amadey | 979d0afc028909c072becc2cd307df23e712245ef9f941d1d3c13701481538f9

Analysis

max time kernel
14s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2024 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

979d0afc028909c072becc2cd307df23e712245ef9f941d1d3c13701481538f9.exe
Size

7.0MB
MD5

9192d3a975a4254e97de82abb25f9022
SHA1

a2bdcc5bdf0b3772c83654df68d1f1f55846ad7d
SHA256

979d0afc028909c072becc2cd307df23e712245ef9f941d1d3c13701481538f9
SHA512

30a6201f4c5fd73d254675472c891720c79dd17420bb0fca14874acb776bfc5cfc48c7b262385b3bbe2b24000da2e1173e7e17cfb61e68e85d30f4d3f198cbfb
SSDEEP

196608:CAKj/44rDQy5AlPlRXH73MSAJmIks9p6OoKaN:EsyDR5uNR3HAJd/6TK

Score

10^/10

amadey gcleaner lumma stealc 9c9aa5 stok credential_access discovery evasion loader persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

https://tacitglibbr.biz/api

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://ratiomun.cyou/api

https://drive-connect.cyou/api

Extracted

Family

stealc

Botnet

stok

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Extracted

Family

lumma

https://tacitglibbr.biz/api

https://immureprech.biz/api

https://deafeninggeh.biz/api

https://effecterectz.xyz/api

https://diffuculttan.xyz/api

https://debonairnukk.xyz/api

https://wrathful-jammy.cyou/api

https://awake-weaves.cyou/api

https://sordid-snaked.cyou/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1V47m0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2D8956.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3p73w.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4e232h.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4e232h.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4e232h.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1V47m0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1V47m0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3p73w.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3p73w.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2D8956.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2D8956.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	1V47m0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	skotes.exe

Executes dropped EXE 10 IoCs

pid	Process
1924	O3P59.exe
2736	o2T35.exe
1496	1V47m0.exe
4624	skotes.exe
4572	2D8956.exe
3432	skotes.exe
888	TdDkUco.exe
4244	3p73w.exe
1368	4e232h.exe
4688	pcrndBC.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	1V47m0.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	2D8956.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	3p73w.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	4e232h.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	979d0afc028909c072becc2cd307df23e712245ef9f941d1d3c13701481538f9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	O3P59.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	o2T35.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0007000000023c95-193.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
1496	1V47m0.exe
4624	skotes.exe
4572	2D8956.exe
3432	skotes.exe
4244	3p73w.exe
1368	4e232h.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	1V47m0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4616	888	WerFault.exe	90
3548	4688	WerFault.exe	98
3160	3796	WerFault.exe	126
6140	388	WerFault.exe	114

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2D8956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4e232h.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pcrndBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	979d0afc028909c072becc2cd307df23e712245ef9f941d1d3c13701481538f9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	O3P59.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TdDkUco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3p73w.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	o2T35.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1V47m0.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TdDkUco.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	TdDkUco.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
452	timeout.exe
3628	timeout.exe
2992	timeout.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
2840	taskkill.exe
4152	taskkill.exe
3260	taskkill.exe
4736	taskkill.exe
3336	taskkill.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1496	1V47m0.exe
1496	1V47m0.exe
4624	skotes.exe
4624	skotes.exe
4572	2D8956.exe
4572	2D8956.exe
3432	skotes.exe
3432	skotes.exe
4244	3p73w.exe
4244	3p73w.exe
1368	4e232h.exe
1368	4e232h.exe
888	TdDkUco.exe
888	TdDkUco.exe
1368	4e232h.exe
1368	4e232h.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1368	4e232h.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1496	1V47m0.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1924	2228	979d0afc028909c072becc2cd307df23e712245ef9f941d1d3c13701481538f9.exe	83
PID 2228 wrote to memory of 1924	2228	979d0afc028909c072becc2cd307df23e712245ef9f941d1d3c13701481538f9.exe	83
PID 2228 wrote to memory of 1924	2228	979d0afc028909c072becc2cd307df23e712245ef9f941d1d3c13701481538f9.exe	83
PID 1924 wrote to memory of 2736	1924	O3P59.exe	84
PID 1924 wrote to memory of 2736	1924	O3P59.exe	84
PID 1924 wrote to memory of 2736	1924	O3P59.exe	84
PID 2736 wrote to memory of 1496	2736	o2T35.exe	85
PID 2736 wrote to memory of 1496	2736	o2T35.exe	85
PID 2736 wrote to memory of 1496	2736	o2T35.exe	85
PID 1496 wrote to memory of 4624	1496	1V47m0.exe	86
PID 1496 wrote to memory of 4624	1496	1V47m0.exe	86
PID 1496 wrote to memory of 4624	1496	1V47m0.exe	86
PID 2736 wrote to memory of 4572	2736	o2T35.exe	87
PID 2736 wrote to memory of 4572	2736	o2T35.exe	87
PID 2736 wrote to memory of 4572	2736	o2T35.exe	87
PID 4624 wrote to memory of 888	4624	skotes.exe	90
PID 4624 wrote to memory of 888	4624	skotes.exe	90
PID 4624 wrote to memory of 888	4624	skotes.exe	90
PID 1924 wrote to memory of 4244	1924	O3P59.exe	91
PID 1924 wrote to memory of 4244	1924	O3P59.exe	91
PID 1924 wrote to memory of 4244	1924	O3P59.exe	91
PID 2228 wrote to memory of 1368	2228	979d0afc028909c072becc2cd307df23e712245ef9f941d1d3c13701481538f9.exe	95
PID 2228 wrote to memory of 1368	2228	979d0afc028909c072becc2cd307df23e712245ef9f941d1d3c13701481538f9.exe	95
PID 2228 wrote to memory of 1368	2228	979d0afc028909c072becc2cd307df23e712245ef9f941d1d3c13701481538f9.exe	95
PID 4624 wrote to memory of 4688	4624	skotes.exe	98
PID 4624 wrote to memory of 4688	4624	skotes.exe	98
PID 4624 wrote to memory of 4688	4624	skotes.exe	98

C:\Users\Admin\AppData\Local\Temp\979d0afc028909c072becc2cd307df23e712245ef9f941d1d3c13701481538f9.exe
"C:\Users\Admin\AppData\Local\Temp\979d0afc028909c072becc2cd307df23e712245ef9f941d1d3c13701481538f9.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\O3P59.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\O3P59.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o2T35.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o2T35.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1V47m0.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1V47m0.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\1014321001\TdDkUco.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014321001\TdDkUco.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:888
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1014321001\TdDkUco.exe" & rd /s /q "C:\ProgramData\1D2DTRQIEU37" & exit
        7⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        8⤵
        Delays execution with timeout.exe
        
        PID:452
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 2176
        7⤵
        Program crash
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\1014323001\pcrndBC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014323001\pcrndBC.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4688
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1014323001\pcrndBC.exe" & rd /s /q "C:\ProgramData\LXLXT2689RQI" & exit
        7⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        8⤵
        Delays execution with timeout.exe
        
        PID:3628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 2060
        7⤵
        Program crash
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\1014341001\e8f05a83f1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014341001\e8f05a83f1.exe"
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\1014342001\2ee381f2eb.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014342001\2ee381f2eb.exe"
        6⤵
        
        PID:388
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 780
        7⤵
        Program crash
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\1014343001\f7c45c456a.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014343001\f7c45c456a.exe"
        6⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\1014343001\f7c45c456a.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014343001\f7c45c456a.exe"
        7⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\1014344001\05c7d4c164.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014344001\05c7d4c164.exe"
        6⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1014344001\05c7d4c164.exe" & rd /s /q "C:\ProgramData\LXLXT2689RQI" & exit
        7⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        8⤵
        Delays execution with timeout.exe
        
        PID:2992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 2004
        7⤵
        Program crash
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\1014345001\b2e4a7f3cf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014345001\b2e4a7f3cf.exe"
        6⤵
        
        PID:864
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        7⤵
        Kills process with taskkill
        
        PID:2840
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        7⤵
        Kills process with taskkill
        
        PID:4152
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        7⤵
        Kills process with taskkill
        
        PID:3260
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        7⤵
        Kills process with taskkill
        
        PID:4736
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        7⤵
        Kills process with taskkill
        
        PID:3336
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        7⤵
        
        PID:5044
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        8⤵
        
        PID:4104
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2076 -parentBuildID 20240401114208 -prefsHandle 2000 -prefMapHandle 1992 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec1658d1-2590-4645-a633-baaac4b4d30c} 4104 "\\.\pipe\gecko-crash-server-pipe.4104" gpu
        9⤵
        
        PID:4388
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2508 -parentBuildID 20240401114208 -prefsHandle 2500 -prefMapHandle 2488 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {19ecb47d-d559-45fd-bb8a-3c5ce7335e91} 4104 "\\.\pipe\gecko-crash-server-pipe.4104" socket
        9⤵
        
        PID:744
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3184 -childID 1 -isForBrowser -prefsHandle 3160 -prefMapHandle 3156 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 988 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c99c01c-24e3-4303-8d70-1797e20eaf6c} 4104 "\\.\pipe\gecko-crash-server-pipe.4104" tab
        9⤵
        
        PID:812
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4092 -childID 2 -isForBrowser -prefsHandle 4084 -prefMapHandle 4080 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 988 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {beb7400f-17ce-429b-80c9-81f2df65a083} 4104 "\\.\pipe\gecko-crash-server-pipe.4104" tab
        9⤵
        
        PID:4508
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4744 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4748 -prefMapHandle 4760 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8b2843b-24e3-45df-b8b2-3163457a3066} 4104 "\\.\pipe\gecko-crash-server-pipe.4104" utility
        9⤵
        
        PID:2784
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5372 -childID 3 -isForBrowser -prefsHandle 5464 -prefMapHandle 5476 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 988 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6947b14b-3f79-4fdb-a955-005ade09e64e} 4104 "\\.\pipe\gecko-crash-server-pipe.4104" tab
        9⤵
        
        PID:5288
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5616 -childID 4 -isForBrowser -prefsHandle 5624 -prefMapHandle 5628 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 988 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6322437e-e30f-4cc1-b776-6e7aece4ba4c} 4104 "\\.\pipe\gecko-crash-server-pipe.4104" tab
        9⤵
        
        PID:5260
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5916 -childID 5 -isForBrowser -prefsHandle 5792 -prefMapHandle 5600 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 988 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {11768637-0ccc-42d8-8057-ed15cdc421fd} 4104 "\\.\pipe\gecko-crash-server-pipe.4104" tab
        9⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\1014346001\5f6e18a357.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014346001\5f6e18a357.exe"
        6⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\1014347001\11210e53aa.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014347001\11210e53aa.exe"
        6⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\1014348001\1778b32337.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014348001\1778b32337.exe"
        6⤵
        
        PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2D8956.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2D8956.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4572
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3p73w.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3p73w.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4244
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4e232h.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4e232h.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1368

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 888 -ip 888
1⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4688 -ip 4688
1⤵
PID:3944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3796 -ip 3796
1⤵
PID:1280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 388 -ip 388
1⤵
PID:6108

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
PID:7000

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
PID:6920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9452F411289BE952D2567554C2622C59

Filesize
345B

MD5
b7896b50af5e87b166787ca6990fe0f6

SHA1
86591f092ea7eb55c6c4db7bbec76204d95e69b8

SHA256
be60d9c4534a7d25de54922942ea611b6399a5cded28bd5ba170de9cf4462801

SHA512
097fce9a60561012d9a5ddb9ab8be79f7f82e14b3c3355fb227e8383f6d7f58dfd29a76eb47b2d0b182ea532039b0860409bd4c732ac9b5de14d5a0fb65a9398

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
23e8401bac61c153efb7b8f0388a8200

SHA1
5ec11edba84df0ec7bb08d03a56767cdb875ce0b

SHA256
2aca8b18ec0a75552e691ddf11ce264ae3723f7c394e4d0c565a47839ed6a887

SHA512
5a258549fe48a1de008e8097b897d2d03816dcb18f366795d803331f71c0783c05f795acec263c7e5e16f0c872dd65f01328ba87d1446eff8cf2b71fcd0110d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9452F411289BE952D2567554C2622C59

Filesize
548B

MD5
e58a7179ef9bfbc86205c69dd40d6630

SHA1
5c858dbc9767c6fa7c5058cd9878d11f2d5ba4d9

SHA256
be7557440c2dafb397b9f24a45bd76f93d15f5fa9d54591d547416be5ffc7a59

SHA512
9a8047f4b8be9eb2ce1b9fbd382fdfc76091ce4e36278f18c6375eb71b97368858e9ede15014098fdbc7353f58817aee1a9fce19024258eef943188ef5c1b973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9IEW0KLU\download[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\activity-stream.discovery_stream.json

Filesize
22KB

MD5
aaf047cf53a7f85abafac0aa35149153

SHA1
b47dfcb41abadd387389ed27967cb68d9767dec3

SHA256
3462abad20628e62f4cfd89e33719c45e745264dfd04eff52a611b4786fce95f

SHA512
01fea5a615a718c88781c3cb42c8ca7bec168bd074aee4a0648505279a8fdea4a11b0226a68a1952ca536e1138a047dde5079cd781e519a263177836f6f8dd81

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984

Filesize
13KB

MD5
cac5856141cd21628cb930a730f2d4e2

SHA1
79d2ed6e377597f8a3fb9c24bf592a884565e387

SHA256
12db47393dfc986905b79d7c58b06738dd6253cc91c873dbe7a3a0dae624a8a0

SHA512
075f47b3b644b8697dd1156dbf58606e76acb282376b861867161e7431b4ea340f921691989bc409c52ceca1620599079c132322be3d2a911f3a4755c943c72f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014321001\TdDkUco.exe

Filesize
384KB

MD5
dfd5f78a711fa92337010ecc028470b4

SHA1
1a389091178f2be8ce486cd860de16263f8e902e

SHA256
da96f2eb74e60de791961ef3800c36a5e12202fe97ae5d2fcfc1fe404bc13c0d

SHA512
a3673074919039a2dc854b0f91d1e1a69724056594e33559741f53594e0f6e61e3d99ec664d541b17f09ffdebc2de1b042eec19ca8477fac86359c703f8c9656

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014341001\e8f05a83f1.exe

Filesize
1.8MB

MD5
9d09272ac982d62d77946b1f957b6112

SHA1
f431d0c1aeed11eaa7a51d97a1a00e0c1f0530c2

SHA256
33b1f3d3f016753911b3e9efeb89ad133c855cd6e4850c0b43b1842ee90ad7fc

SHA512
33c1299c43775a31f27dd2b9747734efc8825b74f8237b489d334126917d0202a3477b4677ea674237a65ba475faac4a24b3a5e6b568d3e1eca9367b34767f4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014342001\2ee381f2eb.exe

Filesize
1.8MB

MD5
e72fd16086a8ecf58337b89509435373

SHA1
8352b01f92cdfa8e5c932513e2ef6363a6a5871c

SHA256
1e76927aa56820767353dd841c3f309f91eb10decead250755a984791efad821

SHA512
3cb26d20b5138ebcdef1adaea9b8fa0bfc7b56862c3ac5b7500a419a6836e3e2656aab697f6459131b0d8672123411dc60d1e15d7c745aa881580ec5c6d3c841

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014343001\f7c45c456a.exe

Filesize
710KB

MD5
28e568616a7b792cac1726deb77d9039

SHA1
39890a418fb391b823ed5084533e2e24dff021e1

SHA256
9597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2

SHA512
85048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014345001\b2e4a7f3cf.exe

Filesize
949KB

MD5
0f47fcde37bf99983f14b406fe58f131

SHA1
6f6ba643fa07d97be4c0a1c5250dff3a6b67a0ff

SHA256
e93220353bc583c6c042a2bd0f3b404a77da4b5d1781051bef8132e22abc12c2

SHA512
ddf01c9bb332edee6c3cd4c803ac48ae388389b5ed9e7e294664f4a4b12f823d86099cb831745d6bea8f562c7a59d61e59ff78870d2eedd64f549c48fb345aa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014346001\5f6e18a357.exe

Filesize
1.7MB

MD5
6731bd7e893f440a5f73edfd40b73112

SHA1
8e396ca101830e0116881c8d8c81c6d5e7918afe

SHA256
599399619509681016345f5e4e50f6edd38a70496201d1a9fbfe5c53d7f4690b

SHA512
d0247ad0a1392a9b622d08e22feee7d79854c8f1492f0b4d5d5e669f7efce409e3a3961f8229ebb40aca97ed6e36066b40393b3e9cb78d7356d34d530c125110

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014347001\11210e53aa.exe

Filesize
2.7MB

MD5
9aa3e28acbd0b5a2e045a6d513c93b6b

SHA1
9381e49745b0e1c2fab053f8d4d2a59bc61988f1

SHA256
2f1568be0dd8f9a154b003441a09464578fc012d81f60faab98f8ba9c1913898

SHA512
994aacaaafb7a60400aa05ad2524eac325b50b46109a75a71e2907e0dc08b5147ad7f63d308c72b92dc70d232335134815b461b00c18c722a365e6e0f8491471

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014348001\1778b32337.exe

Filesize
2.5MB

MD5
2a78ce9f3872f5e591d643459cabe476

SHA1
9ac947dfc71a868bc9c2eb2bd78dfb433067682e

SHA256
21a2ac44acd7a640735870eebfd04b8dc57bc66877cb5be3b929299e86a43dae

SHA512
03e2cd8161a1394ee535a2ea7d197791ab715d69a02ffab98121ec5ac8150d2b17a9a32a59307042c4bbeffad7425b55efa047651de6ed39277dba80711454f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4e232h.exe

Filesize
2.6MB

MD5
d2400fcde85edb853b3104e6365a111f

SHA1
3e65f8195afca5021cb4c1876428e3d9c59a34d4

SHA256
9cb5f2f74fdf3185c6c57fa5fdba9cb02d3c622735c5d11738895c6a8454b085

SHA512
4f27bda71ce1a1c4146b0f2b8c639fd0408d0e330f10c4c35da620a45fa29daa1086f6aa5fbc1713525b0434657788f5783a8e76fabf282f40ccfd94e3f9ee0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\O3P59.exe

Filesize
5.4MB

MD5
631000ebd0942479d98f907b086800b0

SHA1
a4bfe1933cc4b44c126056b9abcbeb7263b6c5bd

SHA256
07ad8fdbcf84a6fc41716301052c96b9e307b104f32ad52fd734eb857c05b5fa

SHA512
783f04d8d1ceccc01f35f4c8db85ba9b9c758869d27e29d1deb70cbd92b7d06bb65e4574e32f38a662d4208727292b651ae41c0a10e69fb2915d14b742704641

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3p73w.exe

Filesize
1.7MB

MD5
1a0eded5ce6f8eb8e3511a33950d857d

SHA1
cabc995ab1a44aa1d8a33689b3197dec2539ca90

SHA256
1ccdd1cd66c2f81632a1ca01e966d71b7d7ef6e27ca73214319fd2d6303e1b1d

SHA512
141704bc409b89089b8d5dd0d9e040f88060bad9736417fbe7c26ee860d3820d008d5a0621a374868a6a76cf049367b227ba6630789b3af1172f31f8f9d17863

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o2T35.exe

Filesize
3.6MB

MD5
26a9e9281e6bf2b77230f2cedb6b1cda

SHA1
fd5ed6f6f896e8424e7d294c18f3e3491dcf9135

SHA256
66c4c30f1b94fd2d753cb03e46dc77de29eb57c9c96d3bae160c0f1686f1ee8c

SHA512
9d54c5eb2c76755bd585098e98340a5bae3e47524b8b3d8dd1a51f43a39c61afeb328d1ee5cce0ed8d3ee91604a4cf30ef7251daeb2bd5cd71b4f1f2091ffa3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1V47m0.exe

Filesize
3.1MB

MD5
783775b86ebd55c9b7d10b44728f6466

SHA1
0681604f097cf598de5e9bc267d33cf9854f4503

SHA256
b620f8e504b494f5ca15470d095d913914703bd94ee5fbdb2cbab67f48d17283

SHA512
33c9087c4150091f68aa9858d70f0419f8b02ba187951c2de4c2954d73b41585ace660d9eb797f0117a463adcf4983f2043253bfd6c7a447b2d2aefda076bfe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2D8956.exe

Filesize
1.8MB

MD5
37acde403802cd8682bd73ebf7b4e303

SHA1
bf2f2c75956275ff074ba520664ea71ad6c84686

SHA256
f051c6f2297f96df69ce15387c419b7ff64615c3db57172075e564efaeaedc15

SHA512
250a46d5003eb0faf4650b84eb76b51c6fd626a644b61d61069814ab3b0c420171483df3d442ef296976372a2b4c302afc36aa5f060017933deefd330b7250e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin

Filesize
6KB

MD5
0df61cd6caaf027b9956db69e6f872d6

SHA1
ecff4a295113d9af9a4fcae0e7f9ad348b1d49d1

SHA256
f2eed2646d66730c93bc0a9e757463fd424bb6da0f9faf8695d5223419cbdeca

SHA512
1d30b918d41bfc51caf7eb3f9ecfaec0a1a7c6adda4a4629ce4bde89c05744561b9bbaea65a3898dd90d7cde05d2e8710e024d655d805caf9fab64581f256ed9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin

Filesize
10KB

MD5
f03f9ef6401b18c6c727894ee1666e44

SHA1
57eae93560a40cb601b0debdf641f43c7041560f

SHA256
7604dab05853ca66624d6ff8c1f51fc786f62acf15a69753e3a99a619bf58366

SHA512
11b908b3f63c1c2e24b5fc414bbf55df05c83cb2ff46ee5dbaa4f92a63682947e0660950e78a234f60d24524d482a164baeabfb01746fe9204a6778b50f34919

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.bin

Filesize
14KB

MD5
94ae247b061bdbc5d3454b34e0af8c92

SHA1
55490685ff39176186e1b79b5e6ab41cd1467298

SHA256
528b5167f4c37df34755ae0e20c7385d0f63f13c80b81570faf2e1a2a6ef4f34

SHA512
b6cdf11d90288ef24fd1438dd5a49b4472e3d03c2808cdf4ca1cef2b0c0007110e361f9980f1847fc3264ff4a666e9a1ffee2e6c3a6fb94706aaa222ec8fb391

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.bin

Filesize
23KB

MD5
8c2585ede54976aee3931e8bcc29a1e7

SHA1
60e6a69917bd295c8a20cbf03d9984b6f9727651

SHA256
690aa5e6e1887481b37596d7e2ee17fdaf558da6f63564dd548a08c5fd935e4a

SHA512
48fc5c76d2ecf0521f89b75d8ae1e4d89e4a182c2beb7be7de018e376c7d8b0ecd0c6e8d24f268109759eb7050b33ed838d66d76025dd0df4caf5292f4b082cf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.bin

Filesize
5KB

MD5
4815529cb1fac072c350ab4cd5d3268a

SHA1
b3431048fa5a4d82c116641e1ac162c725b16e13

SHA256
e311933e630b7c7233975949a26ec48ef833780c98514c69f202d90ab740135c

SHA512
0a386a4d20c52195bcbc9daf0fc0df47e1693e6fef8e84dde7398802f3ce6f77c1d8c7ef88469c4ed804505bcd913c7e13f3b1819f5b2d14398634f453d77b9a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.bin

Filesize
15KB

MD5
aa6ab5d23cd6696a88d8bf47d87abe3f

SHA1
af4e3267a919dce4170ea8f7d87122a21b301338

SHA256
3c276cf8625eefebec6238ffa56427fa251a0d07718c628c210ca389cac8f80e

SHA512
59327554add7c329be524b5fa3caaea9c7fec38083e06eee3081bc7dc13bfdfead347c62e20f41f958c8c5123977b107b95c2d0335b93565f49b239f77ee4c23

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
ce2e5e54b52e8d320d659b61580c0dac

SHA1
3ce3f756afec998d28b767caa22c35522d6d85b4

SHA256
69404a48ead14f35152a677a3fbe97a3b8dbfb996b8626c883d351aebf9327f2

SHA512
d58a9f6b3be2a2814c9a4964f28301f425aaac96919f68baf65ee8a9d6a8d2e70b05ff7b16008392cfdfeca1dfece07f566d5002b4f747a7f4b47c42a9d4d70d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
e973133bb0ca97348b8e1f2bfecb7a74

SHA1
1c7360da9ca2d4696e57eae3dbef4e2d4dda70ca

SHA256
bca8e725a55e35346873228f0381e965d1e5e76779ba12115b1dc67c556244d3

SHA512
b57a41bca9da60ccd26191cf266fe015725edb4dff0979973f36664d1dea077093da11797c38d17b2806d3ef2d5700c6e950dd765db04eb3ad302c6e4a45ab44

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
b395e0fa95d479f9ffc75c5696a4e7c7

SHA1
1e86b521e1754490c7745ba275cd99d84c04bcda

SHA256
8b4a1f84b8fd97e3cdd78f15872110db5e38e58bb8961d7991d902cfe6897f9a

SHA512
e02ea0009f444d3b4d6e6ae19f85f6fbfcffc63fd21ece9bdc96ab434682a4730aed48f9f02fce86ffe23452f7840453264b9ec03c283869384ba1c956c02f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
1d89a89917981e6fd010ce1b5407cf22

SHA1
fb27be3618d76df12d477c52931abe8fa61572ae

SHA256
82433948898c7d93012e86d40d80a95d9fd68ad6a282cdbd673ea9de776a8ac2

SHA512
06be4d046d7fd0c38e9d8dc44f9ad0a4104da16ecd7362be8a4d85efdd1b5831a0004d9201d1fa144169dad0906c5bdc06ded7923df4ca6839045dc60a2a1f17

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\1e527cb8-36c7-4cae-8107-5c5741222b3d

Filesize
25KB

MD5
434bd571dd8be326e2c1fc4810082777

SHA1
5174957de510406aa9238fdba97b72f0f94b637a

SHA256
94d830514cb6d7d69859570b1ce58ed5d7d11149cbec6cb2a0406fc458f01fff

SHA512
462b91c665023beaf6366f08f75e669c1a3062276ae58bb890d6a4a4c87a3e0a0e6afa519a6a43841a55e30ffe2d00db62d8bc0726858217f469a89cfa34678f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\a135b0c7-1e41-4dc7-b0dd-71fcffc3f182

Filesize
982B

MD5
fe55e25daa6180e84b5a1dbd88324033

SHA1
d401b613988b87a9f27992ec8e1e29c8b06c74f1

SHA256
00b73a6c0d2c712e2b4b0be3f603974264e672d5f7b51ac03686c731e37a6127

SHA512
88ebf415b93252aadf3ad79c7701c5b1e8c7278ae9602f12a1068c989302d2b9a99a14e804b1346210743e32b58fa9903d68d311e574e33e5c9fb1b512804023

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\f0d8ae77-03f4-49ae-a534-2c31fe6928a5

Filesize
671B

MD5
a22d8a55ba4938b30a83f9f320d5e679

SHA1
118ba9c7b3f76853a9c667bc057973b9664d3d82

SHA256
ea80f05070e416c5abe6aac9b3c41685379bfb62decd0c07b77e8792a2865b58

SHA512
f012e7a463a9c6c54834d4ac6ad447c6a0d73fe260f5ba4cc05b257e3893f1169e1216f8fa272eef0cdfd38b905732b3157e4aa8e82a1360eab8ba275316e766

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js

Filesize
12KB

MD5
bc5e761db271de64ceb45b91c046e6fb

SHA1
8bc71b28b2d3b81a7c6f4cf9f9a1903f1ec25f44

SHA256
031eb6e19cb42f549f24bbfef25abf5eb927eccc7a55d89dfac99b992b3e2c0e

SHA512
d796752bd5e9683a8c925c9d279f045b3523379c9aa3c456d03fda1a6dfa8927d54666b317b4041d7f571da54ebe5c884a7873464473a0480ade52da71eff597

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js

Filesize
15KB

MD5
657ae767c0d4532f731865aa298f02ea

SHA1
7fc2eebbda6008a275023204c5ccde1df32265e8

SHA256
965e25ed1063ad4dd30627fe03d2ab5a1a0688014abdb71a84d2606a2472a5ef

SHA512
fcf2b2f934c6b7de33f4dd602f13658f3a38a885fdf3bc755e2d082b335456edceee9d53909eceac0edc2d217ab602eefe9b7fb9bcc34a62600a911efdaff444

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js

Filesize
10KB

MD5
84b776d0114d5048e4488d373b469b43

SHA1
cd53d19818051b97f01652bbeb4d05394dbb0f28

SHA256
c29e78d88197123dc8e788db5561ed88da901e69f1bd77bc2ae47509ce3022ad

SHA512
9d351eaa8ce18289a700701016c00aaf40acdfa451aa4c3d73376d94f23340d7aeb779b5e4bf2ea810678ac088beae04fe33ed98a4c4d8f5f6e2a5228a4420d1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js

Filesize
10KB

MD5
4f318dc55ceb6426f604ec4a8004e5fb

SHA1
f87746d39422ec1cd48df0f3c0315faeb80395ed

SHA256
8a1a067057bf5db62dfbc39ed05473b18e83572da31519727b010e8272395def

SHA512
fe511988717cb1922a95dbb49b96a2c06b6464f63521eb981664a04a907cca390793af3d766cac3302153fe629435ffa61f62240c877c8ebd100e222f5ff939f

Download Submit
memory/388-163-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/388-1035-0x0000000000400000-0x0000000000C5C000-memory.dmp

Filesize
8.4MB

Download
memory/388-208-0x0000000000400000-0x0000000000C5C000-memory.dmp

Filesize
8.4MB

Download
memory/388-984-0x0000000000400000-0x0000000000C5C000-memory.dmp

Filesize
8.4MB

Download
memory/388-135-0x0000000000400000-0x0000000000C5C000-memory.dmp

Filesize
8.4MB

Download
memory/888-111-0x0000000000400000-0x000000000064B000-memory.dmp

Filesize
2.3MB

Download
memory/1368-139-0x0000000000E30000-0x00000000010E0000-memory.dmp

Filesize
2.7MB

Download
memory/1368-70-0x0000000000E30000-0x00000000010E0000-memory.dmp

Filesize
2.7MB

Download
memory/1368-69-0x0000000000E30000-0x00000000010E0000-memory.dmp

Filesize
2.7MB

Download
memory/1368-71-0x0000000000E30000-0x00000000010E0000-memory.dmp

Filesize
2.7MB

Download
memory/1368-143-0x0000000000E30000-0x00000000010E0000-memory.dmp

Filesize
2.7MB

Download
memory/1496-35-0x00000000006E0000-0x0000000000A08000-memory.dmp

Filesize
3.2MB

Download
memory/1496-21-0x00000000006E0000-0x0000000000A08000-memory.dmp

Filesize
3.2MB

Download
memory/2332-229-0x0000000000B70000-0x0000000001200000-memory.dmp

Filesize
6.6MB

Download
memory/2332-227-0x0000000000B70000-0x0000000001200000-memory.dmp

Filesize
6.6MB

Download
memory/3432-41-0x0000000000A90000-0x0000000000DB8000-memory.dmp

Filesize
3.2MB

Download
memory/3432-42-0x0000000000A90000-0x0000000000DB8000-memory.dmp

Filesize
3.2MB

Download
memory/3796-210-0x0000000000400000-0x000000000064B000-memory.dmp

Filesize
2.3MB

Download
memory/3852-110-0x0000000000AA0000-0x0000000000F3A000-memory.dmp

Filesize
4.6MB

Download
memory/3852-117-0x0000000000AA0000-0x0000000000F3A000-memory.dmp

Filesize
4.6MB

Download
memory/4244-63-0x0000000000D70000-0x0000000001400000-memory.dmp

Filesize
6.6MB

Download
memory/4244-65-0x0000000000D70000-0x0000000001400000-memory.dmp

Filesize
6.6MB

Download
memory/4540-171-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4540-167-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4540-169-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4572-59-0x0000000000080000-0x000000000052F000-memory.dmp

Filesize
4.7MB

Download
memory/4572-39-0x0000000000080000-0x000000000052F000-memory.dmp

Filesize
4.7MB

Download
memory/4624-3932-0x0000000000A90000-0x0000000000DB8000-memory.dmp

Filesize
3.2MB

Download
memory/4624-3923-0x0000000000A90000-0x0000000000DB8000-memory.dmp

Filesize
3.2MB

Download
memory/4624-3938-0x0000000000A90000-0x0000000000DB8000-memory.dmp

Filesize
3.2MB

Download
memory/4624-1040-0x0000000000A90000-0x0000000000DB8000-memory.dmp

Filesize
3.2MB

Download
memory/4624-1013-0x0000000000A90000-0x0000000000DB8000-memory.dmp

Filesize
3.2MB

Download
memory/4624-3824-0x0000000000A90000-0x0000000000DB8000-memory.dmp

Filesize
3.2MB

Download
memory/4624-72-0x0000000000A90000-0x0000000000DB8000-memory.dmp

Filesize
3.2MB

Download
memory/4624-226-0x0000000000A90000-0x0000000000DB8000-memory.dmp

Filesize
3.2MB

Download
memory/4624-33-0x0000000000A90000-0x0000000000DB8000-memory.dmp

Filesize
3.2MB

Download
memory/4624-3937-0x0000000000A90000-0x0000000000DB8000-memory.dmp

Filesize
3.2MB

Download
memory/4624-3933-0x0000000000A90000-0x0000000000DB8000-memory.dmp

Filesize
3.2MB

Download
memory/4624-161-0x0000000000A90000-0x0000000000DB8000-memory.dmp

Filesize
3.2MB

Download
memory/4624-1704-0x0000000000A90000-0x0000000000DB8000-memory.dmp

Filesize
3.2MB

Download
memory/4624-3931-0x0000000000A90000-0x0000000000DB8000-memory.dmp

Filesize
3.2MB

Download
memory/4624-3926-0x0000000000A90000-0x0000000000DB8000-memory.dmp

Filesize
3.2MB

Download
memory/4624-94-0x0000000000A90000-0x0000000000DB8000-memory.dmp

Filesize
3.2MB

Download
memory/4688-137-0x0000000000400000-0x000000000064B000-memory.dmp

Filesize
2.3MB

Download
memory/5952-1023-0x0000000000A10000-0x0000000000CC8000-memory.dmp

Filesize
2.7MB

Download
memory/5952-1026-0x0000000000A10000-0x0000000000CC8000-memory.dmp

Filesize
2.7MB

Download
memory/5952-977-0x0000000000A10000-0x0000000000CC8000-memory.dmp

Filesize
2.7MB

Download
memory/5952-978-0x0000000000A10000-0x0000000000CC8000-memory.dmp

Filesize
2.7MB

Download
memory/5952-976-0x0000000000A10000-0x0000000000CC8000-memory.dmp

Filesize
2.7MB

Download
memory/6736-1734-0x0000000000A50000-0x0000000000AA7000-memory.dmp

Filesize
348KB

Download
memory/6920-3935-0x0000000000A90000-0x0000000000DB8000-memory.dmp

Filesize
3.2MB

Download
memory/6920-3936-0x0000000000A90000-0x0000000000DB8000-memory.dmp

Filesize
3.2MB

Download
memory/7000-1848-0x0000000000A90000-0x0000000000DB8000-memory.dmp

Filesize
3.2MB

Download