Overview

overview

10

Static

static

3

9642b949ee...9a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-12-2024 02:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9642b949eed76ccea83d0aaaace3c863c7a66534bcf5fbe32739c87dce53c99a.exe

  • Size

    6.9MB

  • MD5

    af444cdb4f19dd4827c8cfe737745c2b

  • SHA1

    fa09119844d86d8aff9dcbf87fdbde69059c7771

  • SHA256

    9642b949eed76ccea83d0aaaace3c863c7a66534bcf5fbe32739c87dce53c99a

  • SHA512

    62f84e7058510a529abbe925ef572e75e19dfc83918a2729ed40f07aea5ad0dcdb07bfe6fd2ff9ecfdf39acdf0434a94aa09a6020369446280f940593314f14c

  • SSDEEP

    196608:/Qf6QjrPgeAsCIJ4AOTl2hgfqMNkFYzIagrf2/1h:G6QjvCIJ4A8lK+NgEIaT/1

Score
10/10
amadeycryptbotlummastealc9c9aa5stokdiscoveryevasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://drive-connect.cyou/api

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

cryptbot

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 21 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 19 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 38 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 25 IoCs
  • Identifies Wine through registry keys 2 TTPs 19 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 5 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2640
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\System32\svchost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:6424
    • C:\Users\Admin\AppData\Local\Temp\9642b949eed76ccea83d0aaaace3c863c7a66534bcf5fbe32739c87dce53c99a.exe
      "C:\Users\Admin\AppData\Local\Temp\9642b949eed76ccea83d0aaaace3c863c7a66534bcf5fbe32739c87dce53c99a.exe"
      1⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4828
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\H2M69.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\H2M69.exe
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3692
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c6h55.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c6h55.exe
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3400
          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1V43P2.exe
            C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1V43P2.exe
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:3552
            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
              "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Checks computer location settings
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Adds Run key to start application
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1564
              • C:\Users\Admin\AppData\Local\Temp\1016431001\54e13c7066.exe
                "C:\Users\Admin\AppData\Local\Temp\1016431001\54e13c7066.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Checks computer location settings
                • Drops startup file
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1452
                • C:\Windows\SysWOW64\schtasks.exe
                  "schtasks" /Query /TN "54e13c7066"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:6768
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /f /sc onlogon /tn "54e13c7066" /tr "C:\Users\Admin\AppData\Local\Temp\1016431001\54e13c7066.exe"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:6840
                • C:\Windows\SysWOW64\attrib.exe
                  "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\1016431001\54e13c7066.exe"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Views/modifies file attributes
                  PID:6376
              • C:\Users\Admin\AppData\Local\Temp\1016432001\586ca7d356.exe
                "C:\Users\Admin\AppData\Local\Temp\1016432001\586ca7d356.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1964
                • C:\Users\Admin\AppData\Local\Temp\QWIPGKFHRSXZHA9BMS88.exe
                  "C:\Users\Admin\AppData\Local\Temp\QWIPGKFHRSXZHA9BMS88.exe"
                  7⤵
                  • Modifies Windows Defender Real-time Protection settings
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Windows security modification
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3276
                • C:\Users\Admin\AppData\Local\Temp\34ZVH0VBT5VFM0FBY5U.exe
                  "C:\Users\Admin\AppData\Local\Temp\34ZVH0VBT5VFM0FBY5U.exe"
                  7⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:208
              • C:\Users\Admin\AppData\Local\Temp\1016433001\cf99b3d495.exe
                "C:\Users\Admin\AppData\Local\Temp\1016433001\cf99b3d495.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:5076
              • C:\Users\Admin\AppData\Local\Temp\1016434001\9d573f1c24.exe
                "C:\Users\Admin\AppData\Local\Temp\1016434001\9d573f1c24.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:4012
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM firefox.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4860
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM chrome.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1016
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM msedge.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2528
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM opera.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4716
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM brave.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2800
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                  7⤵
                    PID:4712
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                      8⤵
                      • Checks processor information in registry
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:3120
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2024 -parentBuildID 20240401114208 -prefsHandle 1940 -prefMapHandle 1932 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {616bda68-b3ae-45d7-b206-5177b53a2a0f} 3120 "\\.\pipe\gecko-crash-server-pipe.3120" gpu
                        9⤵
                          PID:3200
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2508 -parentBuildID 20240401114208 -prefsHandle 2500 -prefMapHandle 2496 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59f3b6d2-6097-4672-a720-c4b3a55c05e8} 3120 "\\.\pipe\gecko-crash-server-pipe.3120" socket
                          9⤵
                            PID:3336
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3104 -childID 1 -isForBrowser -prefsHandle 3096 -prefMapHandle 3092 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5c056ea-cafb-42c1-a336-4bc0958698d3} 3120 "\\.\pipe\gecko-crash-server-pipe.3120" tab
                            9⤵
                              PID:4648
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3940 -childID 2 -isForBrowser -prefsHandle 4036 -prefMapHandle 4032 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {862fa018-78a8-4fac-a4fc-42250e2c9748} 3120 "\\.\pipe\gecko-crash-server-pipe.3120" tab
                              9⤵
                                PID:5016
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4880 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4636 -prefMapHandle 4832 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7dec5d92-0f1b-49fd-ae22-339395dbe1b0} 3120 "\\.\pipe\gecko-crash-server-pipe.3120" utility
                                9⤵
                                • Checks processor information in registry
                                PID:6612
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5172 -childID 3 -isForBrowser -prefsHandle 4636 -prefMapHandle 5144 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8e86e78-8ecd-4581-aae1-378fa0db23a3} 3120 "\\.\pipe\gecko-crash-server-pipe.3120" tab
                                9⤵
                                  PID:6992
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5304 -childID 4 -isForBrowser -prefsHandle 5312 -prefMapHandle 5316 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {876e6803-0fb9-4107-86a1-dbc368eb732b} 3120 "\\.\pipe\gecko-crash-server-pipe.3120" tab
                                  9⤵
                                    PID:7044
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5604 -childID 5 -isForBrowser -prefsHandle 5520 -prefMapHandle 5524 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b416e8b5-0d4a-4c8e-88c1-2d2a5f88b956} 3120 "\\.\pipe\gecko-crash-server-pipe.3120" tab
                                    9⤵
                                      PID:7128
                              • C:\Users\Admin\AppData\Local\Temp\1016435001\089a978919.exe
                                "C:\Users\Admin\AppData\Local\Temp\1016435001\089a978919.exe"
                                6⤵
                                • Modifies Windows Defender Real-time Protection settings
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Windows security modification
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2936
                              • C:\Users\Admin\AppData\Local\Temp\1016436001\776fdad63e.exe
                                "C:\Users\Admin\AppData\Local\Temp\1016436001\776fdad63e.exe"
                                6⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                PID:2648
                                • C:\Users\Admin\AppData\Local\Temp\1016436001\776fdad63e.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1016436001\776fdad63e.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  PID:5728
                                • C:\Users\Admin\AppData\Local\Temp\1016436001\776fdad63e.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1016436001\776fdad63e.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:5736
                              • C:\Users\Admin\AppData\Local\Temp\1016437001\d4d9ba463c.exe
                                "C:\Users\Admin\AppData\Local\Temp\1016437001\d4d9ba463c.exe"
                                6⤵
                                • Enumerates VirtualBox registry keys
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5996
                              • C:\Users\Admin\AppData\Local\Temp\1016438001\a079cf7816.exe
                                "C:\Users\Admin\AppData\Local\Temp\1016438001\a079cf7816.exe"
                                6⤵
                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:6264
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6264 -s 804
                                  7⤵
                                  • Program crash
                                  PID:6576
                              • C:\Users\Admin\AppData\Local\Temp\1016439001\cc15f0cfbb.exe
                                "C:\Users\Admin\AppData\Local\Temp\1016439001\cc15f0cfbb.exe"
                                6⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                PID:6660
                              • C:\Users\Admin\AppData\Local\Temp\1016440001\177cd10feb.exe
                                "C:\Users\Admin\AppData\Local\Temp\1016440001\177cd10feb.exe"
                                6⤵
                                • Enumerates VirtualBox registry keys
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                PID:5744
                          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2L6203.exe
                            C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2L6203.exe
                            4⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:624
                            • C:\Users\Admin\AppData\Local\Temp\9R9H0OZ30BYGNSU8HJE1S.exe
                              "C:\Users\Admin\AppData\Local\Temp\9R9H0OZ30BYGNSU8HJE1S.exe"
                              5⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1940
                            • C:\Users\Admin\AppData\Local\Temp\3S34ZWZ9G4Z32V3X2PTLH3.exe
                              "C:\Users\Admin\AppData\Local\Temp\3S34ZWZ9G4Z32V3X2PTLH3.exe"
                              5⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1700
                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3i56O.exe
                          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3i56O.exe
                          3⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1696
                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4A129Q.exe
                        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4A129Q.exe
                        2⤵
                        • Modifies Windows Defender Real-time Protection settings
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Windows security modification
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1844
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6264 -ip 6264
                      1⤵
                        PID:6512
                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        PID:2740
                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        PID:5424

                      Network

                      MITRE ATT&CK Enterprise v15

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Defense Evasion

                      Hide Artifacts

                      1
                      T1564

                      Hidden Files and Directories

                      1
                      T1564.001

                      Impair Defenses

                      2
                      T1562

                      Disable or Modify Tools

                      2
                      T1562.001

                      Modify Registry

                      3
                      T1112

                      Virtualization/Sandbox Evasion

                      3
                      T1497

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      3
                      T1552

                      Credentials In Files

                      3
                      T1552.001

                      Discovery

                      Browser Information Discovery

                      1
                      T1217

                      Query Registry

                      8
                      T1012

                      System Information Discovery

                      4
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      Virtualization/Sandbox Evasion

                      3
                      T1497

                      Lateral Movement

                      Collection

                      Data from Local System

                      3
                      T1005

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\activity-stream.discovery_stream.json
                        Filesize

                        27KB

                        MD5

                        e7befff31ac2164c0545ba0d2caa3a81

                        SHA1

                        1c51e398fed1f94b27fb1847cd0d8247ef082627

                        SHA256

                        b4594d2386aa6fc38eeb14a968387bb6c07f3a7f566a67905b03997e15a4e51a

                        SHA512

                        f881d4af239b3a15ebfe94274217cf2d74e8d06907ba486b27d8148e76b999c6bcc1fdf5fb027b25e394c0f1de9aa4969a282e0c4128f7b6b7d1611c80597e28

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                        Filesize

                        13KB

                        MD5

                        63a4dfa2afc5a6bb1623c18a55a01a4f

                        SHA1

                        7a659617b5935629154241ac247d97fea66956a6

                        SHA256

                        f24b7725415dc50b27c7f824c035108713212011fe3a66692d35905e65a66c9e

                        SHA512

                        2b6a3c76d16f756afaa3854674b34b413d5b865bd0c7d06157f143d0bf8e70ed753af79bf6485ae5c82c85ed652754bd02c4053520c210f8763adcc94a59e7a4

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                        Filesize

                        15KB

                        MD5

                        96c542dec016d9ec1ecc4dddfcbaac66

                        SHA1

                        6199f7648bb744efa58acf7b96fee85d938389e4

                        SHA256

                        7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                        SHA512

                        cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1016431001\54e13c7066.exe
                        Filesize

                        1.7MB

                        MD5

                        d37dab4c59e707f632bb0b91eaa87ff9

                        SHA1

                        0e153debcf54805a0543646620511b57865d6fc9

                        SHA256

                        375a067be10250dc045ea14025444ad7ec0662cf189abbbd393e6f7ffe85b35d

                        SHA512

                        0ae81abbe56f0a20c8066c52672d969c962a20b19c7e7165b12c7b16a4f0681c4f96ce2cedde50ade5975ced262d581fc99d0947c188cec847c8a82eb85bc0ae

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1016432001\586ca7d356.exe
                        Filesize

                        1.8MB

                        MD5

                        1922024ccd8d7a9bd347a0789ce7f30c

                        SHA1

                        3e2908ffe9cee89b9e636f3090ed481699bb2712

                        SHA256

                        a3feaf6db591278388bb8fcd25a6bd5a1419901b3ba9a1e0d803c64af6644bd0

                        SHA512

                        32daaeca71f644c7976ace329cfb7f47ed9a16c4e9a3e1a9265c3e395a6331375ee6d79f2c1bf55c76ed46afe3ec9e41e901a2837bb42f96e7c114d3b098f5d0

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1016434001\9d573f1c24.exe
                        Filesize

                        944KB

                        MD5

                        7152b64cbdf980e824181620d9ca66ac

                        SHA1

                        740fb5dcf7f20f3ede2be9ca2521de16a485c701

                        SHA256

                        25f1a591367832ad336292fa1218f5bccf783002b7c8ef45869e7e5d13f1dc67

                        SHA512

                        b26f66cd563d07d5b62ca0cfe750aaa27d6ccfd294e224fb5a4da4a5cd3f205bd8a6f1d3329e00f4cc0b769a2e4e67b6cc2dcec19bd18222990feb0a62728bce

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1016436001\776fdad63e.exe
                        Filesize

                        710KB

                        MD5

                        28e568616a7b792cac1726deb77d9039

                        SHA1

                        39890a418fb391b823ed5084533e2e24dff021e1

                        SHA256

                        9597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2

                        SHA512

                        85048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1016437001\d4d9ba463c.exe
                        Filesize

                        4.3MB

                        MD5

                        9bd5b9ceba49c19a9c2f80c23279d441

                        SHA1

                        58f855a1fd2fba52a9dab57da4b762e9620e437d

                        SHA256

                        ede017ad6960a447c0f2337c5bee277d1ce62ee31fb9685e5a2a4628f0e6b31f

                        SHA512

                        5a643d4afcd9eed9b2423256871c9d2859e14f5e8a36f6c8641efd95dfab5f86b82cbf2c1be32b85a954ce84c970e792759a5d29b7bb5d6bcdaa8a9e30a73f9a

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1016438001\a079cf7816.exe
                        Filesize

                        1.9MB

                        MD5

                        129e9d731c27f28d25a824fecd066e54

                        SHA1

                        c42fb09e9dbbb309db3a30deecf9a0edd285e7a1

                        SHA256

                        0186a9725d8a17443751c82eee6683e68637fe4fd6f041f5d5855e6d8bd5ec47

                        SHA512

                        a243cc3e7fd661bc37f90165f8494d45edb1a038e2e56513c256d1666d901298992d42390baed8c18f1ea68ac5400a8d2da9c25e49fc89315b6a2ae07e96f6fb

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1016439001\cc15f0cfbb.exe
                        Filesize

                        1.8MB

                        MD5

                        fd17d712c627b434e99749cfc82c7d51

                        SHA1

                        bf00a1fe4d9efc63e963751201a383bf9df7d25e

                        SHA256

                        af8729a17698880e54e9f23b48e6b68d73672179f58868c201c8cf54d1a578bc

                        SHA512

                        b3f56a4457df967d9355f42316e8332813c46003b4d2e216fbabded7edcddcbefc72ee01fd706722cf81e2fb3e0986c31358a22270f7b36106e77a88b6c25c85

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1016440001\177cd10feb.exe
                        Filesize

                        4.2MB

                        MD5

                        3fcd7adcd85540ce4d7097b400381963

                        SHA1

                        be68d28acb2c143a5d45bea59b9dfdf7bd4ad617

                        SHA256

                        08187fe32be97680f07b29be1fb116c2e19e2f380f6e5c2cdb18272bb3f9c2e7

                        SHA512

                        e8c7e58b9c9bcbe5a20b40207754c5345480a4d905f01be3ff1806f4708fca8263885ababf14b54fa7b38f6c4aaadd4c9284908c4e2bb09fd64933cfdb7fca55

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\3S34ZWZ9G4Z32V3X2PTLH3.exe
                        Filesize

                        2.8MB

                        MD5

                        f10511fc918f0b1648e448adabadb5ac

                        SHA1

                        de86f9989345f527964309965735cdaee4935ff9

                        SHA256

                        b60a85fbc4a8c4db17b7a02e922fa6354ed7bab533fab292fc79b6c73e17e1b4

                        SHA512

                        414055e0a1f1d3c625de5f36e69530bf8f3e88b77e56ec95dd64761580a0f1ac32cd42b1ad30fb8ad9ae8382d610a4ea7d8c0c368b03a615b046cfeaea22040b

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\9R9H0OZ30BYGNSU8HJE1S.exe
                        Filesize

                        1.6MB

                        MD5

                        c22653a5dec4646861e3a66a0275dbc5

                        SHA1

                        627a1c28de11ba6bed383a2947aa482c1cfa14e7

                        SHA256

                        7d70a4737819c33b2875e14f862a474910e1d8618ae4b16dc194ca9a68dae9c7

                        SHA512

                        e1c1add085fbf978055385288f613fe65011d8c827d7c9d73b0f06ee303df87b4877d68b30988aea0f7730c854b23db11dbfdda313f1a2a6f00ede0aaca61dac

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4A129Q.exe
                        Filesize

                        1.7MB

                        MD5

                        c07b01af18efd92367ed44ab96bb6562

                        SHA1

                        18484683aafa4933e4ffd59640b4ea9df33d2cd8

                        SHA256

                        ff16e4b2824ca8102e810f3101d709ffa1f09aca620d07872183cbb4af64b441

                        SHA512

                        9d5b830a270c0198bb9788f10758a1fffe83c130d21eebd6a5c2590032d6fcd36cf2958ab794b4283a98a9e38e0a842878fc474ae3ba5c4d659eec9acdf17b8d

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\H2M69.exe
                        Filesize

                        5.2MB

                        MD5

                        b8e5ea1085848ece999bb0e786904c94

                        SHA1

                        9b5667397632aa88dbf519f605ca723ec0a0bf75

                        SHA256

                        ecb3a73c665f5c65288db80d86d90278534cd69a966ae8adb792652153e8bf1e

                        SHA512

                        8c805632dfbe5c2b01aada6b13ea6ae941f0d15df14304fca5fa1916c4cd404ca16545a76a43743d1e67550d070a787446ade104d5664f1f0df1af61986b32ed

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3i56O.exe
                        Filesize

                        2.7MB

                        MD5

                        b4c1dba163af3b5402e1746b69c964ed

                        SHA1

                        71efe2f7ec13586ae2578c60a56f23732392bc2c

                        SHA256

                        7ec038e9dd03aebc33ae61653612825040d6ede00bc677f73e1ae6c13378dd3c

                        SHA512

                        ce80a035481af64cfb46370ea38daa4ba86ba5341579e34a3e82debb14c7599b1512d35229502655a9307c4e3557276248dba7baa971af4444290d7e6533ecdc

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c6h55.exe
                        Filesize

                        3.6MB

                        MD5

                        6a5e1110a7403eb838a4dc48a2401245

                        SHA1

                        bb125bb5988b73afca031343b3be7e7c475ecc4d

                        SHA256

                        9a6c1dffafd6800eda43958b95ce6dcdf27a9be13cf4e7c398633bb5de13e6f2

                        SHA512

                        21f2ed12db8eb052b7e315044598cb4c72489215f9c03e2dfc2697aae483c90dd00e78766190359634750205c5d003a471a7a988f1e23ae2b7fa01e73607d6d8

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1V43P2.exe
                        Filesize

                        2.9MB

                        MD5

                        7cf236240d235f35fbfd37f4abfed7cd

                        SHA1

                        eb904f17eabb2837a239e3c6b55490657a3a00c7

                        SHA256

                        da8d837276d6ed969359c92e63e8bb6d9c3531f48dd84358031978939b0ca1e4

                        SHA512

                        91aa97e27ea392efc654fd6737875dcf910ac3630f55cb2140782a49a7bc108df55a5292613fe01fdee9e63b46ac768e62c1e41299f93e9e4f240e6d2c426a8f

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2L6203.exe
                        Filesize

                        1.8MB

                        MD5

                        33f9e889016b41140afdad01332d5a26

                        SHA1

                        f4de250dbaa6b3f9c8801498526e0bc22ad340a5

                        SHA256

                        599086e8d07adba2a1da0154abc7ec0c3517e4b13ed3f2cb0c6091bde27cc1eb

                        SHA512

                        40bc464738fe493630dc133edec1f7e02c5ae3aa8999a911636e3ba071b6e2080400f73d02f4f268526b0fa218d30a35361a7df69309c67b0e470be2392344b1

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                        Filesize

                        479KB

                        MD5

                        09372174e83dbbf696ee732fd2e875bb

                        SHA1

                        ba360186ba650a769f9303f48b7200fb5eaccee1

                        SHA256

                        c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                        SHA512

                        b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                        Filesize

                        13.8MB

                        MD5

                        0a8747a2ac9ac08ae9508f36c6d75692

                        SHA1

                        b287a96fd6cc12433adb42193dfe06111c38eaf0

                        SHA256

                        32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                        SHA512

                        59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
                        Filesize

                        6KB

                        MD5

                        e5a11ce84d8a0712c47dc9fcb8d3e4c8

                        SHA1

                        b727642e5f8577be43777590e58bbe1524713411

                        SHA256

                        9217f33ec9e1c49a1ea6f019cc9782a1990999048a09ddc6163729d5448fc650

                        SHA512

                        4187ddd14b07334e53d877597d95767d2ec061f0b3d24121c68824b34827625f720e987a11d1c4b38923ce1b0b4dc7e6f48459d16fd8b57c1faa39695bdac97c

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
                        Filesize

                        8KB

                        MD5

                        011f835d9e41520ffbab2ea5deb3839a

                        SHA1

                        948918b5a20055f99f50a4bbf1ac023e2fb9cc67

                        SHA256

                        27893987e126d8e4ae92cd09244e33e67e1c5627e19addf46701d855419efcd1

                        SHA512

                        878575bafd12de6ffb48fecc993d1258b3f080a03c047cf10e1f602c178d2841013cedf75df92ffd729528e43a375c634a9b6c4d2f2d1083e72624422e5b1077

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
                        Filesize

                        13KB

                        MD5

                        4143640ad79d6e765932986356505257

                        SHA1

                        541fb5118696915c52a3968aa000dd300770f24c

                        SHA256

                        1010179729de95ce677c9e4d33f12e0fd86d3eba637be5e99ef89221be445700

                        SHA512

                        5b9cfba6f822849d8f8208d0314a26cd07d76ea3b344870e0a715340ed0ee7ffa3b4de1616a252575d1f2912c965a8c8dd837c5989a26532c02097157b879379

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.bin
                        Filesize

                        24KB

                        MD5

                        4a97c890d31dc3fad9b5c434b6c58e21

                        SHA1

                        ce251799c6a7897cb9f783c792cfddac41ae6426

                        SHA256

                        f2e2fffa6152662dc78786313cb67616a59ba5aca0c035c9436cfeb4c8656437

                        SHA512

                        cabe13e17a4d75ef8e70e170a417e81ad35d85f297e5e3c100ecab70dbbcd476ab6ec252211dfd5ca01096e4ab23821b69ac0825ae0c7d53bf286207edb64463

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.bin
                        Filesize

                        23KB

                        MD5

                        98421a686559115df8a7c8d620eef53b

                        SHA1

                        004dec14e006e3500954056e843c616aae95eac1

                        SHA256

                        752f7433015b0c05c33051a7d085064d0515c3e975f242837e8d33e0261236a7

                        SHA512

                        a07664d8ea437b5a695aed154c235fcd312a802b5bc866e35eca804ee8d9d6df543c7fd1e6cbfd979806a0bfd3ef838ec10d7ef626b04f55703898fcff0cdc51

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.bin
                        Filesize

                        22KB

                        MD5

                        28f8f4b2614eab8beace9f0deff78539

                        SHA1

                        8f445f4f49cdb57220e153e6dc86697727f699bb

                        SHA256

                        0bab43926512a28aa0ec3e5ef8854be65580fb64110d2cd67b37c72ab8015034

                        SHA512

                        ca1f6866392d38b81d7c1037163a85698b7e6f40df340e5a28a9f93c0114d9ce5942d9ddcd7d4ad71564fe189b16b8d2304dad1a131d50a7681ca08cbc3ea997

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.bin
                        Filesize

                        24KB

                        MD5

                        2e4f41a6626a1612ba4ed1c1943f9161

                        SHA1

                        4bd352d2f4eb133d2bb86106dca4ebc273d7057f

                        SHA256

                        a2ad4c5b6eb7f368e29a3990fb21691eedaa76aeadaaf48e91d72fc3bbf4ea97

                        SHA512

                        897a51100eeb3d8e58aa80f37257c8701f7d8df89637fb99a98d1b198271bbe479f4f915f8be9f6a392bede87aa9df29751b970c2c04b9f259f62abbde3c1b48

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        22KB

                        MD5

                        40742fafa6f8e337f4c5b2ed204f0a2e

                        SHA1

                        ccee487b6834c927b72a6f47b0a89cd9b00999e2

                        SHA256

                        f8c5ba9ec93ab67e6372d7c8b2139af6671e81b76807db7c2da532ba445b10b4

                        SHA512

                        b8a31ac0f636e75cd95a1b827e602e38f7407abf260b965f02e335b1c30653ab7117149ac9b0fa6a7bb90e11557914ed90b3a23edfb076c26ae62498f0649c91

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        25KB

                        MD5

                        f189581caad934e01c1f64bfd29efa54

                        SHA1

                        b10e1084ce45287047a1ff4150a036c37342604e

                        SHA256

                        ed3c598fac42ae99b1b08aa3e76ca6a84df67d8de196ead81b9d34b7c380e0d7

                        SHA512

                        a1718496e2ef46ebb5cbb80a8643f9c58fd6e7cc6586598983896632dd5f66a09e0c7e518bd7c1c30f3d40d7342835ead46d39fac040db5e30768f7d8c4a2e07

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        24KB

                        MD5

                        7e7c1085d646b6d2a98256a03f9b64a5

                        SHA1

                        3655307cdd437574cb080655080724ac2fb4ee0d

                        SHA256

                        8a223dcd4acf9bda95c8b7f4d68b91622751a29a7e49d321b42e1805ea37784d

                        SHA512

                        4b946ac80fc76e7c9ec4e15a39c35599bd19fbd6387a62042a5e6035d20a39de659ac2f34971490ef2b119c26ca2360ba4e238027ad86ee6c943fddbda93ab32

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        21KB

                        MD5

                        ad2cb03587d45c10eaf03566c5f0554c

                        SHA1

                        6d9ef4a4b0ca9c1fd6085549cc76892376e94f7f

                        SHA256

                        8264788669e4cb06b8ffc5a8d3df4051a2e30906c766d4dc3e61ac9b229e7f36

                        SHA512

                        14d44955b5753e5f45779cadbb35944bcdbe11b0aae3fedbaf7481f1f8a5f514b81191da8aeba1e2a22ec416a5634d39c17f663b7dac9d7fceed88bf4876e448

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        22KB

                        MD5

                        b0ffe4247930b6ff384ecb7da3cf482c

                        SHA1

                        a4c70bedbbcdf01118778fe43b5ecfa2806b6a66

                        SHA256

                        6e4a71d8841d3dd1a3aeb57099b72a555993693373f5b93e6271f8d59ffd7457

                        SHA512

                        3a1898a6b2879abf483a7f683865cde14dc9a3a966b7a3c19bc403b95fa3879bf9b4a5828920f5ecda8dc5301e7cd96e37510d4c467df23e9910404300a1909d

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\49643fe4-056a-4e2d-b0e0-759370316147
                        Filesize

                        659B

                        MD5

                        c1a74a8a1f4f08828711a1f19b3d7e2f

                        SHA1

                        2fab0525881e7bfcb94151d239c841696694d019

                        SHA256

                        e25229c5e244e6db100548287224816ff8ac970ae366d4d59697d708175e5e59

                        SHA512

                        7058c3d569179c54ed570e093c597cbbf8f4f2cbd636b9af1e31bfbcbd3d21fe94a06a4e782f559189b437ba4ed248d464f93c9985a322494229219374839f8a

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\d6bf5b7b-ad50-44d1-a596-d732c5a11275
                        Filesize

                        982B

                        MD5

                        881c29484a2e4fce1e5f085b4e84f335

                        SHA1

                        ab5094648ca94c7959579a489297112cf824c9e3

                        SHA256

                        e5af0532eae9e219bd6091aadaa4f5d52a0e6927c5eb447bc0fad6b134e836f0

                        SHA512

                        cc39ef1aa2a30611f3f24272df62c9a42bf633d4177dd3a01bcdb5a93e46600dbcfa5b55da120313d1718073c5fb7589e14efadea8585ed6afdcf3847f1d8e7e

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                        Filesize

                        1.1MB

                        MD5

                        842039753bf41fa5e11b3a1383061a87

                        SHA1

                        3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                        SHA256

                        d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                        SHA512

                        d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                        Filesize

                        116B

                        MD5

                        2a461e9eb87fd1955cea740a3444ee7a

                        SHA1

                        b10755914c713f5a4677494dbe8a686ed458c3c5

                        SHA256

                        4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                        SHA512

                        34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                        Filesize

                        372B

                        MD5

                        bf957ad58b55f64219ab3f793e374316

                        SHA1

                        a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                        SHA256

                        bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                        SHA512

                        79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                        Filesize

                        17.8MB

                        MD5

                        daf7ef3acccab478aaa7d6dc1c60f865

                        SHA1

                        f8246162b97ce4a945feced27b6ea114366ff2ad

                        SHA256

                        bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                        SHA512

                        5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
                        Filesize

                        11KB

                        MD5

                        481febca705e22ae40795ef674b7e3a4

                        SHA1

                        dd15dbb0429638ac5e257a25d21d39f518bdbf22

                        SHA256

                        8d89ed4f17370bdc76c9929f70e70371a2395a24bb9a0b620bb3a97d8a2361e3

                        SHA512

                        928ed0d6a9ee3384b1837c77d1cf573908fd9a0cd8840d9dbccde04504647096af7505a3035a9d8f1146894cba580b14b9633904ab491fa8f5dd86b4111de162

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
                        Filesize

                        15KB

                        MD5

                        62684b1568d3103a8b34936079ea81d5

                        SHA1

                        39476ad1b298b1aad162476b007ed7d260908352

                        SHA256

                        1a02f72ae92b1c7580948f544eab33e6cea733fefc4905d966c4f9c88e8c1f28

                        SHA512

                        a8a43b29e83d783839b8ab1135edcf84aac575fa92512930e39c17c89b2d070cbb92f8256b08df0a5dd0b05999e058c2f979bf035436b6cfdee2577fec3f6918

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
                        Filesize

                        10KB

                        MD5

                        1a9762fdcbea88354853530d46cdc1c9

                        SHA1

                        8850650115ecadb76259d6f13394f68fdd38e70e

                        SHA256

                        90e91602b85b1809b36e945c1befdb7412dd7385a3ffaf226721d311ef1fb677

                        SHA512

                        26706da839d7bd2298aeff007d8265ab5456790bfc60dfd0430f2dae27435488c83d278b64d10648a365551d48dce7f411e6bb255b969689d8cb2758b0e54dce

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs.js
                        Filesize

                        11KB

                        MD5

                        7c436ba651d9cc8955f7d9de6da7220c

                        SHA1

                        c0d030a9d196fd5555ef7fa30e46a04c6326c3a3

                        SHA256

                        cdcfafa8a9266d583220edb0ec9d6aaaa717be786682ab0165c1901cc7c56834

                        SHA512

                        20415461e97534282348c0bff538363362ee0579af6b72212aef66ac3ce1281b51e6fd53933ecc6a0d84f7023c7ab28579db0a5c03e0dfc83d6ab3c4288655e0

                        Download Submit

                      • memory/208-142-0x00000000005C0000-0x0000000000AC4000-memory.dmp

                        Filesize

                        5.0MB

                        Download

                      • memory/208-165-0x00000000005C0000-0x0000000000AC4000-memory.dmp

                        Filesize

                        5.0MB

                        Download

                      • memory/624-39-0x0000000000700000-0x0000000000BAE000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/624-91-0x0000000000700000-0x0000000000BAE000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/624-69-0x0000000000700000-0x0000000000BAE000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1452-1965-0x0000000009BF0000-0x0000000009C56000-memory.dmp

                        Filesize

                        408KB

                        Download

                      • memory/1452-58-0x00000000002D0000-0x000000000072E000-memory.dmp

                        Filesize

                        4.4MB

                        Download

                      • memory/1452-64-0x00000000002D0000-0x000000000072E000-memory.dmp

                        Filesize

                        4.4MB

                        Download

                      • memory/1452-65-0x00000000002D0000-0x000000000072E000-memory.dmp

                        Filesize

                        4.4MB

                        Download

                      • memory/1452-108-0x00000000002D0000-0x000000000072E000-memory.dmp

                        Filesize

                        4.4MB

                        Download

                      • memory/1452-1355-0x0000000008C70000-0x0000000008C8E000-memory.dmp

                        Filesize

                        120KB

                        Download

                      • memory/1452-1348-0x0000000008330000-0x00000000083A6000-memory.dmp

                        Filesize

                        472KB

                        Download

                      • memory/1564-166-0x0000000000090000-0x00000000003BB000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/1564-2692-0x0000000000090000-0x00000000003BB000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/1564-986-0x0000000000090000-0x00000000003BB000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/1564-1270-0x0000000000090000-0x00000000003BB000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/1564-3840-0x0000000000090000-0x00000000003BB000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/1564-35-0x0000000000090000-0x00000000003BB000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/1564-1747-0x0000000000090000-0x00000000003BB000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/1564-3802-0x0000000000090000-0x00000000003BB000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/1564-92-0x0000000000090000-0x00000000003BB000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/1564-3459-0x0000000000090000-0x00000000003BB000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/1564-3536-0x0000000000090000-0x00000000003BB000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/1564-3728-0x0000000000090000-0x00000000003BB000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/1564-3652-0x0000000000090000-0x00000000003BB000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/1564-3578-0x0000000000090000-0x00000000003BB000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/1564-66-0x0000000000090000-0x00000000003BB000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/1564-919-0x0000000000090000-0x00000000003BB000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/1696-97-0x00000000009D0000-0x0000000000EB8000-memory.dmp

                        Filesize

                        4.9MB

                        Download

                      • memory/1696-101-0x00000000009D0000-0x0000000000EB8000-memory.dmp

                        Filesize

                        4.9MB

                        Download

                      • memory/1700-99-0x0000000000310000-0x0000000000814000-memory.dmp

                        Filesize

                        5.0MB

                        Download

                      • memory/1700-93-0x0000000000310000-0x0000000000814000-memory.dmp

                        Filesize

                        5.0MB

                        Download

                      • memory/1844-107-0x0000000000910000-0x0000000000D6E000-memory.dmp

                        Filesize

                        4.4MB

                        Download

                      • memory/1844-192-0x0000000000910000-0x0000000000D6E000-memory.dmp

                        Filesize

                        4.4MB

                        Download

                      • memory/1844-105-0x0000000000910000-0x0000000000D6E000-memory.dmp

                        Filesize

                        4.4MB

                        Download

                      • memory/1844-106-0x0000000000910000-0x0000000000D6E000-memory.dmp

                        Filesize

                        4.4MB

                        Download

                      • memory/1844-167-0x0000000000910000-0x0000000000D6E000-memory.dmp

                        Filesize

                        4.4MB

                        Download

                      • memory/1940-68-0x00000000009C0000-0x0000000000E16000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/1940-67-0x00000000009C0000-0x0000000000E16000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/1940-63-0x00000000009C0000-0x0000000000E16000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/1940-124-0x00000000009C0000-0x0000000000E16000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/1940-163-0x00000000009C0000-0x0000000000E16000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/1964-133-0x0000000000570000-0x0000000000A19000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1964-85-0x0000000000570000-0x0000000000A19000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2740-1678-0x0000000000090000-0x00000000003BB000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/2740-1654-0x0000000000090000-0x00000000003BB000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/2936-946-0x0000000000180000-0x00000000005D6000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/2936-939-0x0000000000180000-0x00000000005D6000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/2936-189-0x0000000000180000-0x00000000005D6000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/2936-190-0x0000000000180000-0x00000000005D6000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/2936-187-0x0000000000180000-0x00000000005D6000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/3276-913-0x0000000000CD0000-0x0000000001126000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/3276-813-0x0000000000CD0000-0x0000000001126000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/3276-136-0x0000000000CD0000-0x0000000001126000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/3276-135-0x0000000000CD0000-0x0000000001126000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/3276-134-0x0000000000CD0000-0x0000000001126000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/3552-21-0x00000000001D0000-0x00000000004FB000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/3552-34-0x00000000001D0000-0x00000000004FB000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/5076-127-0x0000000000FE0000-0x00000000014E4000-memory.dmp

                        Filesize

                        5.0MB

                        Download

                      • memory/5076-125-0x0000000000FE0000-0x00000000014E4000-memory.dmp

                        Filesize

                        5.0MB

                        Download

                      • memory/5424-3727-0x0000000000090000-0x00000000003BB000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/5736-907-0x0000000000400000-0x0000000000457000-memory.dmp

                        Filesize

                        348KB

                        Download

                      • memory/5736-905-0x0000000000400000-0x0000000000457000-memory.dmp

                        Filesize

                        348KB

                        Download

                      • memory/5736-909-0x0000000000400000-0x0000000000457000-memory.dmp

                        Filesize

                        348KB

                        Download

                      • memory/5744-1892-0x0000000000940000-0x00000000015A1000-memory.dmp

                        Filesize

                        12.4MB

                        Download

                      • memory/5744-1625-0x0000000000940000-0x00000000015A1000-memory.dmp

                        Filesize

                        12.4MB

                        Download

                      • memory/5744-1634-0x0000000000940000-0x00000000015A1000-memory.dmp

                        Filesize

                        12.4MB

                        Download

                      • memory/5744-1163-0x0000000000940000-0x00000000015A1000-memory.dmp

                        Filesize

                        12.4MB

                        Download

                      • memory/5996-1003-0x0000000000520000-0x0000000001160000-memory.dmp

                        Filesize

                        12.2MB

                        Download

                      • memory/5996-1004-0x0000000000520000-0x0000000001160000-memory.dmp

                        Filesize

                        12.2MB

                        Download

                      • memory/5996-943-0x0000000000520000-0x0000000001160000-memory.dmp

                        Filesize

                        12.2MB

                        Download

                      • memory/6264-977-0x0000000076110000-0x0000000076325000-memory.dmp

                        Filesize

                        2.1MB

                        Download

                      • memory/6264-975-0x00007FFAB8B90000-0x00007FFAB8D85000-memory.dmp

                        Filesize

                        2.0MB

                        Download

                      • memory/6264-974-0x0000000005170000-0x0000000005570000-memory.dmp

                        Filesize

                        4.0MB

                        Download

                      • memory/6264-973-0x0000000005170000-0x0000000005570000-memory.dmp

                        Filesize

                        4.0MB

                        Download

                      • memory/6264-972-0x00000000000E0000-0x00000000005A8000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/6264-985-0x00000000000E0000-0x00000000005A8000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/6424-978-0x00000000010A0000-0x00000000010AA000-memory.dmp

                        Filesize

                        40KB

                        Download

                      • memory/6424-980-0x0000000001640000-0x0000000001A40000-memory.dmp

                        Filesize

                        4.0MB

                        Download

                      • memory/6424-983-0x0000000076110000-0x0000000076325000-memory.dmp

                        Filesize

                        2.1MB

                        Download

                      • memory/6424-981-0x00007FFAB8B90000-0x00007FFAB8D85000-memory.dmp

                        Filesize

                        2.0MB

                        Download

                      • memory/6660-1002-0x00000000003E0000-0x000000000087D000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/6660-1010-0x00000000003E0000-0x000000000087D000-memory.dmp

                        Filesize

                        4.6MB

                        Download