Overview

overview

10

Static

static

3

1696ef7e4f...43.exe

windows7-x64

9

1696ef7e4f...43.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2025, 18:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1696ef7e4f0fa3c99323c81e2f2079cd04a9879db6e0d98f772b92851623d243.exe

  • Size

    3.1MB

  • MD5

    03bf6e657642cb59d0fb042bd534a048

  • SHA1

    d23556c3bb729a7b3773e7f8fcab497c21a7e7b9

  • SHA256

    1696ef7e4f0fa3c99323c81e2f2079cd04a9879db6e0d98f772b92851623d243

  • SHA512

    2f7046960ce711495152be7efdc7524707a74978ec5562ed915bda1d858957e89fce3eaad62ad51192ad1233718d25990b928eea0c2212270ea005acc2377572

  • SSDEEP

    49152:B5NjmQhu0Gyd50NtwSqWnCWA05+p+al4urPDO:B5w0Gyd50NtwlWnCWATptPq

Score
10/10
amadeygcleanerhealerlitehttpstealcvidar092155ir7amtrumpbotdefense_evasiondiscoverydropperevasionexecutionloaderpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

litehttp

Version

v1.0.9

C2

http://185.208.156.162/page.php

Attributes
  • key

    v1d6kd29g85cm8jp4pv8tvflvg303gbl

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Extracted

Family

vidar

Botnet

ir7am

C2

https://t.me/l793oy

https://steamcommunity.com/profiles/76561199829660832
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/131.0.0.0 Safari/537.36 OPR/116.0.0.0

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect Vidar Stealer 2 IoCs
    stealer
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • LiteHTTP

    LiteHTTP is an open-source bot written in C#.

    stealerbotlitehttp
  • Litehttp family
    litehttp
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 14 IoCs
  • .NET Reactor proctector 2 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry 2 TTPs 26 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 19 IoCs
  • Identifies Wine through registry keys 2 TTPs 13 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\1696ef7e4f0fa3c99323c81e2f2079cd04a9879db6e0d98f772b92851623d243.exe
    "C:\Users\Admin\AppData\Local\Temp\1696ef7e4f0fa3c99323c81e2f2079cd04a9879db6e0d98f772b92851623d243.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Downloads MZ/PE file
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2640
    • C:\Users\Admin\AppData\Local\Temp\59FRVXQMEMCSVX3YJ3K73W1RT.exe
      "C:\Users\Admin\AppData\Local\Temp\59FRVXQMEMCSVX3YJ3K73W1RT.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2420
      • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Downloads MZ/PE file
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3156
        • C:\Users\Admin\AppData\Local\Temp\10104900101\ce4pMzk.exe
          "C:\Users\Admin\AppData\Local\Temp\10104900101\ce4pMzk.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3520
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Local\Caches\R1GzWQKH\Anubis.exe""
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3600
        • C:\Users\Admin\AppData\Local\Temp\10105330101\5d71453e40.exe
          "C:\Users\Admin\AppData\Local\Temp\10105330101\5d71453e40.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3216
          • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
            "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
            5⤵
            • Downloads MZ/PE file
            • System Location Discovery: System Language Discovery
            PID:4956
        • C:\Users\Admin\AppData\Local\Temp\10105340101\be0539ffde.exe
          "C:\Users\Admin\AppData\Local\Temp\10105340101\be0539ffde.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1696
          • C:\Users\Admin\AppData\Local\Temp\10105340101\be0539ffde.exe
            "C:\Users\Admin\AppData\Local\Temp\10105340101\be0539ffde.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3880
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 812
            5⤵
            • Program crash
            PID:4716
        • C:\Users\Admin\AppData\Local\Temp\10105350101\8e1ab07e41.exe
          "C:\Users\Admin\AppData\Local\Temp\10105350101\8e1ab07e41.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3616
          • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
            "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
            5⤵
            • Downloads MZ/PE file
            • System Location Discovery: System Language Discovery
            PID:1696
        • C:\Users\Admin\AppData\Local\Temp\10105360101\4a3c43ed2b.exe
          "C:\Users\Admin\AppData\Local\Temp\10105360101\4a3c43ed2b.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4772
        • C:\Users\Admin\AppData\Local\Temp\10105370101\04cfdae11f.exe
          "C:\Users\Admin\AppData\Local\Temp\10105370101\04cfdae11f.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1496
        • C:\Users\Admin\AppData\Local\Temp\10105380101\8f8052897c.exe
          "C:\Users\Admin\AppData\Local\Temp\10105380101\8f8052897c.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Downloads MZ/PE file
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2700
          • C:\Users\Admin\AppData\Local\Temp\9NIALYWMOENB2LVT579ECB66.exe
            "C:\Users\Admin\AppData\Local\Temp\9NIALYWMOENB2LVT579ECB66.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:5832
        • C:\Users\Admin\AppData\Local\Temp\10105390101\4e81044e7d.exe
          "C:\Users\Admin\AppData\Local\Temp\10105390101\4e81044e7d.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:5108
        • C:\Users\Admin\AppData\Local\Temp\10105400101\838e1ffce9.exe
          "C:\Users\Admin\AppData\Local\Temp\10105400101\838e1ffce9.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2040
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM firefox.exe /T
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4684
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM chrome.exe /T
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1760
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM msedge.exe /T
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4428
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM opera.exe /T
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3048
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM brave.exe /T
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3160
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
            5⤵
              PID:1744
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                6⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:2888
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1964 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 27352 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6bb700c-ae01-4abf-b81f-8412abb97898} 2888 "\\.\pipe\gecko-crash-server-pipe.2888" gpu
                  7⤵
                    PID:4304
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 28272 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fdaa3d82-fbf4-483d-85ad-74a43282f120} 2888 "\\.\pipe\gecko-crash-server-pipe.2888" socket
                    7⤵
                      PID:3492
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2424 -childID 1 -isForBrowser -prefsHandle 2996 -prefMapHandle 3120 -prefsLen 22684 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb7fceee-ca6c-4906-bca8-6f511dcf444a} 2888 "\\.\pipe\gecko-crash-server-pipe.2888" tab
                      7⤵
                        PID:3212
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3968 -childID 2 -isForBrowser -prefsHandle 3960 -prefMapHandle 2620 -prefsLen 32762 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f565d2be-9635-485c-8d62-bc9d5763e34e} 2888 "\\.\pipe\gecko-crash-server-pipe.2888" tab
                        7⤵
                          PID:1580
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4644 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4488 -prefMapHandle 4480 -prefsLen 32762 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7d43f6e-3103-435c-9f47-6c2d107211e2} 2888 "\\.\pipe\gecko-crash-server-pipe.2888" utility
                          7⤵
                          • Checks processor information in registry
                          PID:5464
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5560 -childID 3 -isForBrowser -prefsHandle 5516 -prefMapHandle 5540 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ef91ee9-46aa-44fb-bb6d-bb6a15996ca4} 2888 "\\.\pipe\gecko-crash-server-pipe.2888" tab
                          7⤵
                            PID:2160
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5752 -childID 4 -isForBrowser -prefsHandle 5672 -prefMapHandle 5680 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {295b9755-2c36-4e62-803a-8b39dad5288d} 2888 "\\.\pipe\gecko-crash-server-pipe.2888" tab
                            7⤵
                              PID:5116
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5652 -childID 5 -isForBrowser -prefsHandle 5896 -prefMapHandle 5904 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79a55b2c-c56c-4825-a837-c147fe4f02cc} 2888 "\\.\pipe\gecko-crash-server-pipe.2888" tab
                              7⤵
                                PID:5128
                        • C:\Users\Admin\AppData\Local\Temp\10105410101\bea44ca6a5.exe
                          "C:\Users\Admin\AppData\Local\Temp\10105410101\bea44ca6a5.exe"
                          4⤵
                          • Modifies Windows Defender DisableAntiSpyware settings
                          • Modifies Windows Defender Real-time Protection settings
                          • Modifies Windows Defender TamperProtection settings
                          • Modifies Windows Defender notification settings
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Windows security modification
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5504
                        • C:\Users\Admin\AppData\Local\Temp\10105420101\ce4pMzk.exe
                          "C:\Users\Admin\AppData\Local\Temp\10105420101\ce4pMzk.exe"
                          4⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5996
                        • C:\Users\Admin\AppData\Local\Temp\10105430101\mAtJWNv.exe
                          "C:\Users\Admin\AppData\Local\Temp\10105430101\mAtJWNv.exe"
                          4⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          PID:1160
                          • C:\Users\Admin\AppData\Local\Temp\10105430101\mAtJWNv.exe
                            "C:\Users\Admin\AppData\Local\Temp\10105430101\mAtJWNv.exe"
                            5⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:6080
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 800
                            5⤵
                            • Program crash
                            PID:4984
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1696 -ip 1696
                    1⤵
                      PID:3436
                    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                      C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4148
                    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                      C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:556
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1160 -ip 1160
                      1⤵
                        PID:6096

                      Network

                      MITRE ATT&CK Enterprise v15

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      1
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      4
                      T1543

                      Windows Service

                      4
                      T1543.003

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      4
                      T1543

                      Windows Service

                      4
                      T1543.003

                      Defense Evasion

                      Impair Defenses

                      5
                      T1562

                      Disable or Modify Tools

                      5
                      T1562.001

                      Modify Registry

                      6
                      T1112

                      Virtualization/Sandbox Evasion

                      2
                      T1497

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      3
                      T1552

                      Credentials In Files

                      3
                      T1552.001

                      Discovery

                      Browser Information Discovery

                      1
                      T1217

                      Query Registry

                      7
                      T1012

                      System Information Discovery

                      4
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      Virtualization/Sandbox Evasion

                      2
                      T1497

                      Lateral Movement

                      Collection

                      Data from Local System

                      3
                      T1005

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\ProgramData\176C6B17DF0B9413.dat
                        Filesize

                        40KB

                        MD5

                        a182561a527f929489bf4b8f74f65cd7

                        SHA1

                        8cd6866594759711ea1836e86a5b7ca64ee8911f

                        SHA256

                        42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                        SHA512

                        9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IPTE5OF1\soft[1]
                        Filesize

                        987KB

                        MD5

                        f49d1aaae28b92052e997480c504aa3b

                        SHA1

                        a422f6403847405cee6068f3394bb151d8591fb5

                        SHA256

                        81e31780a5f2078284b011c720261797eb8dd85e1b95a657dbce7ac31e9df1f0

                        SHA512

                        41f715eea031fd8d7d3a22d88e0199277db2f86be73f830819288c0f0665e81a314be6d356fdc66069cb3f2abf0dd02aaa49ac3732f3f44a533fcec0dfd6f773

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JIVBI8VM\service[1].htm
                        Filesize

                        1B

                        MD5

                        cfcd208495d565ef66e7dff9f98764da

                        SHA1

                        b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                        SHA256

                        5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                        SHA512

                        31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\activity-stream.discovery_stream.json
                        Filesize

                        21KB

                        MD5

                        76095ab712ebda221a231032764f90eb

                        SHA1

                        054d8903ff78d31a96937494cd6dbccaa1cb17e8

                        SHA256

                        59697594aa60a6e8d96817f34a0f8f31a44ce27767e85479ed99822be577f60e

                        SHA512

                        624499c68a84c1ab4cdfb9f04c351144e9a7065c3ca8ffaa52fad87e7b1d07cc7cba3dfa055c74b8ca13e7f8e14da26cd6a2a0030be4aeb65e5cc6cb7f33be81

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\cache2\entries\8DF0E9F84C5909278CF68CB55A683669F40995FB
                        Filesize

                        13KB

                        MD5

                        5a27ce5da50777f3ef18184ded0f2f53

                        SHA1

                        136ac868fe40a80f79cbb0b8de5bcf79a981e3f0

                        SHA256

                        e67cb1a6188f105e6b3cb3bf2ba38dd4f2c37b9f2fdcdab1dadae2b3a23f252e

                        SHA512

                        e8a5626d216ba7b6bb82674ba3263f7fb071e74c554777013fee2350f77b2ebe3ce25d6c93bb6ea5ff37b1963ac659a75bd515648b4b2c4b27933adbdb15d706

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\cache2\entries\ADF5BD09EB688DAB1F35EE02E8C35329D0E4AD89
                        Filesize

                        13KB

                        MD5

                        8a1bc13c4b11d550138f8fac62f90cb8

                        SHA1

                        1bb49e80f990c5759f2feab533b30c54bae7f205

                        SHA256

                        d396f955c3959103f200ec9dd86a354f6949baef2ee286a16b7dbf977315bc52

                        SHA512

                        e829ff51377e35ddd020b25fe56a57f3129d8778fdce13d5b661d21e7f16c31680dc6e2d9b1e89e441a76a7d4ad4bebe6972b6968eee667b1a64b908e0592083

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10104900101\ce4pMzk.exe
                        Filesize

                        48KB

                        MD5

                        d39df45e0030e02f7e5035386244a523

                        SHA1

                        9ae72545a0b6004cdab34f56031dc1c8aa146cc9

                        SHA256

                        df468fc510aec82c827987f54b824b978dd71301f93d18d71e704727d6dfdfa2

                        SHA512

                        69866ba5b53d1183a0899e3d22ff06111ae2e8df429beeb853c89f3ed0afb015dd4139b1c507566ffb0fe171a4ff1b318247b7a568dc492d9f71266f5c848a64

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10105330101\5d71453e40.exe
                        Filesize

                        3.7MB

                        MD5

                        4769a99eadbd516c17b7f4c541b87003

                        SHA1

                        cfe5a9970182cf428919e9f110a63df37d0eee06

                        SHA256

                        446ee955b11dbd350c8d44825c88d7846cf6c88c1604b1908739b2ec8b1cfc3e

                        SHA512

                        36146efedbf0780bc6fe459f5c649549b79e79c3908593cc1471f6ed2bd79e1348353d2861a48364aaa86dd5c1a59f7d874811c4c5bcc843e459230c7afb0a91

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10105340101\be0539ffde.exe
                        Filesize

                        445KB

                        MD5

                        c83ea72877981be2d651f27b0b56efec

                        SHA1

                        8d79c3cd3d04165b5cd5c43d6f628359940709a7

                        SHA256

                        13783c2615668fba4a503cbefdc18f8bc3d10d311d8dfe12f8f89868ed520482

                        SHA512

                        d212c563fdce1092d6d29e03928f142807c465ecaaead4fe9d8949b6f36184b8d067a830361559d59fc00d3bbe88feda03d67b549d54f0ec268e9e75698c1dd0

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10105350101\8e1ab07e41.exe
                        Filesize

                        4.5MB

                        MD5

                        96dd38daadfd80cf699a8c087b581ab9

                        SHA1

                        ccea87fbad5d9fdea11ecedfd7f3d0b2d2ff3b2c

                        SHA256

                        ad659d3cd67b4c566ada6bc6dfbeece67e5b1941585fbc480bdd80daf290a110

                        SHA512

                        9862debc204be49700c1025ab9556a2b082890fae9e43ec9b7c7d41ed1db801601e48b51c755679b4035a4af7019b159451bc356769bd432b1173c15a10423ab

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10105360101\4a3c43ed2b.exe
                        Filesize

                        1.8MB

                        MD5

                        f155a51c9042254e5e3d7734cd1c3ab0

                        SHA1

                        9d6da9f8155b47bdba186be81fb5e9f3fae00ccf

                        SHA256

                        560c7869df511c5ea54f20be704bbda02e1623d0867333a90ac3783d29eae7af

                        SHA512

                        67ec5546d96e83a3c6f4197a50812f585b96b4f34a2b8d77503b51cddd4ea5a65d5416c3efc427a5e58119fa068125987e336efb2dfd5811fe59145aa5f5bd6a

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10105370101\04cfdae11f.exe
                        Filesize

                        3.0MB

                        MD5

                        020e8f9ff53e518edb025a6f9e90a525

                        SHA1

                        afc1880f143c9eea39247954aba538ff7d2367bb

                        SHA256

                        5ad7dec6dace67e0f54adf896f2e846ede39239d9640ab932d1673e0c0415c1d

                        SHA512

                        1cb0c9f4f96f0a13261b289e7999d207aea95039e3562a9bddacc7222f2d0f933d63dfb7b49f45ba4a075cf31033d27af58b28a8cd9724eaacfe2dc6ca7b131d

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10105380101\8f8052897c.exe
                        Filesize

                        3.1MB

                        MD5

                        fb8a11382106b0ef3454fc1aa5a86c50

                        SHA1

                        f41d205674642f6a335ba9e90d620d20eb2eaf7c

                        SHA256

                        086f8bc32eddaa4e947338c087f677b1a78da8f7fc4604d0d0519c093e38f7f4

                        SHA512

                        6190e5830f82fdf19bef61a918b4123f1fa45828a7937e682fc80892d3771eef56a4989185261d9b59af72d4edb08e3b15313170dca1baf6e5cc2e643e0e2bb4

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10105390101\4e81044e7d.exe
                        Filesize

                        1.8MB

                        MD5

                        0824d5f9638e1fed7aea21a97f70f38c

                        SHA1

                        83aead23fff28d92a28748702d8329818483c6bc

                        SHA256

                        6f2daaadec4daf489f7a5f923ecf0ef5b7a0af365d4af7e36040904f68545a90

                        SHA512

                        c86e43dac2b620c3d3465c0e9a9c78e72293881cf44b2e5c161c4d6d2ffe601e275bbc651e4a02e1f71f4bd2dc7df0e54248a7f2dc7756696cd42099186953aa

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10105400101\838e1ffce9.exe
                        Filesize

                        947KB

                        MD5

                        28f3e4c645b836fe6b7893752b37edcb

                        SHA1

                        af8e67a82648f1cb435ca22d26656fcad6bec9d6

                        SHA256

                        94757246933bf308c399fc5a46cb74a9203f5940de0c1724cdc9a01ac32d7aef

                        SHA512

                        d00eb74351597901d3feccedf26de34221ef6c08b5aa40b3f2d1669ef90ec0fa2ee935fad71fade353d5e889c21c7ef2bb270793ed19a2dd80ceae87f65181f8

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10105410101\bea44ca6a5.exe
                        Filesize

                        1.7MB

                        MD5

                        b9ec326f2c59b318c0a4ead48270846f

                        SHA1

                        8da0767e75879e574bcb3dc1eccde1b4abd5beef

                        SHA256

                        3f95a0648e4744771d61482b075cedb4d60694226cacddc5882e651acd8c42cd

                        SHA512

                        9cc550f7f8bd20bdc8543fca2773faa13defcde86ea09bf5111be60b1b65f085946162d49d8ed992db33d40c649832890397ca83e60ff1f7f2a1d2f54822f77e

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10105430101\mAtJWNv.exe
                        Filesize

                        350KB

                        MD5

                        b60779fb424958088a559fdfd6f535c2

                        SHA1

                        bcea427b20d2f55c6372772668c1d6818c7328c9

                        SHA256

                        098c4fe0de1df5b46cf4c825e8eba1893138c751968fcf9fe009a6991e9b1221

                        SHA512

                        c17a7781790326579669c2b9ad6f7f9764cf51f44ad11642d268b077ade186563ae53fc5e6e84eb7f563021db00bef9ebd65a8d3fbe7a73e85f70a4caa7d8a7f

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\59FRVXQMEMCSVX3YJ3K73W1RT.exe
                        Filesize

                        1.8MB

                        MD5

                        895d364d98674fc39c6c2ca1607c189c

                        SHA1

                        089147d7501025cfc4f8b84305dfd211c8708be4

                        SHA256

                        43374f0238ae8b778ff340a81a654269894b69815eae179af6634bcf08c96301

                        SHA512

                        56a3e90dc994f061431c5173021cc234cacb37e3cdb1df5f073c92d90fff7495385277da29abf839b77b4cbcf36ca318a2a83f6fbfd484670527e97f45be4d9d

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rss0xm5f.p24.ps1
                        Filesize

                        60B

                        MD5

                        d17fe0a3f47be24a6453e9ef58c94641

                        SHA1

                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                        SHA256

                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                        SHA512

                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                        Filesize

                        479KB

                        MD5

                        09372174e83dbbf696ee732fd2e875bb

                        SHA1

                        ba360186ba650a769f9303f48b7200fb5eaccee1

                        SHA256

                        c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                        SHA512

                        b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                        Filesize

                        13.8MB

                        MD5

                        0a8747a2ac9ac08ae9508f36c6d75692

                        SHA1

                        b287a96fd6cc12433adb42193dfe06111c38eaf0

                        SHA256

                        32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                        SHA512

                        59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Local\Caches\installed.txt
                        Filesize

                        63B

                        MD5

                        b04f0fd9b4fd9bc372841325ea22991a

                        SHA1

                        170750c98159c947af19fdf2a3a4e6c23d22d1c4

                        SHA256

                        584ebf372cfa89da7785e38200ae78122a78a605a67e0e92eaec67aade3f6b17

                        SHA512

                        2d5d4882056cba629bb6e6577035ba5ed9b77033f0450605b56e9274d6c665419f2010c5c3c224cc530b01e76af93a89bf7c3287429c8405b087a69c966b044e

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\AlternateServices.bin
                        Filesize

                        10KB

                        MD5

                        7563dcff26d0fea3bbfce44849e83d26

                        SHA1

                        6f8c649bd587d2421783ea2c0fdcaeb7e4eea6b9

                        SHA256

                        b103297b46160f8e68be3e4958d2ec6c4246e6c7a33892e9ba841da10d5f010e

                        SHA512

                        49b8b0ea7b9d1e04eab4c53888d24a51fd1b0acd45446394950b31df8e2251a1659b3509597a9544e657b524f0623781cb6f1373ab2a3b36fe69a56137ba8408

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        15KB

                        MD5

                        2a70eea69ce99470cff324d1e1ac99f8

                        SHA1

                        575d0b04395e6973bed8d330ce432c0527f7fd24

                        SHA256

                        581b924efda06025d0a34fabf55ab872e55e29249add7436089b81c9b8a1f222

                        SHA512

                        1a65ca380314aa58ecaa89e8725bdfc2e64a35a737851178486ac916b995bdb580aa2b88a9ec7139b1db220d4f051efd6a239e630dd2a2ca6cd3e67e85cb9e06

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        15KB

                        MD5

                        545fba2ff00a57c47864891242741a0f

                        SHA1

                        e44e9be1ae3734e9e9476bf6b66f7d2b4acbac0a

                        SHA256

                        40a324b6db3f67c794d7d694bc1ecc45159eddfda047a649805a6a05879a024f

                        SHA512

                        c2ddd4ae36a9e075f9dc8ae0e8f2dd8b84af473a90b55add50044d249bad4c948ea967f829ab19bd20224a790b222e0bbdbce0323d4c1e04b46ab764a514dbfa

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        5KB

                        MD5

                        aa6026116aea97aaea9057e6b60af45a

                        SHA1

                        b950c10289e467309a47529ad780361fce3c7b45

                        SHA256

                        f9c8c6be9f7940a969b7b55ef880b90bd8ff477a901334082fbd69b956bbe08a

                        SHA512

                        e268e02b6d6c2f716bb24b62a2aa3eac9e371e3627461510bfd7fef609cc80ec4f12936ff4bccbd8c0b11779e87d6dd7448fba9e652924106b5424e36b1c5325

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\datareporting\glean\pending_pings\6a49e589-2b0f-4d23-8be1-54a86e88a6c1
                        Filesize

                        671B

                        MD5

                        2e5dedaff5128cd23648af2836725717

                        SHA1

                        26fd50a2d5e6caa74fed7efd5a0ca36693d4abfa

                        SHA256

                        59c2d1550d1ab136718ad840ab7c8c8d1103f955c6371d4461e5388ff11b4c8b

                        SHA512

                        59f3c97f35547aa2775bf28fd1507e6b793c43bdbe86d9d9dc55bc0024b22af3f97f80c23435a11e0b9153b29c93d2014fb2ca93eec8a57a1ef6a18a1a24c2a0

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\datareporting\glean\pending_pings\9eb135bf-6569-46e3-af6a-cdc15796a385
                        Filesize

                        28KB

                        MD5

                        84b9cd942a1394131c322272210400d3

                        SHA1

                        f14da1966a47322f8ffd8d39bce7f519cbcadf30

                        SHA256

                        7af117c1567a3dadfac463ec206fbec8d8878f80b956bb45f98494670f2aae45

                        SHA512

                        6fdc4787185e2dc3d70e9e79e6dca8763651db07ec3585c4b57b90583b835cff82656e53dcec1b6f4c140b7d7e1651c1ea679bd135393025d147002f9c0fc671

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\datareporting\glean\pending_pings\e2dfdd68-a40b-4c01-b17e-a417123ee687
                        Filesize

                        982B

                        MD5

                        69e960379e62ddf80630bd5c9221abff

                        SHA1

                        5e6df960f913531bc5ebdc07773bab4fa8537d70

                        SHA256

                        be9f11f660f8489c1a36c9c99cb4e77d22968625a4de5530dbb353920ed7ede5

                        SHA512

                        78510c4b9d0d939cd5c6a57ff9139053ab30f09c63ce5bcd47af78c6887fc25feb2833f8a3dc521a04272a1a6ded26df6918da3fed6ae77cd19c641b7f714ca7

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                        Filesize

                        1.1MB

                        MD5

                        842039753bf41fa5e11b3a1383061a87

                        SHA1

                        3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                        SHA256

                        d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                        SHA512

                        d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                        Filesize

                        116B

                        MD5

                        2a461e9eb87fd1955cea740a3444ee7a

                        SHA1

                        b10755914c713f5a4677494dbe8a686ed458c3c5

                        SHA256

                        4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                        SHA512

                        34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                        Filesize

                        372B

                        MD5

                        bf957ad58b55f64219ab3f793e374316

                        SHA1

                        a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                        SHA256

                        bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                        SHA512

                        79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                        Filesize

                        17.8MB

                        MD5

                        daf7ef3acccab478aaa7d6dc1c60f865

                        SHA1

                        f8246162b97ce4a945feced27b6ea114366ff2ad

                        SHA256

                        bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                        SHA512

                        5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\prefs-1.js
                        Filesize

                        9KB

                        MD5

                        600f71a4cf793c6997142c3b96a2c1c1

                        SHA1

                        ee30687791ae30d7d652e1a6de012c3d6ba4e054

                        SHA256

                        6846fb9f182967908a3c8393e8b496ff677495ab237f9f67ef0398c329f44c83

                        SHA512

                        4f2b9eebb997626c2a1079a43b865fae29e9c33b0b1c833f6ed23046af8eef94a902bb1af2cac992afabc335b999b97dede32fe09b21058528fd84e2a820eede

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\prefs-1.js
                        Filesize

                        11KB

                        MD5

                        0ae0a2296219f43201571bf0122707a9

                        SHA1

                        3977aed2336c2e6051276373ed0b236a5f437483

                        SHA256

                        d0260a0ec4c255ee2c69dbfc80c96d394da68f714ffc7d59f456bd33e8ad61d9

                        SHA512

                        0c5bd4b639243e9f4f610edab4e1648d246ce71b013447721b5d6d1bc3512474495e79016636d4d5e8c36965b1bf5e8e93439d54933e534562c210259ee75d70

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\prefs.js
                        Filesize

                        9KB

                        MD5

                        f69129fa6e21da91d2a81ff8823d0231

                        SHA1

                        45ede2673ba843acd3309315f6eb4b09989a2fca

                        SHA256

                        275554a12321eaecd0149b6a946b7c32956223c03cb7a010a0c7fa4683f1a8ee

                        SHA512

                        1d5fe06f69ba5f08f344c718e0e175c9c17ce09de00669630e5a5682e42579c65b823bad71729b251578197dd19949d3aeaa6afdfba9682d3b0dac1add757763

                        Download Submit

                      • memory/556-354-0x0000000000D40000-0x00000000011FD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1160-795-0x0000000000560000-0x00000000005C0000-memory.dmp

                        Filesize

                        384KB

                        Download

                      • memory/1496-239-0x00000000006F0000-0x00000000009FE000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1496-315-0x00000000006F0000-0x00000000009FE000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1496-286-0x00000000006F0000-0x00000000009FE000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1496-287-0x00000000006F0000-0x00000000009FE000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1696-96-0x0000000000440000-0x00000000004B8000-memory.dmp

                        Filesize

                        480KB

                        Download

                      • memory/1696-97-0x0000000005440000-0x00000000059E4000-memory.dmp

                        Filesize

                        5.6MB

                        Download

                      • memory/1696-159-0x0000000000400000-0x000000000042F000-memory.dmp

                        Filesize

                        188KB

                        Download

                      • memory/2420-14-0x0000000000210000-0x00000000006CD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2420-30-0x0000000000210000-0x00000000006CD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2420-20-0x0000000000210000-0x00000000006CD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2420-17-0x0000000000210000-0x00000000006CD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2420-18-0x0000000000210000-0x00000000006CD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2640-5-0x0000000000540000-0x0000000000852000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2640-4-0x0000000000540000-0x0000000000852000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2640-1-0x00000000775B4000-0x00000000775B6000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/2640-0-0x0000000000540000-0x0000000000852000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2640-7-0x0000000000540000-0x0000000000852000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2640-8-0x0000000000540000-0x0000000000852000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2640-2-0x0000000000541000-0x00000000005A1000-memory.dmp

                        Filesize

                        384KB

                        Download

                      • memory/2640-6-0x0000000000541000-0x00000000005A1000-memory.dmp

                        Filesize

                        384KB

                        Download

                      • memory/2640-3-0x0000000000540000-0x0000000000852000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2640-9-0x0000000000540000-0x0000000000852000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2640-16-0x0000000000540000-0x0000000000852000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2700-622-0x0000000000E90000-0x00000000011A4000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2700-314-0x0000000000E90000-0x00000000011A4000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2700-334-0x0000000000E90000-0x00000000011A4000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2700-333-0x0000000000E90000-0x00000000011A4000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/3156-59-0x0000000000D40000-0x00000000011FD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/3156-102-0x0000000000D40000-0x00000000011FD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/3156-224-0x0000000000D40000-0x00000000011FD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/3156-285-0x0000000000D40000-0x00000000011FD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/3156-32-0x0000000000D40000-0x00000000011FD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/3156-189-0x0000000000D40000-0x00000000011FD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/3156-34-0x0000000000D40000-0x00000000011FD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/3156-33-0x0000000000D41000-0x0000000000D6F000-memory.dmp

                        Filesize

                        184KB

                        Download

                      • memory/3156-157-0x0000000000D40000-0x00000000011FD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/3156-316-0x0000000000D40000-0x00000000011FD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/3156-35-0x0000000000D40000-0x00000000011FD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/3156-36-0x0000000000D40000-0x00000000011FD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/3156-56-0x0000000000D40000-0x00000000011FD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/3156-57-0x0000000000D40000-0x00000000011FD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/3156-148-0x0000000000D40000-0x00000000011FD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/3156-58-0x0000000000D40000-0x00000000011FD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/3156-60-0x0000000000D40000-0x00000000011FD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/3156-359-0x0000000000D40000-0x00000000011FD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/3156-809-0x0000000000D40000-0x00000000011FD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/3156-774-0x0000000000D40000-0x00000000011FD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/3216-77-0x00000000009B0000-0x000000000139D000-memory.dmp

                        Filesize

                        9.9MB

                        Download

                      • memory/3216-104-0x00000000009B0000-0x000000000139D000-memory.dmp

                        Filesize

                        9.9MB

                        Download

                      • memory/3216-103-0x00000000009B0000-0x000000000139D000-memory.dmp

                        Filesize

                        9.9MB

                        Download

                      • memory/3216-106-0x00000000009B0000-0x000000000139D000-memory.dmp

                        Filesize

                        9.9MB

                        Download

                      • memory/3520-78-0x0000020840970000-0x0000020840E98000-memory.dmp

                        Filesize

                        5.2MB

                        Download

                      • memory/3520-54-0x0000020825E60000-0x0000020825E72000-memory.dmp

                        Filesize

                        72KB

                        Download

                      • memory/3520-55-0x00000208263A0000-0x00000208263B0000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/3600-130-0x000002B260F50000-0x000002B260F72000-memory.dmp

                        Filesize

                        136KB

                        Download

                      • memory/3616-160-0x0000000000190000-0x0000000000DD5000-memory.dmp

                        Filesize

                        12.3MB

                        Download

                      • memory/3616-154-0x0000000000190000-0x0000000000DD5000-memory.dmp

                        Filesize

                        12.3MB

                        Download

                      • memory/3616-153-0x0000000000190000-0x0000000000DD5000-memory.dmp

                        Filesize

                        12.3MB

                        Download

                      • memory/3616-144-0x0000000000190000-0x0000000000DD5000-memory.dmp

                        Filesize

                        12.3MB

                        Download

                      • memory/3880-101-0x0000000000400000-0x0000000000465000-memory.dmp

                        Filesize

                        404KB

                        Download

                      • memory/3880-99-0x0000000000400000-0x0000000000465000-memory.dmp

                        Filesize

                        404KB

                        Download

                      • memory/4148-116-0x0000000000D40000-0x00000000011FD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/4148-118-0x0000000000D40000-0x00000000011FD000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/4772-223-0x0000000000410000-0x00000000008B1000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/4772-187-0x0000000000410000-0x00000000008B1000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/4772-276-0x0000000000410000-0x00000000008B1000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/4956-111-0x0000000010000000-0x000000001001C000-memory.dmp

                        Filesize

                        112KB

                        Download

                      • memory/4956-107-0x0000000000400000-0x000000000042F000-memory.dmp

                        Filesize

                        188KB

                        Download

                      • memory/4956-105-0x0000000000400000-0x000000000042F000-memory.dmp

                        Filesize

                        188KB

                        Download

                      • memory/5108-331-0x0000000000120000-0x00000000007D8000-memory.dmp

                        Filesize

                        6.7MB

                        Download

                      • memory/5108-332-0x0000000000120000-0x00000000007D8000-memory.dmp

                        Filesize

                        6.7MB

                        Download

                      • memory/5504-801-0x0000000000990000-0x0000000000DD8000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/5504-712-0x0000000000990000-0x0000000000DD8000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/5504-713-0x0000000000990000-0x0000000000DD8000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/5504-804-0x0000000000990000-0x0000000000DD8000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/5504-714-0x0000000000990000-0x0000000000DD8000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/5832-662-0x0000000000EB0000-0x000000000136D000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/5832-618-0x0000000000EB0000-0x000000000136D000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/6080-799-0x0000000000400000-0x0000000000429000-memory.dmp

                        Filesize

                        164KB

                        Download

                      • memory/6080-797-0x0000000000400000-0x0000000000429000-memory.dmp

                        Filesize

                        164KB

                        Download