Overview

overview

10

Static

static

3

ecdf6a1f1e...f3.exe

windows7-x64

9

ecdf6a1f1e...f3.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2025, 22:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ecdf6a1f1edacf783d09e9ff7836e0c41964bf394a4710d278f4c07a5fd586f3.exe

  • Size

    3.0MB

  • MD5

    136e82403122d1036228ef096413d27a

  • SHA1

    530e7a1ab9c54b16aca88c410c6a6d6f9180cb4b

  • SHA256

    ecdf6a1f1edacf783d09e9ff7836e0c41964bf394a4710d278f4c07a5fd586f3

  • SHA512

    0b0642b8b04b964d7875b62c20c0d5230cb3b3cf6239543fda3021a0f940aded0609c388bad7c7c6735dc03e1f578e4fcd7a1d9f3a2942fba1173bcf55ebc8c7

  • SSDEEP

    49152:r1bpc4t5xZJ2MwuEi6FHGCsPdCL+mwHL:r1/t5t2MOpHGxFCL+

Score
10/10
amadeyhealerlitehttpstealc092155trumpbotdefense_evasiondiscoverydropperevasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Extracted

Family

litehttp

Version

v1.0.9

C2

http://185.208.156.162/page.php

Attributes
  • key

    v1d6kd29g85cm8jp4pv8tvflvg303gbl

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • LiteHTTP

    LiteHTTP is an open-source bot written in C#.

    stealerbotlitehttp
  • Litehttp family
    litehttp
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
    defense_evasion
  • Downloads MZ/PE file 11 IoCs
  • Checks BIOS information in registry 2 TTPs 20 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Identifies Wine through registry keys 2 TTPs 10 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\ecdf6a1f1edacf783d09e9ff7836e0c41964bf394a4710d278f4c07a5fd586f3.exe
    "C:\Users\Admin\AppData\Local\Temp\ecdf6a1f1edacf783d09e9ff7836e0c41964bf394a4710d278f4c07a5fd586f3.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Downloads MZ/PE file
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4344
    • C:\Users\Admin\AppData\Local\Temp\TJ9YG2U8BJM54ZFT.exe
      "C:\Users\Admin\AppData\Local\Temp\TJ9YG2U8BJM54ZFT.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1344
      • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Downloads MZ/PE file
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2764
        • C:\Users\Admin\AppData\Local\Temp\10106910101\ktxzLhN.exe
          "C:\Users\Admin\AppData\Local\Temp\10106910101\ktxzLhN.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:856
          • C:\Users\Admin\AppData\Local\Temp\dll32.exe
            "C:\Users\Admin\AppData\Local\Temp\dll32.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2604
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp66EE.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp66EE.tmp.bat
              6⤵
                PID:5732
                • C:\Windows\system32\chcp.com
                  chcp 65001
                  7⤵
                    PID:5748
                  • C:\Windows\system32\tasklist.exe
                    Tasklist /fi "PID eq 2604"
                    7⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5824
                  • C:\Windows\system32\find.exe
                    find ":"
                    7⤵
                      PID:5832
                    • C:\Windows\system32\timeout.exe
                      Timeout /T 1 /Nobreak
                      7⤵
                      • Delays execution with timeout.exe
                      PID:5892
                    • C:\Users\Admin\AppData\Roaming\AdminUserCash\tempdatalogger.exe
                      "C:\Users\Admin\AppData\Roaming\AdminUserCash\tempdatalogger.exe"
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:6024
              • C:\Users\Admin\AppData\Local\Temp\10107160101\d1adfdd8ff.exe
                "C:\Users\Admin\AppData\Local\Temp\10107160101\d1adfdd8ff.exe"
                4⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Downloads MZ/PE file
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3456
                • C:\Users\Admin\AppData\Local\Temp\GQ5IH884TKK0IEYRLHWMSQDG.exe
                  "C:\Users\Admin\AppData\Local\Temp\GQ5IH884TKK0IEYRLHWMSQDG.exe"
                  5⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:860
              • C:\Users\Admin\AppData\Local\Temp\10107170101\bd46c2c23a.exe
                "C:\Users\Admin\AppData\Local\Temp\10107170101\bd46c2c23a.exe"
                4⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:3784
              • C:\Users\Admin\AppData\Local\Temp\10107180101\edf4838555.exe
                "C:\Users\Admin\AppData\Local\Temp\10107180101\edf4838555.exe"
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:3868
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM firefox.exe /T
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4392
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM chrome.exe /T
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:244
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM msedge.exe /T
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1216
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM opera.exe /T
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3780
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM brave.exe /T
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1296
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1912
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    6⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:4704
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1960 -prefMapHandle 1952 -prefsLen 27352 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {864ac6ba-02a5-4552-b337-f4b684c2d4e7} 4704 "\\.\pipe\gecko-crash-server-pipe.4704" gpu
                      7⤵
                        PID:4352
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2484 -parentBuildID 20240401114208 -prefsHandle 2392 -prefMapHandle 2376 -prefsLen 28272 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e5f61d4-c28f-4297-8c58-f7d265099cfd} 4704 "\\.\pipe\gecko-crash-server-pipe.4704" socket
                        7⤵
                          PID:552
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3024 -childID 1 -isForBrowser -prefsHandle 3004 -prefMapHandle 3000 -prefsLen 22684 -prefMapSize 244628 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1bd66725-8b2b-4da3-b7f4-f7fccc020711} 4704 "\\.\pipe\gecko-crash-server-pipe.4704" tab
                          7⤵
                            PID:2296
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3892 -childID 2 -isForBrowser -prefsHandle 3904 -prefMapHandle 3900 -prefsLen 32762 -prefMapSize 244628 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {407bc981-5986-4e26-ae8e-c55cab40f6e4} 4704 "\\.\pipe\gecko-crash-server-pipe.4704" tab
                            7⤵
                              PID:3476
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4712 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4600 -prefMapHandle 4620 -prefsLen 32762 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e91d66e6-c647-4120-abad-b02ea183b488} 4704 "\\.\pipe\gecko-crash-server-pipe.4704" utility
                              7⤵
                              • Checks processor information in registry
                              PID:5348
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5312 -childID 3 -isForBrowser -prefsHandle 5304 -prefMapHandle 5300 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f17871aa-e9fd-4ca7-bd0f-268f58354f00} 4704 "\\.\pipe\gecko-crash-server-pipe.4704" tab
                              7⤵
                                PID:6040
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5536 -childID 4 -isForBrowser -prefsHandle 5456 -prefMapHandle 5460 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a530f856-3e8d-4258-8897-41c4d0d212e2} 4704 "\\.\pipe\gecko-crash-server-pipe.4704" tab
                                7⤵
                                  PID:6052
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5736 -childID 5 -isForBrowser -prefsHandle 5656 -prefMapHandle 5664 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9a042d2-dfa8-45ac-9ba5-aa36800aea20} 4704 "\\.\pipe\gecko-crash-server-pipe.4704" tab
                                  7⤵
                                    PID:6064
                            • C:\Users\Admin\AppData\Local\Temp\10107190101\c1ba2fd1b8.exe
                              "C:\Users\Admin\AppData\Local\Temp\10107190101\c1ba2fd1b8.exe"
                              4⤵
                              • Modifies Windows Defender DisableAntiSpyware settings
                              • Modifies Windows Defender Real-time Protection settings
                              • Modifies Windows Defender TamperProtection settings
                              • Modifies Windows Defender notification settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4468
                            • C:\Users\Admin\AppData\Local\Temp\10107200101\zY9sqWs.exe
                              "C:\Users\Admin\AppData\Local\Temp\10107200101\zY9sqWs.exe"
                              4⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:5664
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10107211121\PcAIvJ0.cmd"
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:5952
                            • C:\Users\Admin\AppData\Local\Temp\10107220101\v6Oqdnc.exe
                              "C:\Users\Admin\AppData\Local\Temp\10107220101\v6Oqdnc.exe"
                              4⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              PID:5376
                            • C:\Users\Admin\AppData\Local\Temp\10107230101\MCxU5Fj.exe
                              "C:\Users\Admin\AppData\Local\Temp\10107230101\MCxU5Fj.exe"
                              4⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              PID:5912
                              • C:\Users\Admin\AppData\Local\Temp\10107230101\MCxU5Fj.exe
                                "C:\Users\Admin\AppData\Local\Temp\10107230101\MCxU5Fj.exe"
                                5⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:5624
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 5912 -s 800
                                5⤵
                                • Program crash
                                PID:5732
                            • C:\Users\Admin\AppData\Local\Temp\10107240101\ce4pMzk.exe
                              "C:\Users\Admin\AppData\Local\Temp\10107240101\ce4pMzk.exe"
                              4⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2860
                      • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                        C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2700
                      • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                        C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        PID:6124
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5912 -ip 5912
                        1⤵
                          PID:5896

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        4
                        T1543

                        Windows Service

                        4
                        T1543.003

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        4
                        T1543

                        Windows Service

                        4
                        T1543.003

                        Defense Evasion

                        Impair Defenses

                        5
                        T1562

                        Disable or Modify Tools

                        5
                        T1562.001

                        Modify Registry

                        6
                        T1112

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Unsecured Credentials

                        3
                        T1552

                        Credentials In Files

                        3
                        T1552.001

                        Discovery

                        Browser Information Discovery

                        1
                        T1217

                        Process Discovery

                        1
                        T1057

                        Query Registry

                        7
                        T1012

                        System Information Discovery

                        4
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Lateral Movement

                        Collection

                        Data from Local System

                        3
                        T1005

                        Command and Control

                        Web Service

                        1
                        T1102

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v82jw7ls.default-release\activity-stream.discovery_stream.json
                          Filesize

                          19KB

                          MD5

                          ca46397a8350ab60f3bd7a55651e0f6b

                          SHA1

                          0de049ab47f4722f7e37eee0e4a1d4efd42c3140

                          SHA256

                          9f54d10875815fe4ee56555fa20b60b38a410f3537c24d53752f824e2c9bdc32

                          SHA512

                          09ee3af7de57a6ee2b87289e52ce894d826f7da9eb98fd6fcecca81b8db72a2b6b2b062449ce61b634285c1a822c4d841d40cbf3c14a46e2cf6da4ea4acb07dd

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v82jw7ls.default-release\cache2\entries\ADF5BD09EB688DAB1F35EE02E8C35329D0E4AD89
                          Filesize

                          13KB

                          MD5

                          3f47a20f902ce2456b77450e6c938627

                          SHA1

                          d960adb642cab9b25f7bd95fa2f83b5eeafb5e1c

                          SHA256

                          ae03acedde63343e127c2d4b61a58c114c26c75870d8cb7870e03b9308feb5ed

                          SHA512

                          1b07e984601cc952531c22d8612403d6156bb7146523f2933599bef8f6ae30ab68d593c6485d3925c4daa502820836bf5ef9ea70d71d677a0be059d2b3a8bfb8

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10106910101\ktxzLhN.exe
                          Filesize

                          15.0MB

                          MD5

                          35a4dfb5f0308d20b1e5bf26e0a70509

                          SHA1

                          0c72b35b74dadbce4a95c034968913de271aae06

                          SHA256

                          40d3baeb6df3e2cd4eed207e773b21989b86ef547de12a748529c2b559025339

                          SHA512

                          51b8bf5583a256015daaa8caa9c9868c792ef4a1157b89a6880b365c4c5a1c7416abc2b1fcdde9d1d5d9bb7aaa1c617d5b34124a582ec042ac5a2afa064c60d9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10107160101\d1adfdd8ff.exe
                          Filesize

                          3.1MB

                          MD5

                          7c169698effcdd45b7cbd763d28e87f5

                          SHA1

                          4f9db666d66255cd7ca2b0973ff00eae8b155f7a

                          SHA256

                          c7fd445ebedd5cfa9a01daccc7c5771a88f1719b6dbfe16c9f0334fc4371250b

                          SHA512

                          58335071c6f27e72c8cd505859c9b122ff354395b239697311c1ce17f224c58dd9e2894fbc874c835866a299b3ae9ffab767195a253698fed0d39f3fb15ff8e3

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10107170101\bd46c2c23a.exe
                          Filesize

                          1.7MB

                          MD5

                          2012699a5e85cd283323c324aa061bc7

                          SHA1

                          69d93116908bf4b6c61a9cb2d3f50a5fbb8cec0f

                          SHA256

                          937ff3f78062e3aaad013b88bb6e807770d40bb65e538eee9c5de6b1487510b5

                          SHA512

                          729e7f19b8dc678a8f8912a9ab64169391259fe9d129ba99ef91360f82f81b2c2e628d68a4d5d9c2e4e3fe9e5c09ff295e6021bb3d23a107d6ab59a361d66683

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10107180101\edf4838555.exe
                          Filesize

                          949KB

                          MD5

                          e935a122d4c4e9c1b44368821a5154ff

                          SHA1

                          c93e4b9fb9563cb04a9cd39c75220eaf6007f98f

                          SHA256

                          161b8b9257159ff8789d47b9a4f5c4b7c6a6e66470392898a8c301348d28cbb4

                          SHA512

                          75a94d4c73fb917adaae4cc2c8e3a74bc4520cd45b87af146b53aca42b194cd26126ad4a2db5efad2aaa41e2874f8b71d58ebab8752c73039e233c8cd94a7e7f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10107190101\c1ba2fd1b8.exe
                          Filesize

                          1.7MB

                          MD5

                          e787e8998f5306a754d625d7e29bbeb5

                          SHA1

                          14e056dbf0b3991664910ee3a1d23a4bb2c0253d

                          SHA256

                          93339b4579800e861b8606cd011c6d919790c72691346eede1aa5d116514672d

                          SHA512

                          30463019ed1ba9aa0a46623f9068b842161c03f03bbd98da21584abf9c913beade0df4ae758c13f20dcd7937a26f1a6c7c5e6f785c75ce05ea500a7fe6d240f6

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10107200101\zY9sqWs.exe
                          Filesize

                          361KB

                          MD5

                          2bb133c52b30e2b6b3608fdc5e7d7a22

                          SHA1

                          fcb19512b31d9ece1bbe637fe18f8caf257f0a00

                          SHA256

                          b8e02f2bc0ffb42e8cf28e37a26d8d825f639079bf6d948f8debab6440ee5630

                          SHA512

                          73229885f8bf4aace4671b819a8487f36acb7878cd309bdf80b998b0a63584f3063364d192b1fc26fa71b9664908fe290a00f6898350c30f40d5f2a2d2efe51f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10107211121\PcAIvJ0.cmd
                          Filesize

                          275B

                          MD5

                          c203adcd3b4b1717be1e79d7d234f89c

                          SHA1

                          a0c726c32766f5d3e3de1bdc9998da2bb2a657e4

                          SHA256

                          bc953bccc3974ff2a40fd6ce700e499d11bfd2463014786a4cb0f7bac6568ad8

                          SHA512

                          724f920d5e5f31155629155184a1ccf6299c72da04362062512c154e27bed136292a0af51f423e8e05d8f80426b72f679a01ab9662d4da6ffc06cfcbcd005368

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10107220101\v6Oqdnc.exe
                          Filesize

                          2.0MB

                          MD5

                          6006ae409307acc35ca6d0926b0f8685

                          SHA1

                          abd6c5a44730270ae9f2fce698c0f5d2594eac2f

                          SHA256

                          a5fa1579a8c1a1d4e89221619d037b6f8275f34546ed44a020f5dfcee3710f0b

                          SHA512

                          b2c47b02c972f63915e2e45bb83814c7706b392f55ad6144edb354c7ee309768a38528af7fa7aeadb5b05638c0fd55faa734212d3a657cd08b7500838135e718

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10107230101\MCxU5Fj.exe
                          Filesize

                          415KB

                          MD5

                          641525fe17d5e9d483988eff400ad129

                          SHA1

                          8104fa08cfcc9066df3d16bfa1ebe119668c9097

                          SHA256

                          7a87b801af709e8e510140f0f9523057793e7883ec2b6a4eab90fcf0ec20fd4a

                          SHA512

                          ee92bc34e21bb68aeda20b237e8b8e27f95e4cc44f5fd9743b52079c40f193cc342f8bb2690fd7ab3624e1690979118bd2e00a46bda3052cbd76bc379b87407e

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10107240101\ce4pMzk.exe
                          Filesize

                          48KB

                          MD5

                          d39df45e0030e02f7e5035386244a523

                          SHA1

                          9ae72545a0b6004cdab34f56031dc1c8aa146cc9

                          SHA256

                          df468fc510aec82c827987f54b824b978dd71301f93d18d71e704727d6dfdfa2

                          SHA512

                          69866ba5b53d1183a0899e3d22ff06111ae2e8df429beeb853c89f3ed0afb015dd4139b1c507566ffb0fe171a4ff1b318247b7a568dc492d9f71266f5c848a64

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Costura\05A92EC28EDC5561548638CAA951F864\64\sqlite.interop.dll
                          Filesize

                          1.7MB

                          MD5

                          65ccd6ecb99899083d43f7c24eb8f869

                          SHA1

                          27037a9470cc5ed177c0b6688495f3a51996a023

                          SHA256

                          aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4

                          SHA512

                          533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\TJ9YG2U8BJM54ZFT.exe
                          Filesize

                          1.8MB

                          MD5

                          f42f59d1a7bc1d3fcd51d41a76974175

                          SHA1

                          08591f2269d3d8c8099beaa0f4676ae8b0f7bb1c

                          SHA256

                          ad14a834ed7d0994d38ec0374f26f4837e94fe5b54d15442c5b2fb796365dc38

                          SHA512

                          38c5cc4567b19c637b58874dd408d5994c168f071962d7008889b9e360667301107a9efd7e1ee326e53bddbec5f536d562d91c7170761127f568d3175544eaae

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\dll32.exe
                          Filesize

                          5.7MB

                          MD5

                          ffb5c5f8bab4598fada3bbf92d02d66d

                          SHA1

                          ae8096c1f160c97874179ea878a61f69bfb9941a

                          SHA256

                          f3aa764be17f1a197f94b949cfd88f99c2d67e9fec1f53046ef1b6189f594da1

                          SHA512

                          902e8a95b964ef3a48504dcdb3c4f0615212eb942476ec26b88e02a39cbaaf866f3fcbe5cd4374342b80aae9a7e17092a28dbe1d53630493a0b0cee8152a4ccf

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmp66EE.tmp.bat
                          Filesize

                          278B

                          MD5

                          26b8a18092d5b4b27ac16ad92ddaabe7

                          SHA1

                          e0b66324e2fe5c6710d0ed03160579d8cd28c99b

                          SHA256

                          b52ebbc9569bd35da800599659649877d7760a740a6c93df436abef0e1e649f9

                          SHA512

                          28b9b3e581252fa19582dd69f444771e831d141b518e39c3aa45ca5d7f90197b96840accc051e1d1f15a79815a67f9394156c2040626f937ef51bd70cc0423bf

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                          Filesize

                          479KB

                          MD5

                          09372174e83dbbf696ee732fd2e875bb

                          SHA1

                          ba360186ba650a769f9303f48b7200fb5eaccee1

                          SHA256

                          c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                          SHA512

                          b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                          Filesize

                          10.2MB

                          MD5

                          b1ec1d46be505e62f7f9c73da3e841cc

                          SHA1

                          8250fd0c8d26eceb095c57b4bc454c4ec0b20e1a

                          SHA256

                          907b2fc8059bc6095c9e64a507ad9603caf9d85c8100cc43eeaf66a21db7b34c

                          SHA512

                          064d8af634b3a408f2fa08d65cb9af07944ed45807b7c596e21c9aa0303a361b932ef04fbd1c44ccfcc7a51d7bff1cc3c22c7b6920bf4e37040443707c9519a8

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\AlternateServices.bin
                          Filesize

                          8KB

                          MD5

                          6387adce098e30b69b2371b56c7369bf

                          SHA1

                          69b07565b14d6c49ad69873794460b77ab9bae59

                          SHA256

                          6cce423fab478f5917998f41ffde0b933ee69eed035b04966ad5cc6cbca2767b

                          SHA512

                          8d3fdf46f875bd26647ba9adea421bcd18b2de7de56b630652d509039a68b780f933a220ca3250b7dd01d114171c3da93d623b64ab64582ea24730b9cb32d667

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\AlternateServices.bin
                          Filesize

                          13KB

                          MD5

                          8cbda8f396f12ebd31e3cd4ff7579a6d

                          SHA1

                          b51936f93fef74540de41c6dd67e348462a7d42f

                          SHA256

                          899621a9d726fc5fd09a6bd4b2100df5c7806b6ef38e8351ea04993ea8873db3

                          SHA512

                          33a724ba15cf14485e728840352a6462e34b631fdfbb815f07c1bdd75af5be0e1e61f92f897a6e9cdae9d60e909fb09f4c5ae68b413ed377175fea9943976d32

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\AlternateServices.bin
                          Filesize

                          15KB

                          MD5

                          607777dd2e92f16ec4b867e0f71b9d17

                          SHA1

                          34a987985e7ab7a35805ecd13a70ce2bb7467655

                          SHA256

                          74bca530db5ceab18997112de20b90356e7b48b41126601e2d86d260457afdd7

                          SHA512

                          d2bc7e078bae940ba3ecfcaacc2bc30732db928a44f1e7380c419d4538c0bed77cbaab004e57a40caf8e21ddace725da1d46dca09a9fdd1833980252bb521835

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\cert9.db
                          Filesize

                          224KB

                          MD5

                          09ad8932c241e954dd413a20c0e27eb8

                          SHA1

                          e7311daf7131c06bb0ec53753d523d7e18e1680c

                          SHA256

                          c65ac6ec0c75b7d0eb1ac1e5e5bbbe3601c05eb07ee1a071eee5c4473da26ff8

                          SHA512

                          7d87dafedea20cec0577de95a67c2169ca8450b9bcef366b36c452e000e085115446f35a59b42fe0d4db6aabd4c525609b9f52aa90d9dda62a4427b12464f863

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          5KB

                          MD5

                          74caa95eaf8ed3eb0ce53d627c822211

                          SHA1

                          d50a5ab1560306f8c0c9d0d7f3641389f0f1b34c

                          SHA256

                          d34ea89540ac62c0658bfd077b2ceff0786ba8574371436655777265407b726d

                          SHA512

                          bc68e37d8112eb8456d97f6c81341f09778db96aa557516f9409f597a97df96730f924519119c214c3153b519f141f0b9f00a756ad19be12cfe1b071b34146d1

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          27KB

                          MD5

                          ef02bea748ccd11d87d8d5fb58515b78

                          SHA1

                          98d4c44d9f4e38b2a1584aa6786617d9b0f539d1

                          SHA256

                          c669aed4a2aa558e92fd71cca0688d61eee7ffbb61e04fb5ad8b39134b52806e

                          SHA512

                          1719aa02231d9e3b32579b84b98a4ea60539a6b40b5410d2b1c105a38e8d1e75ec70e73313bf71ebcc8d388589438d1d77bc9ed2a4cedbdd8bed44de6a233ed4

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          27KB

                          MD5

                          0bebb38898e58689209cb3118ef0af37

                          SHA1

                          70327aba05060fb9c1de8bb547e00fb0902c08b1

                          SHA256

                          44990500ec265c6ec87f2a18aec1663042d670ce37f766afeafee0f4814d7394

                          SHA512

                          3b788a15c605258626a7286b45b1c2767a3e463b122a5beefd9c2d31a9275a091db98fd48741d40084504bcbd6613185ea8157cc1925aa3395bb8d64407cae4c

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          6KB

                          MD5

                          031b23810c5fdda07832e57f6e6c935c

                          SHA1

                          f9ff30eccafeb708a567a44c41d9f66323196104

                          SHA256

                          cfad4f7cd65a98e86877d3bf4c3368fc2cbc5e8bb193ea8b2e41a4cea7ae9c77

                          SHA512

                          706393166fab96fad6e5ecd8e69649a5ce749fe938241a09c0ccb2633827a3a7e46e19edaf601982542d589d1a3eb61b53b77bac1a52feb2147b9d1c03424da1

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\datareporting\glean\pending_pings\33c2d97b-f4b6-4cad-93f1-2632b1e3ec3b
                          Filesize

                          671B

                          MD5

                          1a86a29ab095babf8550babfbc6e6cd6

                          SHA1

                          e05d5e840e876fd0461ac125021624831ef0c838

                          SHA256

                          873ba1351df64e2e5f1c7b699c95a7e125dea8c5f649d77ae3539f20110964fc

                          SHA512

                          d01ecd49d1581493ae0a778f4d4d5cae1321ba935941d15a0c900b974348bf98b6ecff9aa1471636a77ebcc02941a420d37ae0423383ca552a1a35e3c63cee88

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\datareporting\glean\pending_pings\94ab238c-efa6-4544-be29-8ce9ad8eb521
                          Filesize

                          982B

                          MD5

                          964b10eab2ce1e8dbe7325b07630169c

                          SHA1

                          0be8dee2db3c861bec3b1a34deb7b6a9c802fd3b

                          SHA256

                          20d5eacbff47c3aa516d95e1846f8b275ec697886724a46a9b8d737727a25d8b

                          SHA512

                          5d46832a5ab30fecee2c4c7b114511e1cb52a746aea3cfa5d0e2efc69092ac1c908b20ec41efe94ba6b106d67f3b028e201c694de5286967744059f92c163c74

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\datareporting\glean\pending_pings\d9f86734-2860-48dd-b4c4-546e831a5da7
                          Filesize

                          26KB

                          MD5

                          f8074aa1d77ad3983cbeae94491772cf

                          SHA1

                          765cc2b4dd7615f4c5af4999d4ac5900c0410923

                          SHA256

                          c587f2b450a57081a481ea03dba3785f042d32fa83de8fa25b7ace45a31abc68

                          SHA512

                          b92099853e66b006ef36aab25fecc14f3477df44ad7b5c5f7d951addddabd7857ee6b0edb60435dd5101273f479bc3ba89d15f03e983822fe34577bd2196d035

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                          Filesize

                          1.1MB

                          MD5

                          842039753bf41fa5e11b3a1383061a87

                          SHA1

                          3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                          SHA256

                          d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                          SHA512

                          d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                          Filesize

                          116B

                          MD5

                          2a461e9eb87fd1955cea740a3444ee7a

                          SHA1

                          b10755914c713f5a4677494dbe8a686ed458c3c5

                          SHA256

                          4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                          SHA512

                          34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                          Filesize

                          372B

                          MD5

                          bf957ad58b55f64219ab3f793e374316

                          SHA1

                          a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                          SHA256

                          bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                          SHA512

                          79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                          Filesize

                          8.9MB

                          MD5

                          d4202efd2f712b7bd90636bad8a68c33

                          SHA1

                          d981fc6d62d68ba1a348341c48ca027e9178a617

                          SHA256

                          82d84bd476f92efddc9ddfed2229c6b416d4f82f0c878f3d79e55bc7020d054b

                          SHA512

                          406ae9feb3a0d22911df91a7e58c1acabf91fea505a962321c2a80ec6c13c39767d1cd15d8397f1aece75292d3ba11353915fbfc7e5d8fbf89ba2f3a44a63d3c

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\prefs-1.js
                          Filesize

                          11KB

                          MD5

                          0dd0911c7e41f575e7724c8c6c6d221d

                          SHA1

                          1f63ce756c06d896766a55b4a5023a875ebf91dd

                          SHA256

                          c34edc991a0975617c74830dfcce0ea0ed1822c49c9ef9936b053d1d7865cfd2

                          SHA512

                          568ee30ea1187cf124ccf3d61d3e3a1f50503ed53cd983cf7a44cf517300ddea537b4207eeeda24d0b2c211e53230165a70fe59cd2ec95b3e6f264333be36784

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\prefs-1.js
                          Filesize

                          13KB

                          MD5

                          6668e3fd03ced4ef73a4520a8d1a1866

                          SHA1

                          8551d552b7b664164c43dcbf6d64af44e56ca636

                          SHA256

                          3d88299bc2ce768347cc252796b306bfdfca1b1f770e4f6e086745916471dbf8

                          SHA512

                          f45f5b23a6c6b986eb5fe9a7e2303aafc223edc898cc229032d613671fe8924bcc9aa1d972253e56fc577e09d1dd9c7079429086d4d7e513d81274173686cc73

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\prefs.js
                          Filesize

                          12KB

                          MD5

                          b88442af2ee96873e690091a9602b02f

                          SHA1

                          fdc2708f2f4df7b58987bc7dd53163877fa7e3fb

                          SHA256

                          857979ebb1f26a27e6d7588faa2557cbc3f7112c98a68c2b4cfaaf3f61c1271a

                          SHA512

                          c47238cfef5caac65ac6311bb4822c8a51f170a614848e3c5420b929778165a767c81135972b06ba69c0020874d06970e62f6186d59366fda559c9c0c2a0ce23

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\prefs.js
                          Filesize

                          9KB

                          MD5

                          736e417580081b9ecc5b9bf8d688cabe

                          SHA1

                          9fa2416ba51ae6d9b16b8ee52d218effbde75a66

                          SHA256

                          352307b8b1fe95aef58d39df13d304f246c0bfdd81503b916b5eb16c4d950fde

                          SHA512

                          ee37ebafc27ad919dabaf972b9c4d203458390873e7fe8164852ed77013c155365071ea8530f0619d7480365d5481b297fbb3f274277fa23026d50b9f29c73c0

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\prefs.js
                          Filesize

                          10KB

                          MD5

                          5b147114af3924ee73fbf2d800d9e165

                          SHA1

                          4409303227a1aa78ffd04d3df548f7ec4adfc7e6

                          SHA256

                          e9abdf98be871531baf9e03c4238c8ead3a76f65515f4618c37ff9e17d9a958d

                          SHA512

                          d65b94128d55c8b26363a1853431c95bf52a55cd8d31a88df627f623029ebe75fc027aeb8d673cff59aa5bf8f1801b02476cead0464135e110a7ae9cfb2be518

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\prefs.js
                          Filesize

                          9KB

                          MD5

                          d3cf9620b05f30737d30a934922619bd

                          SHA1

                          08fc86b6a4b982322a6fe7dcb368106d540a7e06

                          SHA256

                          c882ff0636faa95348eba30a6868c84ee40712bbc46182dcf37cef9a558a1f0a

                          SHA512

                          75160c3b30b620504c4dc762a45c98cb6246153636165800edee36c1f8514c191fd3fd84779be456167e5b061af70b00201ca515f5b48a77d07dc04fcf3de28e

                          Download Submit

                        • memory/856-68-0x0000000000290000-0x00000000011A4000-memory.dmp

                          Filesize

                          15.1MB

                          Download

                        • memory/856-69-0x000000001BE70000-0x000000001C9D6000-memory.dmp

                          Filesize

                          11.4MB

                          Download

                        • memory/860-122-0x0000000000100000-0x00000000005BD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/860-123-0x0000000000100000-0x00000000005BD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/1344-15-0x0000000000D30000-0x00000000011ED000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/1344-33-0x0000000000D30000-0x00000000011ED000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/1344-21-0x0000000000D30000-0x00000000011ED000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/1344-19-0x0000000000D30000-0x00000000011ED000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/1344-18-0x0000000000D31000-0x0000000000D5F000-memory.dmp

                          Filesize

                          184KB

                          Download

                        • memory/2604-82-0x0000017EBE3C0000-0x0000017EBE436000-memory.dmp

                          Filesize

                          472KB

                          Download

                        • memory/2604-81-0x0000017EA42D0000-0x0000017EA42DA000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/2604-76-0x0000017EA38F0000-0x0000017EA3EA6000-memory.dmp

                          Filesize

                          5.7MB

                          Download

                        • memory/2700-48-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2700-47-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2764-43-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2764-40-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2764-34-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2764-680-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2764-36-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2764-99-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2764-608-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2764-83-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2764-50-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2764-49-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2764-45-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2764-44-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2764-37-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2764-141-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2764-38-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2764-39-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2764-42-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2764-550-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2764-41-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2764-35-0x0000000000EC1000-0x0000000000EEF000-memory.dmp

                          Filesize

                          184KB

                          Download

                        • memory/2860-663-0x0000017E8B5A0000-0x0000017E8B5B2000-memory.dmp

                          Filesize

                          72KB

                          Download

                        • memory/2860-664-0x0000017E8B940000-0x0000017E8B950000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/3456-97-0x00000000009F0000-0x0000000000D03000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3456-121-0x00000000009F0000-0x0000000000D03000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3784-115-0x0000000000360000-0x00000000009F7000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/3784-114-0x0000000000360000-0x00000000009F7000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/4344-1-0x0000000077A24000-0x0000000077A26000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/4344-8-0x0000000000120000-0x000000000042A000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/4344-3-0x0000000000120000-0x000000000042A000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/4344-9-0x0000000000120000-0x000000000042A000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/4344-7-0x0000000000121000-0x0000000000181000-memory.dmp

                          Filesize

                          384KB

                          Download

                        • memory/4344-2-0x0000000000121000-0x0000000000181000-memory.dmp

                          Filesize

                          384KB

                          Download

                        • memory/4344-10-0x0000000000120000-0x000000000042A000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/4344-17-0x0000000000120000-0x000000000042A000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/4344-0-0x0000000000120000-0x000000000042A000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/4344-6-0x0000000000120000-0x000000000042A000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/4344-5-0x0000000000120000-0x000000000042A000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/4344-4-0x0000000000120000-0x000000000042A000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/4468-488-0x0000000000950000-0x0000000000DC2000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/4468-487-0x0000000000950000-0x0000000000DC2000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/4468-489-0x0000000000950000-0x0000000000DC2000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/4468-575-0x0000000000950000-0x0000000000DC2000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/4468-584-0x0000000000950000-0x0000000000DC2000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/5376-610-0x00000000007E0000-0x0000000000C7B000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/5376-639-0x00000000007E0000-0x0000000000C7B000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/5624-635-0x0000000000400000-0x0000000000466000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/5624-642-0x0000000003830000-0x0000000003835000-memory.dmp

                          Filesize

                          20KB

                          Download

                        • memory/5624-637-0x0000000000400000-0x0000000000466000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/5624-640-0x0000000000400000-0x0000000000466000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/5664-591-0x0000000003610000-0x0000000003615000-memory.dmp

                          Filesize

                          20KB

                          Download

                        • memory/5664-590-0x0000000003610000-0x0000000003615000-memory.dmp

                          Filesize

                          20KB

                          Download

                        • memory/5912-632-0x0000000000150000-0x00000000001C0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/5912-633-0x0000000005040000-0x00000000055E4000-memory.dmp

                          Filesize

                          5.6MB

                          Download

                        • memory/6124-580-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/6124-576-0x0000000000EC0000-0x000000000137D000-memory.dmp

                          Filesize

                          4.7MB

                          Download