Overview

overview

10

Static

static

3

0abcd43814...cc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-12-2024 16:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0abcd4381407833a5724ca388d337f195d935298479a75a56319964bfd2e8acc.exe

  • Size

    5.4MB

  • MD5

    b4d398c7e8d9a4de32149cf4c462529a

  • SHA1

    3eff0ee04687b011a9c2bfe1ec885dc5c713c6bb

  • SHA256

    0abcd4381407833a5724ca388d337f195d935298479a75a56319964bfd2e8acc

  • SHA512

    e0528f544bda562c4733bcf6d5d67a5d8c9171b95a36c5247dd32c07c54b6faea50741a97522cb060f6fc7eeeef3d9ccada1000fe27b68870c81d11549548553

  • SSDEEP

    98304:sv702jqrtYGVjdjYmmc9JlaoeCoRIzsp8PoHzVcc+F8P37KJAAqZQECU+7QGR:N2jqfVFmeLoRzpw0cc+W7k/qP9+QG

Score
10/10
amadeygcleanerlummastealcxmrig9c9aa5stokdiscoveryevasionexecutionloaderminerpersistencestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
    evasion
  • XMRig Miner payload 10 IoCs
    miner
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 20 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Identifies Wine through registry keys 2 TTPs 10 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Power Settings 1 TTPs 4 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: MapViewOfSection 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\0abcd4381407833a5724ca388d337f195d935298479a75a56319964bfd2e8acc.exe
    "C:\Users\Admin\AppData\Local\Temp\0abcd4381407833a5724ca388d337f195d935298479a75a56319964bfd2e8acc.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2684
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c7m76.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c7m76.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3212
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1V48r3.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1V48r3.exe
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1684
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:948
          • C:\Users\Admin\AppData\Local\Temp\1013469001\249a49b82e.exe
            "C:\Users\Admin\AppData\Local\Temp\1013469001\249a49b82e.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1288
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 1568
              6⤵
              • Program crash
              PID:3764
          • C:\Users\Admin\AppData\Local\Temp\1013470001\9f4b6f193e.exe
            "C:\Users\Admin\AppData\Local\Temp\1013470001\9f4b6f193e.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2032
          • C:\Users\Admin\AppData\Local\Temp\1013471001\2d010b533e.exe
            "C:\Users\Admin\AppData\Local\Temp\1013471001\2d010b533e.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:2944
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM firefox.exe /T
              6⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2768
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM chrome.exe /T
              6⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1296
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM msedge.exe /T
              6⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2596
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM opera.exe /T
              6⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:944
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM brave.exe /T
              6⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:416
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4784
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                7⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:5108
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2040 -parentBuildID 20240401114208 -prefsHandle 1968 -prefMapHandle 1960 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d19c70c6-ccb6-448a-b896-aa7331a4665d} 5108 "\\.\pipe\gecko-crash-server-pipe.5108" gpu
                  8⤵
                    PID:3708
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2452 -prefMapHandle 2448 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bae2cb5f-aeb5-420f-89c9-1310fd5effe7} 5108 "\\.\pipe\gecko-crash-server-pipe.5108" socket
                    8⤵
                      PID:3112
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3300 -childID 1 -isForBrowser -prefsHandle 3128 -prefMapHandle 3324 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9a3912d-b329-4275-9a76-19035beb030b} 5108 "\\.\pipe\gecko-crash-server-pipe.5108" tab
                      8⤵
                        PID:4756
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4132 -childID 2 -isForBrowser -prefsHandle 4124 -prefMapHandle 4120 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b62fafd5-29ce-4af0-b4b0-b57544e13841} 5108 "\\.\pipe\gecko-crash-server-pipe.5108" tab
                        8⤵
                          PID:3192
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4784 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4788 -prefMapHandle 4868 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5067812b-d56c-44d0-87bf-4edd81ed01da} 5108 "\\.\pipe\gecko-crash-server-pipe.5108" utility
                          8⤵
                          • Checks processor information in registry
                          PID:5844
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5188 -childID 3 -isForBrowser -prefsHandle 5180 -prefMapHandle 5176 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0261cfd7-6dc4-48e7-b007-f2a6d17a5e54} 5108 "\\.\pipe\gecko-crash-server-pipe.5108" tab
                          8⤵
                            PID:7000
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4016 -childID 4 -isForBrowser -prefsHandle 5168 -prefMapHandle 5092 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d4648ab-e307-4ebc-836a-2bdf5adba742} 5108 "\\.\pipe\gecko-crash-server-pipe.5108" tab
                            8⤵
                              PID:7128
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5588 -childID 5 -isForBrowser -prefsHandle 5508 -prefMapHandle 5516 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4c1574f-d8d6-4098-8732-1d225be591cf} 5108 "\\.\pipe\gecko-crash-server-pipe.5108" tab
                              8⤵
                                PID:7140
                        • C:\Users\Admin\AppData\Local\Temp\1013472001\e5d97e8c6c.exe
                          "C:\Users\Admin\AppData\Local\Temp\1013472001\e5d97e8c6c.exe"
                          5⤵
                          • Modifies Windows Defender Real-time Protection settings
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Windows security modification
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:6644
                        • C:\Users\Admin\AppData\Local\Temp\1013473001\e0d56f3ea2.exe
                          "C:\Users\Admin\AppData\Local\Temp\1013473001\e0d56f3ea2.exe"
                          5⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5436
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 1592
                            6⤵
                            • Program crash
                            PID:4852
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1013474041\2EW05w7.ps1"
                          5⤵
                          • Blocklisted process makes network request
                          • Command and Scripting Interpreter: PowerShell
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5656
                          • C:\Users\Admin\AppData\Local\Temp\downloaded_file.exe
                            "C:\Users\Admin\AppData\Local\Temp\downloaded_file.exe"
                            6⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: MapViewOfSection
                            PID:6420
                            • C:\Windows\SYSTEM32\cmd.exe
                              cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsSystem\WindowsSystem.exe','C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe'
                              7⤵
                                PID:6456
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsSystem\WindowsSystem.exe','C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe'
                                  8⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:6576
                              • C:\Windows\explorer.exe
                                "C:\Windows\explorer.exe"
                                7⤵
                                • Suspicious behavior: MapViewOfSection
                                PID:6464
                                • C:\Windows\EXPLORER.EXE
                                  C:\Windows\EXPLORER.EXE {DF4EE2DA-C20C-4BBF-97D5-4B94E23FE1C8}
                                  8⤵
                                    PID:6988
                                  • C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe
                                    "C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe" ""
                                    8⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2440
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                      9⤵
                                      • Power Settings
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5220
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                      9⤵
                                      • Power Settings
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3888
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                      9⤵
                                      • Power Settings
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5948
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                      9⤵
                                      • Power Settings
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2780
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      9⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      PID:3604
                                  • C:\Windows\EXPLORER.EXE
                                    C:\Windows\EXPLORER.EXE {DF4EE2DA-C20C-4BBF-97D5-4B94E23FE1C8}
                                    8⤵
                                      PID:5392
                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2R7377.exe
                            C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2R7377.exe
                            3⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1568
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 1592
                              4⤵
                              • Program crash
                              PID:4580
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 1576
                              4⤵
                              • Program crash
                              PID:2340
                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3k57S.exe
                          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3k57S.exe
                          2⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5072
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1568 -ip 1568
                        1⤵
                          PID:2928
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 1568 -ip 1568
                          1⤵
                            PID:4992
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1288 -ip 1288
                            1⤵
                              PID:3844
                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:6204
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5436 -ip 5436
                              1⤵
                                PID:6060
                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5320

                              Network

                              MITRE ATT&CK Enterprise v15

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Command and Scripting Interpreter

                              1
                              T1059

                              PowerShell

                              1
                              T1059.001

                              Persistence

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Power Settings

                              1
                              T1653

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Defense Evasion

                              Impair Defenses

                              2
                              T1562

                              Disable or Modify Tools

                              2
                              T1562.001

                              Modify Registry

                              3
                              T1112

                              Virtualization/Sandbox Evasion

                              2
                              T1497

                              Credential Access

                              Discovery

                              Query Registry

                              6
                              T1012

                              System Information Discovery

                              4
                              T1082

                              System Location Discovery

                              1
                              T1614

                              System Language Discovery

                              1
                              T1614.001

                              Virtualization/Sandbox Evasion

                              2
                              T1497

                              Lateral Movement

                              Collection

                              Command and Control

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe
                                Filesize

                                2.8MB

                                MD5

                                56ec5472231866630749ccf6977c4fbd

                                SHA1

                                03c5fe2e0dd49a554b354e7ef26f794f4aa86e9d

                                SHA256

                                e19905020c9685a68c3f4c9f62f57e4b21bc8dcfad567c89b0b37b42a120182b

                                SHA512

                                46274dfec96406c4bd101c6207c813e03b965e9f9a6b1b57147bcfb7d24a9180002c3b8001ac85a91dfd0b75f0aabba119e455d52fa847a751c32f00e3ad4753

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H6N4U6J0\download[1].htm
                                Filesize

                                1B

                                MD5

                                cfcd208495d565ef66e7dff9f98764da

                                SHA1

                                b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                SHA256

                                5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                SHA512

                                31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                Filesize

                                19KB

                                MD5

                                33372f708bd093493e0329561e8cc5ec

                                SHA1

                                77ceb9a226ba7e9037cf00fd67e82f382c158104

                                SHA256

                                00671d7d596b5d9d1dea8ba2f76de55b00767606ba6b9f7f8ade584e0b42c3b5

                                SHA512

                                2370d7125cae418a3e67148954cc5bb568f13418b196a327fe8f5e97cc49c304f90831a18b34253460db85ad2a51773e153f0683995e2c351e58f26567071f49

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\activity-stream.discovery_stream.json
                                Filesize

                                19KB

                                MD5

                                8f4e19456072d257f9e5d15e67cf181b

                                SHA1

                                35da5b255034943b15d731e6725d625004f9d498

                                SHA256

                                d3d49c19016e8e2684dacd10ae58e0aee442b9659614f8361f6229b681b9695c

                                SHA512

                                0636a949c9fa5f730d54fac06e6915c7dc926e94e491e82cde4a6130bbe2c04077ebcfce0dccbb8bb0fa4ae34403d180e7ab10ad0a75f8268f9e7ae7acf707a5

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                                Filesize

                                13KB

                                MD5

                                38e7943a8ec4444bbf68a22b65340057

                                SHA1

                                0e4d573c949414258e68ea01f5647f7e8a0666d2

                                SHA256

                                35961431905fc84554cb81d31252c06444aaf460c17eea334cbe874d4d8973ce

                                SHA512

                                c00542b22b21f9bcb89d13df7ae9552ac5b3db8139fa4479ddd77eac4fe95b761f6c98300cd31a4617b3e9fae99d85e7ca1fd22c8c62d928d3d1b8f2043991f3

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                Filesize

                                15KB

                                MD5

                                96c542dec016d9ec1ecc4dddfcbaac66

                                SHA1

                                6199f7648bb744efa58acf7b96fee85d938389e4

                                SHA256

                                7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                SHA512

                                cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1013469001\249a49b82e.exe
                                Filesize

                                1.8MB

                                MD5

                                fc730cc04cea274ba94c95faad570950

                                SHA1

                                9959c1e33b3fe4f3e4da5e033f97a39004518b7d

                                SHA256

                                478b4646887cf4961943568f8aef881f2991e0fffaf5d2592939724c6a8c2d78

                                SHA512

                                5eb3af384e548e3ae02a1a0b972394b6a4b40798df44e379d50dd251c1f61eccc0d90460f966de2c3868ed9b521daae7e59c1eef449b02e884ffb96b408a7281

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1013470001\9f4b6f193e.exe
                                Filesize

                                1.7MB

                                MD5

                                be752df2a3bae5d9fbd14d433b351967

                                SHA1

                                64355c823c38b257e469ff717c5ba8a9e0b0bbf2

                                SHA256

                                08570ded4cf2c4a1d44b1837436d241c0392f3c9f35ff96da78ffc80dcdcf0fc

                                SHA512

                                600cb7a8e7832f70909f53ea387c850d8a8b7e255d80f7049ff4833b198ae18cb817460e2343ff92021935c17d4845caa88ecf4ecbad8b832083d6f0fd83b151

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1013471001\2d010b533e.exe
                                Filesize

                                948KB

                                MD5

                                20f205ebc3ddeec636e52a437b8c3c9b

                                SHA1

                                a7d0319411c2b8d115b5fb02f1ef63a37c7ea55f

                                SHA256

                                d1f20d134a92d23683fc218749a27d327a9ac6a35cdcde8bded0854bc05ab3e8

                                SHA512

                                2a7880884aabb5a5cd1677455c38f50d6e97d7ffe11688673f683c76031725fe068acfc0f530bd3d1d574d721566ef9308431595b09cff17840a294b5b19afcb

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1013472001\e5d97e8c6c.exe
                                Filesize

                                2.7MB

                                MD5

                                43c842910f45deae72a62e0819adceb0

                                SHA1

                                fffcc762a5d4753855e62bd845ad39e43c962097

                                SHA256

                                aedb1af233367d2b3facb397055713f112e2fd833e625f07fff1ae723ebc4fb8

                                SHA512

                                c9fca70038e11e562e613d13061e2b68c378ee16bddf7341ca81e3502e07f31d01431f8acb39d35d43444115d96a0ace52d81d352ccbddbbe66773f64cc73fc0

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1013473001\e0d56f3ea2.exe
                                Filesize

                                1.9MB

                                MD5

                                e96cd9e1c8cbc927c9c445e155d5bd75

                                SHA1

                                6c8d7a80cb4635fda0f7b799ace942dcd10b3700

                                SHA256

                                9f1169888c4c2acd65e79928bb27a686204fa3b622b921a7ee56c7a735924eb6

                                SHA512

                                419cb0650a718f7356335745a64d441d8693c48181692bdfb22da508fa993e93772f5ee89ae5085e5ae3d04f28936b57e12e6704291be6acc45041744ba7f413

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1013474041\2EW05w7.ps1
                                Filesize

                                8KB

                                MD5

                                de8938735aac7e7328ab07101836c2e8

                                SHA1

                                1109c9d099e5caa3fdb90c4e45622aaa1d9fa7e3

                                SHA256

                                2a772aefe91cd03f252ecfd3f1141a75506dd52f41c584fb754ba66f0a7accb9

                                SHA512

                                b78b4217ff3e01b998c4c884f10d0bdeeac41b373826b428304587f4929ccff2379f8884aa00e9aa6b9149eaf062009266a6c5fd3792bcb25b4fcaba2597b71c

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\DATABASE
                                Filesize

                                48KB

                                MD5

                                349e6eb110e34a08924d92f6b334801d

                                SHA1

                                bdfb289daff51890cc71697b6322aa4b35ec9169

                                SHA256

                                c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                                SHA512

                                2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3k57S.exe
                                Filesize

                                1.7MB

                                MD5

                                426c4cc5cc662dbf06c9232c69e5d989

                                SHA1

                                66ef4347c88c6f9e42f6fadcd8bc241c3ebff11c

                                SHA256

                                69877dd837ed30807eb6255dd96d4031f1473a677decb52b023e260c1d7aa851

                                SHA512

                                e61545a5c91201fb1a374dfa4f0265e28b0a366ba300e427f5e60d8d745ac94013086d1fb6861f41f9396d4c09c7fff5623d7b8d30831a64b42379250bd5a1c7

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c7m76.exe
                                Filesize

                                3.6MB

                                MD5

                                f08d01e421655cedfe3e42920e73dba4

                                SHA1

                                b3c949460783e15f12ccf08f1306a648cbda305c

                                SHA256

                                b55c049f198870b34c787e0abb93e392ef6d03eda2d6f1900de4c7a204f5619f

                                SHA512

                                c0b7ff499fa1d0537219c758331b8a5ee3a0422bb5abf58a98cdf07b47db589cbbc47d40907c4dd8c6d99a4f7d60fcbe2754db1c08118205ed343788fa987cf3

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1V48r3.exe
                                Filesize

                                3.1MB

                                MD5

                                0bc8514721ccb995fa1072d8f167d532

                                SHA1

                                8ab7107e7adbba9e6fe9362e3bb923706c852797

                                SHA256

                                c87a5e136fafd0da8252d65d01cde92bb27e8da419b57ea32f9522855d0a948d

                                SHA512

                                488f786a09667183a954126bae120c1131015d2aa94eee1d56563e209418d3330aabe5e373d17eb682298fbcc00a801549c039d52a4778ab1c844d28505c6ce5

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2R7377.exe
                                Filesize

                                1.8MB

                                MD5

                                aea9554a885748e0394687cc80792951

                                SHA1

                                6fe6285b185928ece358988782074e7ddf8ac5de

                                SHA256

                                1efbb04fa466e6dbab12ce5eded56ad4a4feb1c6a355ed82ebd15b4f35d51080

                                SHA512

                                56acc112cf707f90eafa2f76a7ae87bd9198fb7175cd2be562ba3d77da8f389e7b6441f7f4e39e58059f71842857b958e75a1c01587d71c3bad6e0d0ff929b8f

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dg0ixhbe.hoj.ps1
                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\downloaded_file.exe
                                Filesize

                                503KB

                                MD5

                                d60c9e070239f8c240aaa6d8832e11ef

                                SHA1

                                aaac23a338a91505c56c3057d22a14bf190a2795

                                SHA256

                                493f1bd7227c4ee9430f8ad226e929908996b97a28f578a850e9b26c393ad2d2

                                SHA512

                                d70cf79dec352bd965f8506ad989375642a8931300d5497724c82882ae4d57ccc314d4e6b24c398075af3deb4433207522106647e70e74c90e56791e20bca42c

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                Filesize

                                479KB

                                MD5

                                09372174e83dbbf696ee732fd2e875bb

                                SHA1

                                ba360186ba650a769f9303f48b7200fb5eaccee1

                                SHA256

                                c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                SHA512

                                b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                Filesize

                                13.8MB

                                MD5

                                0a8747a2ac9ac08ae9508f36c6d75692

                                SHA1

                                b287a96fd6cc12433adb42193dfe06111c38eaf0

                                SHA256

                                32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                SHA512

                                59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
                                Filesize

                                18KB

                                MD5

                                0ed1eee71bedd3e6aee730205cc61f9d

                                SHA1

                                b7527d8afc23542cad7cc84515d14178dbd39b5d

                                SHA256

                                722d2135a7431cf52fd013c6bf89635812363c7d12aefe40cb4e5995b32d8b3d

                                SHA512

                                72ab0b402376094f5903f61fc4a7fde470c6131e8eda547f452e830d229d69c9b76b80d0ac664f583498a6b6908ab1defa394456fde93b35b0ee9c8a6eb80dd8

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
                                Filesize

                                13KB

                                MD5

                                2f67595a8c72a7707e90910f9a64004e

                                SHA1

                                760a7ab11deeb8d59918aad5b4ef03696ef9b0ed

                                SHA256

                                81380de4df1ad91b839295e463ec58229f33b62c5ec16c2b34a336fa70a18f3b

                                SHA512

                                1ff468086331eea6935d7c37d6188a294211adfdd4753b3fe7873b0faa9dfb5f96fd2286d25ec3e1b952a8a1a3ef244919d2b27b844c88c346698d48785bf4f0

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\cert9.db
                                Filesize

                                224KB

                                MD5

                                afe120812e9c9788d5ca4e5a206364e5

                                SHA1

                                329f22142ea600e281c53bcca2facc44a71c4540

                                SHA256

                                4c9817b40ada77f7a26127baa636e5a710aecaf5e7f7b61a75760a91e2879519

                                SHA512

                                dda753bf528c086cccfd7bbb5382dc672eebd4971501df4435fe4c697503aeb52647b6da79e2512772bb0198f70e9a7941a74b647f0f237e57cd1d75d842b82c

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.bin
                                Filesize

                                23KB

                                MD5

                                c91f44d4b245644b22dd3a548ff918bf

                                SHA1

                                9d5dcd8faef5ca10ea024973a67bd990d6c1b3fa

                                SHA256

                                c455eeba1eab820e0546a57f35ae92ef0b5298feab1885aa3ada04b5a61cc0bd

                                SHA512

                                67861d912237d741245880d61c64a7bec210ce1af9ab9ed06b1be405f8eb53df093f1bd2947c799e0a2b467256c061d08d141d8c922af655a5bf236be2912ae2

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.bin
                                Filesize

                                5KB

                                MD5

                                d9acde5cb58b65b76a313598839dac5a

                                SHA1

                                7975c9b0722f0039e1dbd3423d869aafb6e029fb

                                SHA256

                                a57e151317a4f5896bf6feb67b9012a068703b1a18e19b56c4fdaa834f2275fa

                                SHA512

                                0040180bb7c442734590610c8a4a4b653925d72e0502d548881c4c83fd5604bf74f3cf28fa9bfe0912b7f345c446157b62bf1080717a1735fa4c903eb8b2f5af

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.bin
                                Filesize

                                15KB

                                MD5

                                c084f8bb682f1b0da6d9effec93fe52c

                                SHA1

                                26b4c7114c16ef0a14f6af618c425f438f173656

                                SHA256

                                e2218d8f872f95e249e3e984c5f3599912a7de6fefa175bc043b2b2dd0a7c2b0

                                SHA512

                                aac0033b8369efeea3661523b1c7710d34a7359064064b14dabdb0c29353ee97388c9684d39c6368b293b52d0b76cd8b4f02ba2502d631feb173a5b2d43997d9

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                5KB

                                MD5

                                66fd63a18daa491c721e65e04a30fb15

                                SHA1

                                49921791aaf4baca6e01a610c3055401bda29542

                                SHA256

                                6ab73787702ac61068421011a5d73b1a40426e8a09f45829399e59857d22f7f3

                                SHA512

                                6a18b4d921000204475c6a92f01be5948d4d808ac4bbeb45e837eadd02a8bc2c0a5f821fc38bdd25dc82e7c4057d18e5d8ef28e0821a8b8ad834350f30fb045a

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                6KB

                                MD5

                                be5ccbd024933b37aabc32128ee274dc

                                SHA1

                                69c836e93ac26a0f609c26630551f25cb53f15b2

                                SHA256

                                11680554762ab63a9a925d22bda0d03ff946934bf7c5ea68f78ba74eb677ba8c

                                SHA512

                                25678b4b60bfd78f85cae04c0ddfc9d5011ab797d23c16b0f964bb8af18bb970b88ddce8005e9385dae6bb126fa601451f42dc1a1826a5c672a52554c98cbb12

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                6KB

                                MD5

                                adfda7bdb1751a75a32a97c04f060b96

                                SHA1

                                393b1a742b36a24afbdca9e11f961d23fff3149c

                                SHA256

                                3e987fd017b4f645b6e9e77bd9bbe9f088f3e62b912374147fd00d1cf6ced6ee

                                SHA512

                                c362074446103ed23327231ebf510d4cb930710320b82125b41474e7e5e39dd799b3de81e7899efec04a73b4477c71373630ab3c2d5beb8e2d30a0bdc1f492fb

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                6KB

                                MD5

                                b005298e30f52a9d4ae535ca8b772603

                                SHA1

                                2dfb8cec02b42f72adefbed3977591d6d8093a94

                                SHA256

                                e3305011fb597bb09bc8144561700023e7b424b2f6fa142a38fae1ecd07e9d31

                                SHA512

                                122ce4f5f6ef180b8f35ffd7ef62c77605c51f16075bc74023983eeae1bc332507dc8b8e7b0d33a33b8e305afc064f1cb554e58cc5383e351c4cb12103d3d631

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                15KB

                                MD5

                                37a9f6b2ad248102015ea51fccd4537c

                                SHA1

                                af8581ed41bcbcb592f43b232c4ccd059f54e429

                                SHA256

                                348c3a6b37e6420849947811590195ffef46f970ceaeac8638faf4e3857cb6cd

                                SHA512

                                f8db3160552cffd6150eed3eeb9b3c6b23e05cba870677e3c5f78809998774d588debeaed6bb78f636243dc0df866f6fe482b104a7af83a15413cd42276e569a

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\225c9c65-7aa0-46a0-b659-6b3b56158ba0
                                Filesize

                                26KB

                                MD5

                                a1f8b016f7f27842cab3311a15d77783

                                SHA1

                                c531db531ba5b393a0b5cf858866a619b170497c

                                SHA256

                                d964ead94d2c22a554390bd8cad7f13757362afda15e0c20635849465b23ee5f

                                SHA512

                                92f08a6ff7c29a3d35d9ec317a58c3bb9ed01f0db9f1583f23936c6f71ef9b7179b8ce28a10844f3dd017d5e316ed5c83b3b8d11fd8ec339ff8e8f8c0dc50e17

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\c98b2100-4a14-479e-b33c-36317121ad98
                                Filesize

                                982B

                                MD5

                                cc6b922abee2d089ce7e71adf8258a27

                                SHA1

                                23d18162eb791aecccd03471ab6067b9907e8d5b

                                SHA256

                                a43bce6452a8e66145480dcaa0052427807791ef78ada9f50757ed3409bf47db

                                SHA512

                                2a9a6e1d0a8f3107e9b1e66bc968d47cb366114aea325d8222225ac30818318cdf1b473e765917288d2b9874959567a0518e9a54d1bdda3eb53f71be47d12de9

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\dda55387-e96f-47a5-a3f7-b1bca7a0ab7b
                                Filesize

                                671B

                                MD5

                                6f849c6172c71d61f9fb9b6bead52c4d

                                SHA1

                                e607252adcbe7ceff68205966ddf04286a9bd13f

                                SHA256

                                9e041ec8542752f1218816f6de51ecfe73ee75bbcd52e62e5b8ef404a84ac346

                                SHA512

                                fd0aa93fbd6741ca6f3e5672a7f319043dc81dad1cc73f2ae16d85fa957dd7a57b6b3dabe9d66ca8f992afbbc8cdc9faf39b3eaa622c76c1196e0af094c32781

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                Filesize

                                1.1MB

                                MD5

                                842039753bf41fa5e11b3a1383061a87

                                SHA1

                                3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                SHA256

                                d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                SHA512

                                d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                Filesize

                                116B

                                MD5

                                2a461e9eb87fd1955cea740a3444ee7a

                                SHA1

                                b10755914c713f5a4677494dbe8a686ed458c3c5

                                SHA256

                                4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                SHA512

                                34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                Filesize

                                372B

                                MD5

                                bf957ad58b55f64219ab3f793e374316

                                SHA1

                                a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                SHA256

                                bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                SHA512

                                79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                Filesize

                                17.8MB

                                MD5

                                daf7ef3acccab478aaa7d6dc1c60f865

                                SHA1

                                f8246162b97ce4a945feced27b6ea114366ff2ad

                                SHA256

                                bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                SHA512

                                5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
                                Filesize

                                10KB

                                MD5

                                8186c0f765844c916700a668155168f7

                                SHA1

                                7c776dbcde78ae08d78ff14d1914d8b7965f3972

                                SHA256

                                05a37019f9e5c103ead3779237004d586da32e9868ecd7aac1fc2c8c4b10bf72

                                SHA512

                                32d27e966e91d537d216d11ea0121ceadfb82827cbf7a61cf31027e14df8916eab692f28e7d5b4078ecfc07b6d4e06c13b1403e2882a1abc931284291bde8e3b

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
                                Filesize

                                12KB

                                MD5

                                4e31fbdfbc02f370f8b3dca3821c9eeb

                                SHA1

                                8584e37c251271606e7f4332d5de70d8c62ae739

                                SHA256

                                ae41e7ce950a2bb2d0f5ae2dc0ac49b7f8604445ee1fa18dafb4eaac18577f53

                                SHA512

                                9f77066a3e09cfe3cd72a7f6177e1a83e6ba53166f81845b87f8288b5852e7c176665feb5b2eeb9374cf0ca628700c47a33298e91a5e3936e4feb08561bf220e

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
                                Filesize

                                15KB

                                MD5

                                b0dfbd308a48afd03a4b1673f93c9285

                                SHA1

                                b3aa045fa8fd73db3fd4d43a97a34c4b39f4313a

                                SHA256

                                21fcd17eb36e858f57dea1825e4be23517d75c9e766af0e7cdfc2d700586635a

                                SHA512

                                5e3c6985806194abeac35a3fe8136fca3772c1c642cf7bca0be8742400d3927f8a5bb797e71bcaeb915f741881e4308ab901cb1cc41f75f7c6cc1598611c3a0b

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs.js
                                Filesize

                                11KB

                                MD5

                                767f09c4c25f3b14d40b385853a596ad

                                SHA1

                                75cecc764a8e3ca82432105073c7526a4ca9dd1c

                                SHA256

                                7553d36ee18ac2781eb02e379963efd1514b34c16a3b5f118af4e2ca6bb54931

                                SHA512

                                30370051ce824de43cc39d5651f77f44d153861ffee1e81de2da07045bc348c67a3ac15a29ff18262112f117490463b0e5cabd3f891534b5715791c25714bbd0

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\security_state\data.safe.bin
                                Filesize

                                2.9MB

                                MD5

                                1ce77bd202efcc1f225bdefde0b98ffe

                                SHA1

                                1c0dfc0f8bf449dc6fde3713738e2f627895d44a

                                SHA256

                                579d0e8fc0e2698ab5553e99019f3e29c3e2f8f13a69fbfe03575618b40a89d4

                                SHA512

                                cf7f68429e05fd162fe2e178c5e152d3f36ee99e3de6e1299919aabc481f0bd49ba9b036fec3c1cfd96c629caa380be112079d821f0bbd5ffe9e5e47270b832d

                                Download Submit

                              • memory/948-1158-0x0000000000200000-0x0000000000518000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/948-4245-0x0000000000200000-0x0000000000518000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/948-931-0x0000000000200000-0x0000000000518000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/948-4164-0x0000000000200000-0x0000000000518000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/948-30-0x0000000000200000-0x0000000000518000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/948-3259-0x0000000000200000-0x0000000000518000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/948-851-0x0000000000200000-0x0000000000518000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/948-76-0x0000000000200000-0x0000000000518000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/948-60-0x0000000000200000-0x0000000000518000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/1288-59-0x0000000000C90000-0x0000000001146000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1288-61-0x0000000000C90000-0x0000000001146000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1568-37-0x0000000000390000-0x0000000000834000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/1568-38-0x0000000000390000-0x0000000000834000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/1684-16-0x0000000000BB1000-0x0000000000C19000-memory.dmp

                                Filesize

                                416KB

                                Download

                              • memory/1684-18-0x0000000000BB0000-0x0000000000EC8000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/1684-14-0x0000000000BB0000-0x0000000000EC8000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/1684-17-0x0000000000BB0000-0x0000000000EC8000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/1684-33-0x0000000000BB1000-0x0000000000C19000-memory.dmp

                                Filesize

                                416KB

                                Download

                              • memory/1684-32-0x0000000000BB0000-0x0000000000EC8000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/1684-15-0x0000000077154000-0x0000000077156000-memory.dmp

                                Filesize

                                8KB

                                Download

                              • memory/2032-77-0x0000000000550000-0x0000000000BDE000-memory.dmp

                                Filesize

                                6.6MB

                                Download

                              • memory/2032-79-0x0000000000550000-0x0000000000BDE000-memory.dmp

                                Filesize

                                6.6MB

                                Download

                              • memory/2440-1089-0x0000018A1BE50000-0x0000018A1C0CD000-memory.dmp

                                Filesize

                                2.5MB

                                Download

                              • memory/2440-2830-0x00007FF702650000-0x00007FF702918000-memory.dmp

                                Filesize

                                2.8MB

                                Download

                              • memory/2440-3910-0x00007FF702650000-0x00007FF702918000-memory.dmp

                                Filesize

                                2.8MB

                                Download

                              • memory/3604-3905-0x0000000140000000-0x0000000140835000-memory.dmp

                                Filesize

                                8.2MB

                                Download

                              • memory/3604-3908-0x0000000140000000-0x0000000140835000-memory.dmp

                                Filesize

                                8.2MB

                                Download

                              • memory/3604-3899-0x0000000140000000-0x0000000140835000-memory.dmp

                                Filesize

                                8.2MB

                                Download

                              • memory/3604-4253-0x0000000140000000-0x0000000140835000-memory.dmp

                                Filesize

                                8.2MB

                                Download

                              • memory/3604-4251-0x0000000140000000-0x0000000140835000-memory.dmp

                                Filesize

                                8.2MB

                                Download

                              • memory/3604-3904-0x0000000140000000-0x0000000140835000-memory.dmp

                                Filesize

                                8.2MB

                                Download

                              • memory/3604-4076-0x0000000140000000-0x0000000140835000-memory.dmp

                                Filesize

                                8.2MB

                                Download

                              • memory/3604-3902-0x0000000140000000-0x0000000140835000-memory.dmp

                                Filesize

                                8.2MB

                                Download

                              • memory/3604-3903-0x0000000140000000-0x0000000140835000-memory.dmp

                                Filesize

                                8.2MB

                                Download

                              • memory/3604-3907-0x0000000140000000-0x0000000140835000-memory.dmp

                                Filesize

                                8.2MB

                                Download

                              • memory/3604-3909-0x0000000000EC0000-0x0000000000EE0000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/3604-3935-0x0000000140000000-0x0000000140835000-memory.dmp

                                Filesize

                                8.2MB

                                Download

                              • memory/3604-3926-0x0000000140000000-0x0000000140835000-memory.dmp

                                Filesize

                                8.2MB

                                Download

                              • memory/3604-3925-0x0000000140000000-0x0000000140835000-memory.dmp

                                Filesize

                                8.2MB

                                Download

                              • memory/3604-3923-0x0000000140000000-0x0000000140835000-memory.dmp

                                Filesize

                                8.2MB

                                Download

                              • memory/3604-3924-0x0000000140000000-0x0000000140835000-memory.dmp

                                Filesize

                                8.2MB

                                Download

                              • memory/5072-42-0x0000000000340000-0x00000000009D9000-memory.dmp

                                Filesize

                                6.6MB

                                Download

                              • memory/5072-43-0x0000000000340000-0x00000000009D9000-memory.dmp

                                Filesize

                                6.6MB

                                Download

                              • memory/5320-4259-0x0000000000200000-0x0000000000518000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/5436-1293-0x0000000000400000-0x0000000000C67000-memory.dmp

                                Filesize

                                8.4MB

                                Download

                              • memory/5436-933-0x0000000000400000-0x0000000000C67000-memory.dmp

                                Filesize

                                8.4MB

                                Download

                              • memory/5436-932-0x0000000000400000-0x0000000000C67000-memory.dmp

                                Filesize

                                8.4MB

                                Download

                              • memory/5436-870-0x0000000000400000-0x0000000000C67000-memory.dmp

                                Filesize

                                8.4MB

                                Download

                              • memory/5436-913-0x0000000010000000-0x000000001001C000-memory.dmp

                                Filesize

                                112KB

                                Download

                              • memory/5436-3539-0x0000000000400000-0x0000000000C67000-memory.dmp

                                Filesize

                                8.4MB

                                Download

                              • memory/5656-905-0x0000000006420000-0x000000000643E000-memory.dmp

                                Filesize

                                120KB

                                Download

                              • memory/5656-943-0x0000000008190000-0x0000000008226000-memory.dmp

                                Filesize

                                600KB

                                Download

                              • memory/5656-906-0x0000000006460000-0x00000000064AC000-memory.dmp

                                Filesize

                                304KB

                                Download

                              • memory/5656-890-0x0000000002B40000-0x0000000002B76000-memory.dmp

                                Filesize

                                216KB

                                Download

                              • memory/5656-911-0x0000000006A00000-0x0000000006A1A000-memory.dmp

                                Filesize

                                104KB

                                Download

                              • memory/5656-891-0x00000000057E0000-0x0000000005E08000-memory.dmp

                                Filesize

                                6.2MB

                                Download

                              • memory/5656-904-0x0000000005E80000-0x00000000061D4000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/5656-893-0x0000000005630000-0x0000000005696000-memory.dmp

                                Filesize

                                408KB

                                Download

                              • memory/5656-894-0x0000000005E10000-0x0000000005E76000-memory.dmp

                                Filesize

                                408KB

                                Download

                              • memory/5656-910-0x0000000007A70000-0x00000000080EA000-memory.dmp

                                Filesize

                                6.5MB

                                Download

                              • memory/5656-945-0x00000000087E0000-0x0000000008D84000-memory.dmp

                                Filesize

                                5.6MB

                                Download

                              • memory/5656-944-0x0000000007A40000-0x0000000007A62000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/5656-892-0x0000000005490000-0x00000000054B2000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/6204-937-0x0000000000200000-0x0000000000518000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/6464-967-0x0000000000A20000-0x0000000000A90000-memory.dmp

                                Filesize

                                448KB

                                Download

                              • memory/6464-968-0x0000000000A20000-0x0000000000A90000-memory.dmp

                                Filesize

                                448KB

                                Download

                              • memory/6464-970-0x0000000000A20000-0x0000000000A90000-memory.dmp

                                Filesize

                                448KB

                                Download

                              • memory/6464-965-0x0000000000A20000-0x0000000000A90000-memory.dmp

                                Filesize

                                448KB

                                Download

                              • memory/6464-969-0x0000000000A20000-0x0000000000A90000-memory.dmp

                                Filesize

                                448KB

                                Download

                              • memory/6464-966-0x0000000000A20000-0x0000000000A90000-memory.dmp

                                Filesize

                                448KB

                                Download

                              • memory/6464-958-0x0000000000A20000-0x0000000000A90000-memory.dmp

                                Filesize

                                448KB

                                Download

                              • memory/6464-957-0x0000000000370000-0x0000000000372000-memory.dmp

                                Filesize

                                8KB

                                Download

                              • memory/6464-1317-0x0000000000A20000-0x0000000000A90000-memory.dmp

                                Filesize

                                448KB

                                Download

                              • memory/6576-980-0x000001D1C0E80000-0x000001D1C0EA2000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/6644-799-0x0000000000410000-0x00000000006D6000-memory.dmp

                                Filesize

                                2.8MB

                                Download

                              • memory/6644-919-0x0000000000410000-0x00000000006D6000-memory.dmp

                                Filesize

                                2.8MB

                                Download

                              • memory/6644-798-0x0000000000410000-0x00000000006D6000-memory.dmp

                                Filesize

                                2.8MB

                                Download

                              • memory/6644-929-0x0000000000410000-0x00000000006D6000-memory.dmp

                                Filesize

                                2.8MB

                                Download

                              • memory/6644-669-0x0000000000410000-0x00000000006D6000-memory.dmp

                                Filesize

                                2.8MB

                                Download

                              • memory/6988-1097-0x0000000000F90000-0x0000000001093000-memory.dmp

                                Filesize

                                1.0MB

                                Download

                              • memory/6988-1034-0x0000000000B00000-0x0000000000B01000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/6988-1041-0x0000000000F90000-0x0000000001093000-memory.dmp

                                Filesize

                                1.0MB

                                Download

                              • memory/6988-1035-0x0000000000F90000-0x0000000001093000-memory.dmp

                                Filesize

                                1.0MB

                                Download