Overview

overview

10

Static

static

3

7b5e36ef75...cc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-12-2024 22:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7b5e36ef75876c0cbbadfe05d8bb172398b77241195ce3cbdca88f04ddd00ccc.exe

  • Size

    7.0MB

  • MD5

    7e99e0180c3cdb01a938c9529b0e3dd5

  • SHA1

    16245a9866c4fda53e592a2b07a203513da4e64b

  • SHA256

    7b5e36ef75876c0cbbadfe05d8bb172398b77241195ce3cbdca88f04ddd00ccc

  • SHA512

    6bae6f0ce6b4af0e49d900860f18d42e3321f4cbbe9570d5a8be40684f8349df320c4c1fe10d05e669e1b6fa786f55a3b0a4e3c1ef155200765ee1324343b0e3

  • SSDEEP

    196608:VTa9wyhCagIiooxvMQMvX6usrMCRwzf/0Hflcx:taAagIioaU/6JrMCRwzfcHa

Score
10/10
amadeyasyncratgcleanerlummastealc9c9aa5defaultstokdiscoveryevasionloaderpersistencepyinstallerratstealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

https://classify-shed.biz/api

https://drive-connect.cyou/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

205.209.109.10:4449

205.209.109.10:7723
Mutex

clgbfqzkkypxjps

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

https://classify-shed.biz/api

https://drive-connect.cyou/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Async RAT payload 2 IoCs
    rat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 26 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 22 IoCs
  • Identifies Wine through registry keys 2 TTPs 13 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 9 IoCs
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 30 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b5e36ef75876c0cbbadfe05d8bb172398b77241195ce3cbdca88f04ddd00ccc.exe
    "C:\Users\Admin\AppData\Local\Temp\7b5e36ef75876c0cbbadfe05d8bb172398b77241195ce3cbdca88f04ddd00ccc.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1472
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n7P59.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n7P59.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4008
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Z9O66.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Z9O66.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4972
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1g68q1.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1g68q1.exe
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:460
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1636
            • C:\Users\Admin\AppData\Local\Temp\1013229001\0tClIDb.exe
              "C:\Users\Admin\AppData\Local\Temp\1013229001\0tClIDb.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4904
              • C:\Users\Admin\AppData\Local\Temp\1013229001\0tClIDb.exe
                "C:\Users\Admin\AppData\Local\Temp\1013229001\0tClIDb.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4420
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 1420
                  8⤵
                  • Program crash
                  PID:4212
            • C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe
              "C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:3176
              • C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe
                "C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:3920
            • C:\Users\Admin\AppData\Local\Temp\1013509001\45e61c1ad6.exe
              "C:\Users\Admin\AppData\Local\Temp\1013509001\45e61c1ad6.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1140
              • C:\Users\Admin\AppData\Local\Temp\1013509001\45e61c1ad6.exe
                "C:\Users\Admin\AppData\Local\Temp\1013509001\45e61c1ad6.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2684
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 1380
                  8⤵
                  • Program crash
                  PID:948
            • C:\Users\Admin\AppData\Local\Temp\1013545001\n4e23hz.exe
              "C:\Users\Admin\AppData\Local\Temp\1013545001\n4e23hz.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:2860
            • C:\Users\Admin\AppData\Local\Temp\1013546001\d267a1eb33.exe
              "C:\Users\Admin\AppData\Local\Temp\1013546001\d267a1eb33.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1724
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 1532
                7⤵
                • Program crash
                PID:5496
            • C:\Users\Admin\AppData\Local\Temp\1013547001\c6e16f8922.exe
              "C:\Users\Admin\AppData\Local\Temp\1013547001\c6e16f8922.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2328
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 1576
                7⤵
                • Program crash
                PID:5040
            • C:\Users\Admin\AppData\Local\Temp\1013548001\ccf2ecb349.exe
              "C:\Users\Admin\AppData\Local\Temp\1013548001\ccf2ecb349.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3816
            • C:\Users\Admin\AppData\Local\Temp\1013549001\875eed7a0d.exe
              "C:\Users\Admin\AppData\Local\Temp\1013549001\875eed7a0d.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:420
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM firefox.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2840
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM chrome.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3100
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM msedge.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:436
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM opera.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2764
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM brave.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3092
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                7⤵
                  PID:948
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    8⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    PID:892
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2036 -parentBuildID 20240401114208 -prefsHandle 1952 -prefMapHandle 1944 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea9ee635-3598-4fc7-8d9e-541863ea4b39} 892 "\\.\pipe\gecko-crash-server-pipe.892" gpu
                      9⤵
                        PID:1100
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2472 -parentBuildID 20240401114208 -prefsHandle 2468 -prefMapHandle 2464 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b18d658b-e133-46bc-a432-19a90a64e1e0} 892 "\\.\pipe\gecko-crash-server-pipe.892" socket
                        9⤵
                          PID:692
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3304 -childID 1 -isForBrowser -prefsHandle 2944 -prefMapHandle 3000 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1072 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81a2b748-1b87-4fa9-ae7a-802b8c3e0ae8} 892 "\\.\pipe\gecko-crash-server-pipe.892" tab
                          9⤵
                            PID:1220
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4228 -childID 2 -isForBrowser -prefsHandle 4220 -prefMapHandle 4216 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1072 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c06d80a4-387d-425b-8a48-62dbe427a94e} 892 "\\.\pipe\gecko-crash-server-pipe.892" tab
                            9⤵
                              PID:1380
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4800 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4840 -prefMapHandle 4836 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d96c2fd-9989-457a-a3de-6d33f3b11a6b} 892 "\\.\pipe\gecko-crash-server-pipe.892" utility
                              9⤵
                              • Checks processor information in registry
                              PID:5728
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5560 -childID 3 -isForBrowser -prefsHandle 5556 -prefMapHandle 5432 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1072 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {71d9bd0e-29dd-4ecf-867f-b1b2a737a6f7} 892 "\\.\pipe\gecko-crash-server-pipe.892" tab
                              9⤵
                                PID:6076
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5712 -childID 4 -isForBrowser -prefsHandle 5788 -prefMapHandle 5784 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1072 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfb665a1-e1a5-4b78-9bc0-1b0d72fbc75c} 892 "\\.\pipe\gecko-crash-server-pipe.892" tab
                                9⤵
                                  PID:6504
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5760 -childID 5 -isForBrowser -prefsHandle 5764 -prefMapHandle 5708 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1072 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a50d85bd-e294-490d-9639-84a31b77f91c} 892 "\\.\pipe\gecko-crash-server-pipe.892" tab
                                  9⤵
                                    PID:1364
                            • C:\Users\Admin\AppData\Local\Temp\1013550001\1a31c4c717.exe
                              "C:\Users\Admin\AppData\Local\Temp\1013550001\1a31c4c717.exe"
                              6⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4972
                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2H7888.exe
                          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2H7888.exe
                          4⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3676
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 1596
                            5⤵
                            • Program crash
                            PID:4104
                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3p42p.exe
                        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3p42p.exe
                        3⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5016
                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4u735q.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4u735q.exe
                      2⤵
                      • Modifies Windows Defender Real-time Protection settings
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Windows security modification
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4808
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3676 -ip 3676
                    1⤵
                      PID:3628
                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3064
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4420 -ip 4420
                      1⤵
                        PID:4388
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2684 -ip 2684
                        1⤵
                          PID:4544
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2328 -ip 2328
                          1⤵
                            PID:3880
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1724 -ip 1724
                            1⤵
                              PID:5476
                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5600
                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5824

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PGH3GSHW\download[1].htm
                              Filesize

                              1B

                              MD5

                              cfcd208495d565ef66e7dff9f98764da

                              SHA1

                              b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                              SHA256

                              5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                              SHA512

                              31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n4zftpal.default-release\activity-stream.discovery_stream.json
                              Filesize

                              19KB

                              MD5

                              a2c2c1037142b8d72397da8930e90c2b

                              SHA1

                              c7833dbd1d6bed2d6a8ebadb207b1959977ccc95

                              SHA256

                              2de6cab88d748da3de2093522f436b5583df5b060ccd14d336b9bca855d69fee

                              SHA512

                              359ae693d9c0cf34a0e6cef83fa2dbcb581e48b3c5b3870a301c0ea8c35776e35ab229bd575410fdbd3f4a0a4b1757565ee9f9bb25e7313a4396c5541adbf1ab

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n4zftpal.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                              Filesize

                              13KB

                              MD5

                              631d0c419e28d2ee0b4e093e544c87f5

                              SHA1

                              6d134235fd282d818b8e41d01f8dbba814b8d0ef

                              SHA256

                              756f367211e26a16966a4e06283dddd9fbba5c3d41be6baa7ce299e13824b25a

                              SHA512

                              486f2f39a2b1b892017d309f8c3c6f898eccf0dfe3b2ea3c4d77b9f2eb9dd008a73e8893f0ac18bdab2f3fd197d6d2c3017a8ab3b3cfe1b889778d1b781ac1cb

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n4zftpal.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                              Filesize

                              15KB

                              MD5

                              96c542dec016d9ec1ecc4dddfcbaac66

                              SHA1

                              6199f7648bb744efa58acf7b96fee85d938389e4

                              SHA256

                              7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                              SHA512

                              cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1013210001\B3vKvPi.exe
                              Filesize

                              612B

                              MD5

                              e3eb0a1df437f3f97a64aca5952c8ea0

                              SHA1

                              7dd71afcfb14e105e80b0c0d7fce370a28a41f0a

                              SHA256

                              38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521

                              SHA512

                              43573b0cbaac6e2e1646e6217d2d10c40ad10b9db1f4492d6740545e793c891b5e39283a082896c0392b88eb319dfa9392421b1c89c094c9ce9f31b53d37ebaf

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1013229001\0tClIDb.exe
                              Filesize

                              809KB

                              MD5

                              ec31a091e3c06294cade73a10d5cae88

                              SHA1

                              0eadea9ac15955c791ad35ebb2719fb632ce0197

                              SHA256

                              23f46ec28302b106fa23d1db2a513875c7157b803cf32f4f3f94e51ed4ba2d83

                              SHA512

                              827499e195dfea6bbbcd3e92dff81dab77d32418eaa9438fe66d6c35df2c7736b5842afb83e892a2f1c84e8fba1b53f3f300a1b9ed465ecbf2cb55b6544cc328

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe
                              Filesize

                              9.9MB

                              MD5

                              53306653e88891da35bdfc1330a2dafd

                              SHA1

                              0870df54ca24e32bf88ccf00d7dd0ada3a0ea096

                              SHA256

                              fc3471e819eafc1640b51c5c8d4bd36db60dc96d912769fa0dfd619f3ec6ff09

                              SHA512

                              930ff27fc7377eaf0097cc6430f2c5486336c398a7ae08fadbcb0af62490b96c0b9ec3d36455c04e5a79d2405fc0c6f1f6a44b0298f3b6ff46f2a6c591aa51ba

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1013509001\45e61c1ad6.exe
                              Filesize

                              809KB

                              MD5

                              9a2cc9d6c6282e7b2a0ff5649a70b0df

                              SHA1

                              99c7c3969c9ab39261b59f047514ff7de2bc4c07

                              SHA256

                              b08f2b65885b9ae1825d27ddf6dc9189641e0f8817999f4386da55ffcc548287

                              SHA512

                              b61aa465d601a75426129b2096e900c008faeee6d67b729bf3b2fdeef6957934e9bba7353ad55b499c2722f5381c9cc684f867e4c2b7958e743d1a459eae88d7

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1013545001\n4e23hz.exe
                              Filesize

                              1.7MB

                              MD5

                              40f8c17c136d4dc83b130c9467cf6dcc

                              SHA1

                              e9b6049aa7da0af9718f2f4ae91653d9bac403bb

                              SHA256

                              cafb60920939bd2079d96f2e6e73f87632bc15bd72998f864e8968f7aab9623b

                              SHA512

                              6760a0752957535ec45ce3307e31569ac263eb73157d6a424d6e30647651a4e93db7c0378028d9e0ce07e65a357d2bb81047064ccda2f6a13fa7402ee7794c2d

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1013546001\d267a1eb33.exe
                              Filesize

                              1.9MB

                              MD5

                              3acaa0d2f010b5962a1ee0687334660d

                              SHA1

                              0f6c414ffaa5e9052365719ea76c81b795130fe5

                              SHA256

                              617514b5e721e4963f6b93f203452f7988a0f4c30db06748b90bb202331c3e73

                              SHA512

                              af6349f44b5ce73adfeb9186ce201a706b7dcd0109690326bd768f84cb01ea71aa62066b63a33a6f438296e7309418af215228a9e052ab03ad372c14df2fa9bd

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1013547001\c6e16f8922.exe
                              Filesize

                              1.8MB

                              MD5

                              1cfa4d3434f4056fd9d63f5c16c73c76

                              SHA1

                              6c86f5fb5062e2037b6baf1701230bff249f89f7

                              SHA256

                              49d35e116cb2a602f6f457f4003e0247c283b7e659f9f78022e102a25307acb1

                              SHA512

                              2781e457d4353889a963282fb8e572ebea98cf78987ead57385fe6d54c22374c699dbd17c9f74080a838a7f3d8449740ab8698339a7e50a8c4f585ea81c07f0f

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1013548001\ccf2ecb349.exe
                              Filesize

                              1.7MB

                              MD5

                              2a5180fa99c0de75ccd62e94f2aae836

                              SHA1

                              1275aec60dc64f9905643489eb6fd72f89e6c25d

                              SHA256

                              f4550f78fc5ec7db14f88f4fcf5e33f3cfa231eb4d6a31740489e9aa54a29934

                              SHA512

                              4c0af282f816e68ab275f80dded7fca21dee1544b4be22a08ed9efdad166463cad3b388fa1965357d7cbed513a7653245d646456c1747e7e14d2f4b0babc09c9

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1013549001\875eed7a0d.exe
                              Filesize

                              946KB

                              MD5

                              31e83117e3f9c52a9c42bf3b2ab06016

                              SHA1

                              8583f8f8a3264a01dd9991a0f1e0275c0a26f83a

                              SHA256

                              7eed919e39fe9d07c7a3119281e6e261bed4c4769c451101f72e005a04e11078

                              SHA512

                              93295bcfcbae4b055d5124aead7d07510fbb44fa8af8f54cf0eea6471e2e0c8d74c3b3880e190dfc153e60d7f5a58147672d3f08dbf39167600cb54fa8fb1476

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1013550001\1a31c4c717.exe
                              Filesize

                              2.7MB

                              MD5

                              8ac4a1b0cc739478c779d0909f664099

                              SHA1

                              b90363c3750ab3ac2cd36d18356108c8be3b647a

                              SHA256

                              afa4fd51e40bd644b329f993a157df79194ac9820100c3378dacb674dc63ee2c

                              SHA512

                              28afa024a71aefb0491a4af9d328747dab6c1682cb4a9746e3b01fbc5e610063acf186b6cfcb493491e0e24863dcfaff2f6765d69ab71eb8f28a6c40acf2e8a1

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4u735q.exe
                              Filesize

                              2.7MB

                              MD5

                              187e6efd5c162bf3e36d227fba611aa8

                              SHA1

                              d71494b39e30d3cce6c442da8023330c4b549b40

                              SHA256

                              430c83c0fb7108a4cb8f88594d86b227058e951ada65db00d2ecbda1b8e67845

                              SHA512

                              e5a8c21c8cf6185a31b308b6fdb75542d5ec40d664db5ee7a208f4e64c5946d3f8d9c58bd7f46b6747d34cf5bef37a8bdc5d075f0d4df5bcde731f9899f945cb

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n7P59.exe
                              Filesize

                              5.3MB

                              MD5

                              0270d56b5ab8baba72df6eaed96dbf53

                              SHA1

                              63050d2da8d5e39237bbfde1ce9c19961dcd88b5

                              SHA256

                              b81084939d8bce8849be10c01939b4c700ff10d34ff0c2e351c39d2a8d4dd875

                              SHA512

                              136c3c623e554e922093d29027a236ca0a8efc391f236654f03682d4fbcb036178f5e7a2a84b7ff83d0af17f35e83ad457bf9998930255348e74d6650276b562

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3p42p.exe
                              Filesize

                              1.8MB

                              MD5

                              506f8e1a147fa0fe3fa3cebb9152cd8f

                              SHA1

                              c5049f50f6b40392d3477bbf29f3a6c5f38e44e6

                              SHA256

                              3751a2c80b682cd6ff24d123ccb2dab108704ddb73e21df93a6c68815043d220

                              SHA512

                              6c6359772c620838b8070e34206cccb164e0d9691ba931af6af77f5dc5e367ae0bfd24c020c12c3363d2deda2efed7f59633952e8379f1344c832d190a37ad9b

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Z9O66.exe
                              Filesize

                              3.5MB

                              MD5

                              b7787567a1f2b9a827372fdbb76d3944

                              SHA1

                              f4e9ffdf367046fbdf7a65721125c2f096f716ca

                              SHA256

                              5f402bd69210f5d8c83e2321f637b45f3abdc09bd722196a538a392a75e05079

                              SHA512

                              51ef4d342dce3190e19a63316708e98d966845aab6522534a6c6a1f1116f0e7e54d13134bac8cbfb12f716aa42e4069d1ecd823787da487af27a6d23acc5998b

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1g68q1.exe
                              Filesize

                              3.0MB

                              MD5

                              b1d16474d1cce3a573026500af7cdd09

                              SHA1

                              edbfb0ba0fb68b51ba33d881874efdf780d107d7

                              SHA256

                              9f29fb0df6f61aaecd024f58f699e9952d00ffc004af1764740c9eccea66d6a8

                              SHA512

                              c779a79fd10acf03519843c79aec40b36a2304a84534288f79f410642c22afa0f6d9bb6b90cd4bfb00e97d97d9da713e1189741f83361bcc0456520982a238f9

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2H7888.exe
                              Filesize

                              1.8MB

                              MD5

                              477b786c55ec776c0c2d3416bb905197

                              SHA1

                              db2c3b98ab0f1acb2c98f195cb3335baa10d6c03

                              SHA256

                              d6d6e3c25fe6fa50aeb98b6391c233009e81e8e90e91b6f47ec1d972e14780c2

                              SHA512

                              6d4ed2ec263f077a86339a0266e31d409de3cbea2affeb4aedefcd50c0e22eda3c47e3b44997aec4c23ee1874aeb89dc433c567cab77ece83ffbb6b5522ea030

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\_MEI31762\VCRUNTIME140.dll
                              Filesize

                              94KB

                              MD5

                              a87575e7cf8967e481241f13940ee4f7

                              SHA1

                              879098b8a353a39e16c79e6479195d43ce98629e

                              SHA256

                              ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e

                              SHA512

                              e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\_MEI31762\_bz2.pyd
                              Filesize

                              78KB

                              MD5

                              bcf0d58a4c415072dae95db0c5cc7db3

                              SHA1

                              8ce298b7729c3771391a0decd82ab4ae8028c057

                              SHA256

                              d7faf016ef85fdbb6636f74fc17afc245530b1676ec56fc2cc756fe41cd7bf5a

                              SHA512

                              c54d76e50f49249c4e80fc6ce03a5fdec0a79d2ff0880c2fc57d43227a1388869e8f7c3f133ef8760441964da0bf3fc23ef8d3c3e72ce1659d40e8912cb3e9bc

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\_MEI31762\_ctypes.pyd
                              Filesize

                              116KB

                              MD5

                              41a9708af86ae3ebc358e182f67b0fb2

                              SHA1

                              accab901e2746f7da03fab8301f81a737b6cc180

                              SHA256

                              0bd4ed11f2fb097f235b62eb26a00c0cb16815bbf90ab29f191af823a9fed8cf

                              SHA512

                              835f9aa33fdfbb096c31f8ac9a50db9fac35918fc78bce03dae55ea917f738a41f01aee4234a5a91ffa5bdbbd8e529399205592eb0cae3224552c35c098b7843

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\_MEI31762\_lzma.pyd
                              Filesize

                              150KB

                              MD5

                              ba3797d77b4b1f3b089a73c39277b343

                              SHA1

                              364a052731cfe40994c6fef4c51519f7546cd0b1

                              SHA256

                              f904b02720b6498634fc045e3cc2a21c04505c6be81626fe99bdb7c12cc26dc6

                              SHA512

                              5688ae25405ae8c5491898c678402c7a62ec966a8ec77891d9fd397805a5cfcf02d7ae8e2aa27377d65e6ce05b34a7ffdedf3942a091741af0d5bce41628bf7d

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\_MEI31762\_socket.pyd
                              Filesize

                              73KB

                              MD5

                              79c2ff05157ef4ba0a940d1c427c404e

                              SHA1

                              17da75d598deaa480cdd43e282398e860763297b

                              SHA256

                              f3e0e2f3e70ab142e7ce1a4d551c5623a3317fb398d359e3bd8e26d21847f707

                              SHA512

                              f91fc9c65818e74ddc08bbe1ccea49f5f60d6979bc27e1cdb2ef40c2c8a957bd3be7aea5036394abab52d51895290d245fd5c9f84cc3cc554597ae6f85c149e1

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\_MEI31762\base_library.zip
                              Filesize

                              812KB

                              MD5

                              ab6d3149a35e6baddf630cdcefe0dab5

                              SHA1

                              44cdb197e8e549a503f6cfcb867a83bf2214d01c

                              SHA256

                              1d91fa604893531393f83e03e68eb97d2c14c2d957ed33877d2b27b7c30ce059

                              SHA512

                              28a882e86d92d42ff983b68445cc90431c2b65b7ec3abbffb5585a9750d67b8b52a1361e20d4d80ca4a30b927fe543a2e9c9a65c1846e42a112b511ddc59545a

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\_MEI31762\libffi-7.dll
                              Filesize

                              32KB

                              MD5

                              eef7981412be8ea459064d3090f4b3aa

                              SHA1

                              c60da4830ce27afc234b3c3014c583f7f0a5a925

                              SHA256

                              f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

                              SHA512

                              dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\_MEI31762\pyexpat.pyd
                              Filesize

                              187KB

                              MD5

                              f3630fa0ca9cb85bfc865d00ef71f0aa

                              SHA1

                              f176fdb823417abeb54daed210cf0ba3b6e02769

                              SHA256

                              ac1dfb6cdeeadbc386dbd1afdda4d25ba5b9b43a47c97302830d95e2a7f2d056

                              SHA512

                              b8472a69000108d462940f4d2b5a611e00d630df1f8d6041be4f7b05a9fd9f8e8aa5de5fe880323569ac1b6857a09b7b9d27b3268d2a83a81007d94a8b8da0ff

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\_MEI31762\python310.dll
                              Filesize

                              4.2MB

                              MD5

                              c6c37b848273e2509a7b25abe8bf2410

                              SHA1

                              b27cfbd31336da1e9b1f90e8f649a27154411d03

                              SHA256

                              b7a7f3707beab109b66de3e340e3022dd83c3a18f444feb9e982c29cf23c29b8

                              SHA512

                              222ad791304963a4b8c1c6055e02c0c4c47fce2bb404bd4f89c022ff9706e29ca6fa36c72350fbf296c8a0e3e48e3756f969c003dd1eb056cd026efe0b7eba40

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\_MEI31762\select.pyd
                              Filesize

                              25KB

                              MD5

                              431464c4813ed60fbf15a8bf77b0e0ce

                              SHA1

                              9825f6a8898e38c7a7ddc6f0d4b017449fb54794

                              SHA256

                              1f56df23a36132f1e5be4484582c73081516bee67c25ef79beee01180c04c7f0

                              SHA512

                              53175384699a7bb3b93467065992753b73d8f3a09e95e301a1a0386c6a1224fa9ed8fa42c99c1ffbcfa6377b6129e3db96e23750e7f23b4130af77d14ac504a0

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                              Filesize

                              479KB

                              MD5

                              09372174e83dbbf696ee732fd2e875bb

                              SHA1

                              ba360186ba650a769f9303f48b7200fb5eaccee1

                              SHA256

                              c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                              SHA512

                              b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                              Filesize

                              13.8MB

                              MD5

                              0a8747a2ac9ac08ae9508f36c6d75692

                              SHA1

                              b287a96fd6cc12433adb42193dfe06111c38eaf0

                              SHA256

                              32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                              SHA512

                              59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin
                              Filesize

                              12KB

                              MD5

                              c32df3093cf6e786b6f1313f6ec69704

                              SHA1

                              f85c985925b72b7758e53fff3cb640e38ef032b5

                              SHA256

                              a497397afa86feb1dd8d6afcdfa95041a7c8c772fa2e08fb273a0dfd2f34d328

                              SHA512

                              1253b6dec2d03491091d7f2af03f773ad69bde43fd83a878823997cb104c597df9ced0523229f94ebbe783458c4b8e56f03085b997675c594aa7162436e2dd88

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin
                              Filesize

                              6KB

                              MD5

                              a4c457715727f444c2b02608869a2ca3

                              SHA1

                              1260fb2f74b871ec6c2f2c9253017efb8bdd30cc

                              SHA256

                              9b6591cb1725f180d5e0c3ce2196d5c2580295776c1bb1e567e2901cfd7ed7b8

                              SHA512

                              eef279df0c7d01363c7b6ea8a3861af1355027c50605dda18df402ceb67e21c493386c1f497291e8d01de5aac89cc7c1a2547999066c05716749da929e2d6f90

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin
                              Filesize

                              18KB

                              MD5

                              eed2729ac9558ccb38f9db9541ba724a

                              SHA1

                              7f66e34cb1413e58022be12260c9b4c5c4221317

                              SHA256

                              1cb7c66235c6d94fa3b4344b7fc6a5d456e7fb3c231c2b4e7bf04bb6fb4e4af0

                              SHA512

                              31767160f8b4c0787a64363b3852966ee4e2cceb17c0ec84a148ccd25767f8dfd6ff8b47b47d1645f186a252b52081e50eb4069d3c9b6cd45a1e16dff9f6644d

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin
                              Filesize

                              8KB

                              MD5

                              e4219b6b17d6f251e24c8af8881bf37b

                              SHA1

                              cff6e8b70060bac0dbe7f4d87dfd11695b811329

                              SHA256

                              b0b7b07ad650b34e87777ce7396e3c1f128826c46c6c02a082de721413e5f46d

                              SHA512

                              b65fd3f01abb534521262ba0208f94c2fe1b3a692dd228ee1165920025655f039c3fc76cc30085b21eb37155610ecfcccd2874df72867a3cd92ec91329c61e94

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.bin
                              Filesize

                              6KB

                              MD5

                              9ca87ed506515e1842c753989a665764

                              SHA1

                              9d44b2e7f0b7c6b3e2a77e97ac8ffe612d6286f6

                              SHA256

                              2b91c5e78ac5a07d7891c88dc633ec7de12e0ba5713d69a85cf9c3084bb02cfb

                              SHA512

                              83b5ae14d966d8045fb997d1c43af1fefadc60ca470e243eccd480de5adf857d4ea43c53a9936c1ef903430cdc23c6e08cc742bb5c7158a173f9f35dd18740c0

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.bin
                              Filesize

                              23KB

                              MD5

                              8cf66a8665e675088e5ffe2ace1fd76e

                              SHA1

                              7019430405b90861760738eb37add16aefa7190f

                              SHA256

                              bedbe2e810ff211a610c6fd6aea5d1a1059b3861e7d753b9a6aa96295ea2375a

                              SHA512

                              d533614f22fbaf1517e6dac164e7bafd4c22185dd19b8827c1523302419e7699d9e6a2518e0eabb9fba37fe336a1bc8c0cb0ff371b0daa71f6625bc84b05a618

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.bin
                              Filesize

                              5KB

                              MD5

                              a67617afd27b72e876e83dec3bd95522

                              SHA1

                              3ad9b4eecdf934f2b48bcb4423952f8857a8c614

                              SHA256

                              97a6b331edc465dd9b07654733e78b99d6c2db540a1efe24e4595fd8a7eceddd

                              SHA512

                              2b4969efe12868c004f72812a433e6cb7dd633e488a619416e5ee5f92d5023b972c3e035889c6b659d4e24615e2dd48eb8c643705b21c1843aa5c35b03f7493a

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp
                              Filesize

                              5KB

                              MD5

                              332b01349e0160dd524d17ab2e8a798c

                              SHA1

                              eefb42629256402498c82d3dc22c96c3db40441b

                              SHA256

                              577063c97afd43d87ae747abddd98fc479210058dd8f9c1cdd3513e7d118b616

                              SHA512

                              0b151b8418395992f9c1fcffa731d64b75a7378bb792c91b364390a936ca1d824cd5cd4ac868a2cb955854e05a1307798000b02b7439660820aa0aeee27fe08d

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp
                              Filesize

                              15KB

                              MD5

                              0c8112b47528aef16d9226eec211a992

                              SHA1

                              5086e980f888236d421a48c24b6ffd785fe60c8b

                              SHA256

                              f7d723f64be1cd8b176ff6cd3163c83bf274b711b833697e4eab0ebb6d0635f9

                              SHA512

                              4195d4feb0dfd378f6d14685c302217354d88f606ad3835f218bda4a57511bdec9b9aa2fc6bef057e8e680cbc60c7ddfcb0deaeb9b83710d5a389e6fca7a9124

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp
                              Filesize

                              15KB

                              MD5

                              0db85fefa744d17be5a5db9f4daa56a1

                              SHA1

                              fb0df179273b7ca2f81945333f14cea6fea161e7

                              SHA256

                              c726a658103d74eb521c8e9566a5e346d55189e9d76c90bee846fe2bf66b1395

                              SHA512

                              e51e7ed43a5eeb276f11213466f2e25813eed875d3535ebd43a732c092add307dc574ed36320a7882cf363848aea73f005d959f10c848ed4bbe1d22e8e48d035

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp
                              Filesize

                              6KB

                              MD5

                              45dc44c2fdd756d4062e397aa0ee7133

                              SHA1

                              df244923ceac56fb219e4fbcc1a9aa19a01dabcd

                              SHA256

                              19955bca3e7563a6b4e74987f165516822bcdc25f63f8c90fb8cf7b942962f1a

                              SHA512

                              c2b68ab194cf49a1c4b304fdf23db55392c68b93457dd09139146e1d881eb106a8032b75bba78da1d9149bc88f1118c10bc136a054ed94384319608f7b09f7fa

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\05ed283a-612e-40e6-a672-d66208a7e057
                              Filesize

                              982B

                              MD5

                              74d111c21cf6b82d58295d0914f10a10

                              SHA1

                              31961f75d33ffc8bb1b949f7c37427bf191e1940

                              SHA256

                              ee43d309992f5882b1aa40ee1e74e090ca2a3e37a3555156a60e9860ff677238

                              SHA512

                              11b220b101908d765b47b77e5a2d2618bd240552aa941e6b3d559b6f9050343a5371373143b23912ee172d35824c9fa062b0bd743c14a60d5a9ff5fe5614abdc

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\8d38fbc7-8d43-4ffb-af41-90137e2dbfdb
                              Filesize

                              26KB

                              MD5

                              433f636cacbed84eb51da4b1dd7b55c2

                              SHA1

                              2ba47a00ade4391166c8cc739fb549ca983cf9df

                              SHA256

                              24ba32204469e078f59ca67105fbdb206bee9392466a7ed631b61b85b3093596

                              SHA512

                              c2a8d00437f932e1693de36f16f37561fba1dc184a75d61fb7879bc45fc236853c13f1c75680b6de951be8a2b1a0336e5c93232bebe493f8cc546da45f8970bd

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\9a27a650-8fc5-4b8e-91b6-9994dc1c98a9
                              Filesize

                              671B

                              MD5

                              7d1179fba639ceb6b5ff813895d178cc

                              SHA1

                              5ed03fb2c83ad6031c4301361ee32ff8fe9eb8a4

                              SHA256

                              41c664c4beedad65e5f500d56d6ae04f1174fa4ccaf083da8dc3531ee2957571

                              SHA512

                              e8e0192df0fa022c75e0c24c0748c7f8a73d9d120297b615ee11ef5673b1312835e3984d3f6536838cb24605e5adac57b6ec5e97d95101ee534331e75d74b5e8

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                              Filesize

                              1.1MB

                              MD5

                              842039753bf41fa5e11b3a1383061a87

                              SHA1

                              3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                              SHA256

                              d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                              SHA512

                              d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                              Filesize

                              116B

                              MD5

                              2a461e9eb87fd1955cea740a3444ee7a

                              SHA1

                              b10755914c713f5a4677494dbe8a686ed458c3c5

                              SHA256

                              4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                              SHA512

                              34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                              Filesize

                              372B

                              MD5

                              bf957ad58b55f64219ab3f793e374316

                              SHA1

                              a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                              SHA256

                              bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                              SHA512

                              79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                              Filesize

                              17.8MB

                              MD5

                              daf7ef3acccab478aaa7d6dc1c60f865

                              SHA1

                              f8246162b97ce4a945feced27b6ea114366ff2ad

                              SHA256

                              bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                              SHA512

                              5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs-1.js
                              Filesize

                              10KB

                              MD5

                              bda09e4e5f20e962b293d4d7c464f8f8

                              SHA1

                              605a81a92f4b5570a7a4857fe120ee7fb541a0ff

                              SHA256

                              8923d54913bbd50474365972ccadf14522193eec014e27e6f59c0a68f7af4268

                              SHA512

                              404b6b834a305310296ebee6ca8871500d846663ef4d3614f88f2d07f6f0fd1ef08a4376b243aad0da45db1ed75c00edd9a2d5b571ce12d47a8c2162c7543d25

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs-1.js
                              Filesize

                              12KB

                              MD5

                              82a32b988bd2132f86b0b3ee4618d95d

                              SHA1

                              38cbe4679616a504b23c8bf9caea136f776f0d33

                              SHA256

                              64dcccac5795a2c72571dbf6941a33cf3fa35a4d36b8ac79c9c738ef85c80fed

                              SHA512

                              7773f43db85f797ad6f878d06d4976c510e8411064cd71671d4118ea17318c6e40b17b75856b3d86efe63483fbdde525660326028d1a68bdaa69c1bb319f5f9b

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs-1.js
                              Filesize

                              15KB

                              MD5

                              df15feda4e0576e0aaf3423afb893909

                              SHA1

                              d7725fb261f6ece47fc386f324b064bdf8064bce

                              SHA256

                              c0be791bb37761370e4f5ed4fd213ca3e2626c53fc10fc1130767a279f02f2d6

                              SHA512

                              c03942807a10799ec97b9d14a9619fc64ffde7736953b5e2b9857fba9e835e0d797f04412ef64e9cd49712437ff4441c30ac70fb34f21ff56f3ff71bc693d8d5

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs.js
                              Filesize

                              11KB

                              MD5

                              4f378f7b5eb700863e63065adc89fe35

                              SHA1

                              10e4703a4d338d360cf6113d8657065f34c56c04

                              SHA256

                              b27741e6858d19848fd1999f03db30f5d9f67fd0bd8a86c91a973ed197336d71

                              SHA512

                              65e87b0daec9346f7c7f253f335a23f322b04d1b49131e58f135aa9ee6b1b622e30308f7a06e15c5116db1c8e8ec720d8a171d40d1ebb8c14a7226f0a9af3fa5

                              Download Submit

                            • memory/460-21-0x0000000000A60000-0x0000000000D6C000-memory.dmp

                              Filesize

                              3.0MB

                              Download

                            • memory/460-35-0x0000000000A60000-0x0000000000D6C000-memory.dmp

                              Filesize

                              3.0MB

                              Download

                            • memory/1636-3780-0x0000000000EA0000-0x00000000011AC000-memory.dmp

                              Filesize

                              3.0MB

                              Download

                            • memory/1636-3567-0x0000000000EA0000-0x00000000011AC000-memory.dmp

                              Filesize

                              3.0MB

                              Download

                            • memory/1636-84-0x0000000000EA0000-0x00000000011AC000-memory.dmp

                              Filesize

                              3.0MB

                              Download

                            • memory/1636-3788-0x0000000000EA0000-0x00000000011AC000-memory.dmp

                              Filesize

                              3.0MB

                              Download

                            • memory/1636-3793-0x0000000000EA0000-0x00000000011AC000-memory.dmp

                              Filesize

                              3.0MB

                              Download

                            • memory/1636-275-0x0000000000EA0000-0x00000000011AC000-memory.dmp

                              Filesize

                              3.0MB

                              Download

                            • memory/1636-1878-0x0000000000EA0000-0x00000000011AC000-memory.dmp

                              Filesize

                              3.0MB

                              Download

                            • memory/1636-3795-0x0000000000EA0000-0x00000000011AC000-memory.dmp

                              Filesize

                              3.0MB

                              Download

                            • memory/1636-229-0x0000000000EA0000-0x00000000011AC000-memory.dmp

                              Filesize

                              3.0MB

                              Download

                            • memory/1636-32-0x0000000000EA0000-0x00000000011AC000-memory.dmp

                              Filesize

                              3.0MB

                              Download

                            • memory/1636-343-0x0000000000EA0000-0x00000000011AC000-memory.dmp

                              Filesize

                              3.0MB

                              Download

                            • memory/1636-3776-0x0000000000EA0000-0x00000000011AC000-memory.dmp

                              Filesize

                              3.0MB

                              Download

                            • memory/1636-72-0x0000000000EA0000-0x00000000011AC000-memory.dmp

                              Filesize

                              3.0MB

                              Download

                            • memory/1636-1094-0x0000000000EA0000-0x00000000011AC000-memory.dmp

                              Filesize

                              3.0MB

                              Download

                            • memory/1636-90-0x0000000000EA0000-0x00000000011AC000-memory.dmp

                              Filesize

                              3.0MB

                              Download

                            • memory/1636-1122-0x0000000000EA0000-0x00000000011AC000-memory.dmp

                              Filesize

                              3.0MB

                              Download

                            • memory/1724-1115-0x0000000000400000-0x0000000000C61000-memory.dmp

                              Filesize

                              8.4MB

                              Download

                            • memory/1724-1086-0x0000000000400000-0x0000000000C61000-memory.dmp

                              Filesize

                              8.4MB

                              Download

                            • memory/1724-323-0x0000000000400000-0x0000000000C61000-memory.dmp

                              Filesize

                              8.4MB

                              Download

                            • memory/1724-273-0x0000000000400000-0x0000000000C61000-memory.dmp

                              Filesize

                              8.4MB

                              Download

                            • memory/1724-321-0x0000000000400000-0x0000000000C61000-memory.dmp

                              Filesize

                              8.4MB

                              Download

                            • memory/1724-279-0x0000000010000000-0x000000001001C000-memory.dmp

                              Filesize

                              112KB

                              Download

                            • memory/2328-299-0x00000000009D0000-0x0000000000E66000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/2328-302-0x00000000009D0000-0x0000000000E66000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/2684-228-0x0000000000400000-0x0000000000457000-memory.dmp

                              Filesize

                              348KB

                              Download

                            • memory/2684-224-0x0000000000400000-0x0000000000457000-memory.dmp

                              Filesize

                              348KB

                              Download

                            • memory/2684-226-0x0000000000400000-0x0000000000457000-memory.dmp

                              Filesize

                              348KB

                              Download

                            • memory/2860-1091-0x0000000008BD0000-0x0000000008C36000-memory.dmp

                              Filesize

                              408KB

                              Download

                            • memory/2860-250-0x0000000000DB0000-0x0000000001212000-memory.dmp

                              Filesize

                              4.4MB

                              Download

                            • memory/2860-298-0x0000000000DB0000-0x0000000001212000-memory.dmp

                              Filesize

                              4.4MB

                              Download

                            • memory/2860-254-0x0000000007970000-0x000000000797A000-memory.dmp

                              Filesize

                              40KB

                              Download

                            • memory/2860-1090-0x00000000086B0000-0x000000000874C000-memory.dmp

                              Filesize

                              624KB

                              Download

                            • memory/2860-248-0x0000000000DB0000-0x0000000001212000-memory.dmp

                              Filesize

                              4.4MB

                              Download

                            • memory/2860-253-0x00000000079A0000-0x0000000007A32000-memory.dmp

                              Filesize

                              584KB

                              Download

                            • memory/2860-249-0x0000000000DB0000-0x0000000001212000-memory.dmp

                              Filesize

                              4.4MB

                              Download

                            • memory/2860-251-0x0000000007B60000-0x0000000008104000-memory.dmp

                              Filesize

                              5.6MB

                              Download

                            • memory/3064-83-0x0000000000EA0000-0x00000000011AC000-memory.dmp

                              Filesize

                              3.0MB

                              Download

                            • memory/3064-82-0x0000000000EA0000-0x00000000011AC000-memory.dmp

                              Filesize

                              3.0MB

                              Download

                            • memory/3676-40-0x0000000000830000-0x0000000000CC9000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3676-39-0x0000000000830000-0x0000000000CC9000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3816-320-0x0000000000C30000-0x00000000012C5000-memory.dmp

                              Filesize

                              6.6MB

                              Download

                            • memory/3816-318-0x0000000000C30000-0x00000000012C5000-memory.dmp

                              Filesize

                              6.6MB

                              Download

                            • memory/4420-78-0x0000000000400000-0x0000000000457000-memory.dmp

                              Filesize

                              348KB

                              Download

                            • memory/4420-76-0x0000000000400000-0x0000000000457000-memory.dmp

                              Filesize

                              348KB

                              Download

                            • memory/4420-80-0x0000000000400000-0x0000000000457000-memory.dmp

                              Filesize

                              348KB

                              Download

                            • memory/4808-59-0x0000000000510000-0x00000000007D4000-memory.dmp

                              Filesize

                              2.8MB

                              Download

                            • memory/4808-85-0x0000000000510000-0x00000000007D4000-memory.dmp

                              Filesize

                              2.8MB

                              Download

                            • memory/4808-89-0x0000000000510000-0x00000000007D4000-memory.dmp

                              Filesize

                              2.8MB

                              Download

                            • memory/4808-49-0x0000000000510000-0x00000000007D4000-memory.dmp

                              Filesize

                              2.8MB

                              Download

                            • memory/4808-58-0x0000000000510000-0x00000000007D4000-memory.dmp

                              Filesize

                              2.8MB

                              Download

                            • memory/4972-1107-0x0000000000160000-0x0000000000422000-memory.dmp

                              Filesize

                              2.8MB

                              Download

                            • memory/4972-1022-0x0000000000160000-0x0000000000422000-memory.dmp

                              Filesize

                              2.8MB

                              Download

                            • memory/4972-1054-0x0000000000160000-0x0000000000422000-memory.dmp

                              Filesize

                              2.8MB

                              Download

                            • memory/4972-1104-0x0000000000160000-0x0000000000422000-memory.dmp

                              Filesize

                              2.8MB

                              Download

                            • memory/4972-1055-0x0000000000160000-0x0000000000422000-memory.dmp

                              Filesize

                              2.8MB

                              Download

                            • memory/5016-45-0x00000000006B0000-0x0000000000D5B000-memory.dmp

                              Filesize

                              6.7MB

                              Download

                            • memory/5016-44-0x00000000006B0000-0x0000000000D5B000-memory.dmp

                              Filesize

                              6.7MB

                              Download

                            • memory/5600-1121-0x0000000000EA0000-0x00000000011AC000-memory.dmp

                              Filesize

                              3.0MB

                              Download

                            • memory/5824-3792-0x0000000000EA0000-0x00000000011AC000-memory.dmp

                              Filesize

                              3.0MB

                              Download