec26976f695ac

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            5KB

                            MD5

                            575741ddc9e9e2e99d5bf9964facc1f0

                            SHA1

                            09f8b30b1446e2f17359affc9f1106f2e16d5436

                            SHA256

                            584d0247c0abc008e28e30162d8890fb66d09848efa926144b084c61c1492c73

                            SHA512

                            1151dc68a3c0ed119f567a142334f7e68f7b74827ea6f0bcc5f1265cd92cead13015de83e847f71b1950e53d24b57ade99395009b14b19af222736df865c125e

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            15KB

                            MD5

                            61b497ad64ef31cdf231c2c0afb0060f

                            SHA1

                            71247bd8d67717583236c213b6c6066add8b3420

                            SHA256

                            9122d29e27a0dc88aa1c315cba27ac457a7ec3b55efe5bec275f51eb2796481c

                            SHA512

                            9b9e4cecebfd5c2d14c4fa52aa1af5de312f0e7ea59541ae5596253789d595da21cd7f13368127614cdb322d37baefe53e6604a8e074fceae397c26cc6baa204

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            6KB

                            MD5

                            b53835b6e93ab003d4c93e7cb71f2fe0

                            SHA1

                            d7bfd95f704dae957b64a591cefd1e6702a3ac32

                            SHA256

                            dff158f8acb12423d0daadbf4054ee3de98b0c8fa50795df2b1b733a4429eb93

                            SHA512

                            7e16f17e540d5abe9a7e588a4e5464dfd2a997b1553ac26c193e0f5fd988ce359a829a475fb57db9fa6664734ac04c66e75b658aba38030ff6e22cebb70338cf

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            6KB

                            MD5

                            c79d66159c4588f3f9ee048a051837cf

                            SHA1

                            4551a00586bc6d34b3da27847a4976403b2689c3

                            SHA256

                            5b6b92dc3fbdb58e9a2b501f93b66ffa67ccc2a1f4a6277bf1fe3ea726cee04a

                            SHA512

                            6da497ed6443b495b57b8bdaca61f13fbbfd2ec387a62cdb4403e277476fad7921a6d7c4ab15aa7659a8654cad4e71f651596167508d52c3d7a0887717b74b6f

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\e712a3cd-0b20-4d10-a6f9-0f89fa03c4f0
                            Filesize

                            982B

                            MD5

                            46b52f5f0aee9777e763987dc88d260c

                            SHA1

                            8948f6159758a538236a34711d91461bb822fe23

                            SHA256

                            7e3963b1fa301251718a88bd415285817edd19315f2bf9488ca31ee8c55de6d3

                            SHA512

                            995f304419470f543898e047a6640a0411e77feba8d6320724a0233749376d2b898f08053c121196c5625e895b8c424f14dd95bdf359da70701b8574dc573887

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\f2ab5249-9a9d-45ca-8335-39e9f1e92e82
                            Filesize

                            671B

                            MD5

                            4141cb356736f3a21fca00ddc50fa886

                            SHA1

                            59142074c156d8c4defcd9cd97b1b7f997ee2a49

                            SHA256

                            4eb945d9b91aae6d41f9eb74a98b2ef8ea2b45bd716c3cb27190de477b1277e3

                            SHA512

                            dd0417878a9ee04f9624793430722541b41061e507d91d5e06eb417b20ab0c382dc9a7b7e81c4ba07dc025dddcb068e3db6dbb0667415fa6c0cd20a963bd1e42

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\f6770b55-593a-4ac6-bca3-b06fac057ed1
                            Filesize

                            24KB

                            MD5

                            0286bde5eadffbc58d652078722a65a6

                            SHA1

                            966fdf53010cc6edf31625e5a44bf94d7cd6e4c4

                            SHA256

                            db807e5e2ab090405a786be72facf4c3fc854e800876266aac1e9dd2a422977d

                            SHA512

                            c514b859031f9cd554e834c81d3fe47ba422251b3d8ea7cc134ba740ffbcb5adab888dcc06c479831d3061a481a17a54337cf8cc85756684d54e7242446e752c

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                            Filesize

                            1.1MB

                            MD5

                            842039753bf41fa5e11b3a1383061a87

                            SHA1

                            3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                            SHA256

                            d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                            SHA512

                            d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                            Filesize

                            116B

                            MD5

                            2a461e9eb87fd1955cea740a3444ee7a

                            SHA1

                            b10755914c713f5a4677494dbe8a686ed458c3c5

                            SHA256

                            4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                            SHA512

                            34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                            Filesize

                            372B

                            MD5

                            bf957ad58b55f64219ab3f793e374316

                            SHA1

                            a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                            SHA256

                            bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                            SHA512

                            79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                            Filesize

                            17.8MB

                            MD5

                            daf7ef3acccab478aaa7d6dc1c60f865

                            SHA1

                            f8246162b97ce4a945feced27b6ea114366ff2ad

                            SHA256

                            bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                            SHA512

                            5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js
                            Filesize

                            12KB

                            MD5

                            43d53f1282b495323763aa7176266892

                            SHA1

                            7d4d9b8dd45b46f1fee537d727ee5151185ab34b

                            SHA256

                            951b791e74f9ccb888095af11256f8e476c90ca06da7cb41da88aa5712727850

                            SHA512

                            67c50ea9014327e73076e9d4fd1cf026761460cd8b255d00ce0c012ac83c6e76bbd3ab6096620a5525deb931d229191e9580b5331b301c1a105d5f350efd017b

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js
                            Filesize

                            15KB

                            MD5

                            4bc4f0b11ef9eac9ec1b0e309b46c35a

                            SHA1

                            525713a535d6a78ca81fccde03e1dc9b510e7b67

                            SHA256

                            a8813040d0d500fda33973899622c92b89487290b429643f877e7f1f19b5ce11

                            SHA512

                            d9a4968e0160e4eab912ef8209f255bf69c7613c90f07f2fe7d66e3eb6f82e2a3174f75b5f2aef2652b336e9ad6f171cd16b9b83528f54245252a874eb3f4197

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs.js
                            Filesize

                            11KB

                            MD5

                            67e10f26f0a6046b53518aeb890b871c

                            SHA1

                            f3d6acbfff1a74750eb6f3ec04196edb98f80d16

                            SHA256

                            b32dec9890cd30b7eab907e576b41af1e5474788878e08b1ad65d08133098909

                            SHA512

                            4595f24756a9ec773f1604c0da94da0d63401aca1c6044cc57f1492e795c94ddee6338f7813d8a01520d97fe70725ccbee78e96b1009bac5f323a468225f7680

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs.js
                            Filesize

                            10KB

                            MD5

                            47228093b23e677bdbb545cf800358f4

                            SHA1

                            fc5935aef888f4dc8d87501ae0b1ed9778581d73

                            SHA256

                            066ee2814b911bf94cad35d84fe7e374dd33e2b3b203454cc77c2f806b9dc394

                            SHA512

                            12715adadde0e3dd8f1761963670527eaa49e566d250f4efefd482272bcf7aa586eaf4f909f2b9e63f654267e55c3a2ac55002cbf630a8419e4c9524e4069fd3

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                            Filesize

                            5.0MB

                            MD5

                            53562dd6a1a8f06768800fd9645d14fb

                            SHA1

                            e34e79abb72fa41411cf2fa0fa477b72df13445c

                            SHA256

                            01f0f58771eb5477104ab31bce54bf919198fd0fba8c0c16a34a06676b70da0d

                            SHA512

                            fbb34ee07fc386533129b0194973c607225d150d1100b8d7e420465ebfeaa8c8e5a8e77312438541d8404f30017bfd29be9eca5df3cc7ba233b332bad025f78c

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Wihnup.exe
                            Filesize

                            256KB

                            MD5

                            8fdf47e0ff70c40ed3a17014aeea4232

                            SHA1

                            e6256a0159688f0560b015da4d967f41cbf8c9bd

                            SHA256

                            ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82

                            SHA512

                            bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be

                            Download Submit

                          • memory/1104-521-0x0000000000030000-0x0000000000358000-memory.dmp

                            Filesize

                            3.2MB

                            Download

                          • memory/1104-22-0x0000000000030000-0x0000000000358000-memory.dmp

                            Filesize

                            3.2MB

                            Download

                          • memory/1104-20-0x0000000000031000-0x0000000000099000-memory.dmp

                            Filesize

                            416KB

                            Download

                          • memory/1104-21-0x0000000000030000-0x0000000000358000-memory.dmp

                            Filesize

                            3.2MB

                            Download

                          • memory/1104-23-0x0000000000030000-0x0000000000358000-memory.dmp

                            Filesize

                            3.2MB

                            Download

                          • memory/1104-16-0x0000000000030000-0x0000000000358000-memory.dmp

                            Filesize

                            3.2MB

                            Download

                          • memory/1104-46-0x0000000000031000-0x0000000000099000-memory.dmp

                            Filesize

                            416KB

                            Download

                          • memory/1104-47-0x0000000000030000-0x0000000000358000-memory.dmp

                            Filesize

                            3.2MB

                            Download

                          • memory/1364-1277-0x0000000004D60000-0x0000000004DD6000-memory.dmp

                            Filesize

                            472KB

                            Download

                          • memory/1364-1278-0x0000000005850000-0x000000000586E000-memory.dmp

                            Filesize

                            120KB

                            Download

                          • memory/1364-1262-0x0000000000100000-0x000000000012C000-memory.dmp

                            Filesize

                            176KB

                            Download

                          • memory/1428-2516-0x00000000009C0000-0x0000000000CC4000-memory.dmp

                            Filesize

                            3.0MB

                            Download

                          • memory/1436-2539-0x00000000001C0000-0x0000000000652000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/1436-2514-0x00000000001C0000-0x0000000000652000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/2276-1299-0x00000000065A0000-0x00000000066D8000-memory.dmp

                            Filesize

                            1.2MB

                            Download

                          • memory/2276-2476-0x0000000006B00000-0x0000000006BA8000-memory.dmp

                            Filesize

                            672KB

                            Download

                          • memory/2276-1298-0x0000000000770000-0x0000000000BD6000-memory.dmp

                            Filesize

                            4.4MB

                            Download

                          • memory/2512-3245-0x0000000000E80000-0x00000000013FC000-memory.dmp

                            Filesize

                            5.5MB

                            Download

                          • memory/2512-3291-0x0000000006DB0000-0x0000000006EF4000-memory.dmp

                            Filesize

                            1.3MB

                            Download

                          • memory/2512-4566-0x0000000007320000-0x00000000073D6000-memory.dmp

                            Filesize

                            728KB

                            Download

                          • memory/2932-2492-0x0000000000F40000-0x00000000013EC000-memory.dmp

                            Filesize

                            4.7MB

                            Download

                          • memory/2932-2518-0x0000000000F40000-0x00000000013EC000-memory.dmp

                            Filesize

                            4.7MB

                            Download

                          • memory/4256-2547-0x0000000000110000-0x0000000000150000-memory.dmp

                            Filesize

                            256KB

                            Download

                          • memory/4256-2548-0x0000000004920000-0x000000000493A000-memory.dmp

                            Filesize

                            104KB

                            Download

                          • memory/4256-2549-0x0000000004AE0000-0x0000000004C3A000-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/4464-1235-0x0000000000030000-0x0000000000358000-memory.dmp

                            Filesize

                            3.2MB

                            Download

                          • memory/4800-2943-0x0000000000030000-0x0000000000358000-memory.dmp

                            Filesize

                            3.2MB

                            Download

                          • memory/4820-91-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-109-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-71-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-65-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-63-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-73-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-75-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-53-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-61-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-1230-0x0000000005710000-0x000000000587E000-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/4820-77-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-1231-0x0000000005420000-0x000000000546C000-memory.dmp

                            Filesize

                            304KB

                            Download

                          • memory/4820-59-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-57-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-81-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-85-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-87-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-89-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-69-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-93-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-95-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-97-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-101-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-103-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-105-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-107-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-111-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-113-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-55-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-2502-0x0000000005650000-0x00000000056A4000-memory.dmp

                            Filesize

                            336KB

                            Download

                          • memory/4820-48-0x0000000000550000-0x00000000007AE000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/4820-49-0x00000000051E0000-0x00000000053DE000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-50-0x0000000005990000-0x0000000005F34000-memory.dmp

                            Filesize

                            5.6MB

                            Download

                          • memory/4820-51-0x0000000005480000-0x0000000005512000-memory.dmp

                            Filesize

                            584KB

                            Download

                          • memory/4820-52-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-99-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-83-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-79-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4820-67-0x00000000051E0000-0x00000000053D8000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4864-3-0x0000000000C00000-0x0000000000F28000-memory.dmp

                            Filesize

                            3.2MB

                            Download

                          • memory/4864-2-0x0000000000C01000-0x0000000000C69000-memory.dmp

                            Filesize

                            416KB

                            Download

                          • memory/4864-0-0x0000000000C00000-0x0000000000F28000-memory.dmp

                            Filesize

                            3.2MB

                            Download

                          • memory/4864-4-0x0000000000C00000-0x0000000000F28000-memory.dmp

                            Filesize

                            3.2MB

                            Download

                          • memory/4864-19-0x0000000000C01000-0x0000000000C69000-memory.dmp

                            Filesize

                            416KB

                            Download

                          • memory/4864-18-0x0000000000C00000-0x0000000000F28000-memory.dmp

                            Filesize

                            3.2MB

                            Download

                          • memory/4864-1-0x0000000077A14000-0x0000000077A16000-memory.dmp

                            Filesize

                            8KB

                            Download

                          • memory/5076-2540-0x0000000000090000-0x0000000000723000-memory.dmp

                            Filesize

                            6.6MB

                            Download

                          • memory/5076-2543-0x0000000000090000-0x0000000000723000-memory.dmp

                            Filesize

                            6.6MB

                            Download

                          • memory/5220-2963-0x0000000000E80000-0x0000000001136000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/5220-2964-0x0000000000E80000-0x0000000001136000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/5220-2980-0x0000000000E80000-0x0000000001136000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/5220-2977-0x0000000000E80000-0x0000000001136000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/5220-2962-0x0000000000E80000-0x0000000001136000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/5596-4611-0x00000000050A0000-0x0000000005106000-memory.dmp

                            Filesize

                            408KB

                            Download

                          • memory/5596-3235-0x00000000049F0000-0x0000000004AB2000-memory.dmp

                            Filesize

                            776KB

                            Download

                          • memory/5596-3228-0x00000000005A0000-0x0000000000600000-memory.dmp

                            Filesize

                            384KB

                            Download

                          • memory/5720-6515-0x0000000000030000-0x0000000000358000-memory.dmp

                            Filesize

                            3.2MB

                            Download