hxxps://github[.]com/TheAltening/Authenticator/releases/download/2[.]0[.]0/TheAltening[.]zip

Analysis

max time kernel
84s
max time network
89s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/TheAltening/Authenticator/releases/download/2.0.0/TheAltening.zip

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
768	TheAltening.exe
768	TheAltening.exe
768	TheAltening.exe
768	TheAltening.exe
768	TheAltening.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4772	netstat.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	TheAltening.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	TheAltening.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	TheAltening.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\altening	TheAltening.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\altening\ = "URL:Altening Alt Loader"	TheAltening.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	TheAltening.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	TheAltening.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	TheAltening.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	TheAltening.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	TheAltening.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\altening\shell\open\command	TheAltening.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\altening\shell	TheAltening.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	TheAltening.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	TheAltening.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	TheAltening.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	TheAltening.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	TheAltening.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	TheAltening.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	TheAltening.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	TheAltening.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	TheAltening.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	TheAltening.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\altening\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\altening\\altening.launcher.exe,1"	TheAltening.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings	TheAltening.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	TheAltening.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	TheAltening.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	TheAltening.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	TheAltening.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	TheAltening.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	TheAltening.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	TheAltening.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\altening\URL Protocol	TheAltening.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\altening\DefaultIcon	TheAltening.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\altening\shell\open	TheAltening.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\altening\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\altening\\altening.launcher.exe\" \"%1\""	TheAltening.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	TheAltening.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\TheAltening.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
768	TheAltening.exe
768	TheAltening.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	firefox.exe
Token: SeDebugPrivilege	2956	firefox.exe
Token: SeDebugPrivilege	2956	firefox.exe
Token: SeDebugPrivilege	768	TheAltening.exe
Token: SeDebugPrivilege	4772	netstat.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
768	TheAltening.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
768	TheAltening.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
768	TheAltening.exe
768	TheAltening.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 2956	3220	firefox.exe	58
PID 3220 wrote to memory of 2956	3220	firefox.exe	58
PID 3220 wrote to memory of 2956	3220	firefox.exe	58
PID 3220 wrote to memory of 2956	3220	firefox.exe	58
PID 3220 wrote to memory of 2956	3220	firefox.exe	58
PID 3220 wrote to memory of 2956	3220	firefox.exe	58
PID 3220 wrote to memory of 2956	3220	firefox.exe	58
PID 3220 wrote to memory of 2956	3220	firefox.exe	58
PID 3220 wrote to memory of 2956	3220	firefox.exe	58
PID 3220 wrote to memory of 2956	3220	firefox.exe	58
PID 3220 wrote to memory of 2956	3220	firefox.exe	58
PID 2956 wrote to memory of 1916	2956	firefox.exe	88
PID 2956 wrote to memory of 1916	2956	firefox.exe	88
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 4332	2956	firefox.exe	89
PID 2956 wrote to memory of 1596	2956	firefox.exe	90
PID 2956 wrote to memory of 1596	2956	firefox.exe	90
PID 2956 wrote to memory of 1596	2956	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/TheAltening/Authenticator/releases/download/2.0.0/TheAltening.zip"
1⤵
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/TheAltening/Authenticator/releases/download/2.0.0/TheAltening.zip
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2956.0.1272785885\1935897486" -parentBuildID 20221007134813 -prefsHandle 1876 -prefMapHandle 1856 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {adad4855-2a99-42f6-9747-86a910f20f38} 2956 "\\.\pipe\gecko-crash-server-pipe.2956" 1984 28724603858 gpu
    3⤵
    PID:1916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2956.1.9323290\1483904759" -parentBuildID 20221007134813 -prefsHandle 2372 -prefMapHandle 2368 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e30da938-8f46-490c-8517-271873646147} 2956 "\\.\pipe\gecko-crash-server-pipe.2956" 2384 287232fa258 socket
    3⤵
    PID:4332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2956.2.1960161644\2094255012" -childID 1 -isForBrowser -prefsHandle 3112 -prefMapHandle 3192 -prefsLen 21668 -prefMapSize 233444 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37ace7b8-f37a-4b76-b988-7b7fa123ab73} 2956 "\\.\pipe\gecko-crash-server-pipe.2956" 3064 287275dc858 tab
    3⤵
    PID:1596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2956.3.647035090\683793871" -childID 2 -isForBrowser -prefsHandle 3620 -prefMapHandle 3616 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e931a9cf-2e9a-44b3-a3dc-d407f0643497} 2956 "\\.\pipe\gecko-crash-server-pipe.2956" 3628 2870f868458 tab
    3⤵
    PID:652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2956.6.230694646\2118036365" -childID 5 -isForBrowser -prefsHandle 5292 -prefMapHandle 5288 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1568af6b-a7f6-4f58-82e2-c210cf4d4c14} 2956 "\\.\pipe\gecko-crash-server-pipe.2956" 5204 287297ba758 tab
    3⤵
    PID:4676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2956.5.835424107\1844733060" -childID 4 -isForBrowser -prefsHandle 5004 -prefMapHandle 5008 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1ad32d2-e0d1-4825-a55c-ddcc3f7b24ca} 2956 "\\.\pipe\gecko-crash-server-pipe.2956" 5000 287297ba458 tab
    3⤵
    PID:2580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2956.4.370989888\699970907" -childID 3 -isForBrowser -prefsHandle 4848 -prefMapHandle 4552 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {83849074-fb04-4584-975c-15142ab4ee4a} 2956 "\\.\pipe\gecko-crash-server-pipe.2956" 4860 28727bd6958 tab
    3⤵
    PID:5000

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:380

C:\Users\Admin\Downloads\TheAltening\TheAltening.exe
"C:\Users\Admin\Downloads\TheAltening\TheAltening.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:768
- C:\Windows\SYSTEM32\netstat.exe
  "netstat.exe" -a -n -o
  2⤵
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\.net\TheAltening\hOHr51s9Bz0M1wb5lZYsR6q9KnUsh1I=\D3DCompiler_47_cor3.dll

Filesize
832KB

MD5
8ac3efe7b341f871d9ce1b387d3876cf

SHA1
fb5ef520bc9add6d10c4c159b967ab9257ca91a0

SHA256
c8124f1da648034991667dfc7976e7b47465a888470d52051a7a6d380ef73d3d

SHA512
6427bdb8651c0a404464cd3ec408ef350c028afb3d1a6bfa5cdc1cb8ef3a6ad083b435cd7e0d64bf2f790e4729e2920660426cd40536448813739d552dcba76c

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\TheAltening\hOHr51s9Bz0M1wb5lZYsR6q9KnUsh1I=\PresentationNative_cor3.dll

Filesize
1.2MB

MD5
8e874bb782193fa45d027254e7d03244

SHA1
024ccc78d1d23050164e8cfdf141c921f42e0c74

SHA256
f75f98fbbb02dad69bcd8c69ec26eb3705dbd95dad996b58308b50e6c9904246

SHA512
3f3b0f93e5600c0671688317ee00d7a88411b80b7c4aa383d274af318782a66665409a528d484409bfe598c309ed54480c86a4d4e109dee5265351d5902d0c56

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\TheAltening\hOHr51s9Bz0M1wb5lZYsR6q9KnUsh1I=\clrjit.dll

Filesize
1.2MB

MD5
5905e0c07a93f86ddc463aafecdb01dc

SHA1
082497061addc2856338886c284d14e6f6ea519b

SHA256
9091134602c1f0f48c52d6b5ac01258550d20742fc18a8171385f28a9b764ac5

SHA512
00706af7195257f57594369d0a33a7bdb548d1af74bf24f7e7e8deb33124b94d11bcd1c09f7076e5e484af1125a7b9f38944e85157369546d7c44cd564bd9e75

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\TheAltening\hOHr51s9Bz0M1wb5lZYsR6q9KnUsh1I=\coreclr.dll

Filesize
1.9MB

MD5
9903f3dfcd005de56284f83c45bf349e

SHA1
b84613e390a6d157e6af8f73d4851619b922de37

SHA256
cb0b269423e59f4c17e7e3dca7385ea5d92cffcc460a76c13530bc5613bf7b3d

SHA512
9aa187e9cc62d7904cf0892b5ecd9e79fbb41f8372ff1299c8487dbaeee8ac95a0eceaf22c78d451a8b3f313d9e70e8a5782010e8bae02e1cd232d1cc070dc06

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\TheAltening\hOHr51s9Bz0M1wb5lZYsR6q9KnUsh1I=\wpfgfx_cor3.dll

Filesize
896KB

MD5
34c963788c3ba6509d29d902becbf119

SHA1
f32de9d62b92c4e7a2a5f432e16184375aa24288

SHA256
0368cbded58edc0fedef8e5ab541cf2b3d017923e38e2ae0a9f8b7df57704133

SHA512
acd4dd4132d099b458dd520aec384a5eaa2087bceb879b8b389cccec00464dcf4bd2e76b3bea47f491ecbde3b7d8a9c367faf191ab638444a218fde813bf031f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp3E0E.tmp

Filesize
1KB

MD5
2f3de4f6d50debc5f7a35f6a0fb3ad88

SHA1
d0f2dcc536294e9cf364f1a2c08c9ecb2bcae02e

SHA256
cfc50ccc669a9ad9d4ec5980565235b71f8004c3659910ef1f82ae0119762882

SHA512
91bc8a527f858f77e39fa6adc220d719a223f55687f3ccdda0ced5f2298774e70fcb3a49cad20f158886399d4cd8e4cf247ae79df79fbc83c7142fb843c2c88e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp4A73.tmp

Filesize
1KB

MD5
d40a41a8d204d9353d85d7e926f9d25d

SHA1
698610c43c7e58218ac700d571a110ad152e5a6f

SHA256
ec0f6b35bbdfff51c56d44cc2524ab9126387fdefd6727a8974f313b9a3c2b04

SHA512
ce479718eb8fc93db3bca66e9d559b25d74dae9cfe26a8d106a891ee2a1b3c9f098ac7498713791dec4d62e955f3d7de291ef9d09fe3e50b1caf30bcd8a04f4f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
71e51e2741b55a5bd83cd61f3d6a1c20

SHA1
ec7935a96ed3b26c29ac0a923ca2f5cd337c49ab

SHA256
478ed1ede156cd8f8a6e627529d3bca7123811199c3671b2860686c1292a0e71

SHA512
f13952c036b554e510a073b97900c8267209d340bb6c1752806ab142d1429ebcfb5da0ab8bc90d1f67582f3ed19b2e719552f9efd835f34713bf280aadf8873f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\datareporting\glean\pending_pings\bf7f0764-1cbf-4718-b62d-759cdb1d951e

Filesize
11KB

MD5
0bbaaa7f7df49aef18848306b48c9f69

SHA1
f18be0040d58e2933c5deae0ced4dec645e5b8cb

SHA256
cbf25d57aa8ea794d1cf6cb2b4748e8a8766184b5779ec4174ec2868e0ee42f5

SHA512
2140d2ba1dbbd3649d8d379121a256d217dc716900aba2ebdb7203e617335389f105b172817fe0d9272890466f0a9ad131c05b511e12bd37fcd88dd381f72acb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\datareporting\glean\pending_pings\e64afaa4-2e96-4ae5-88c8-db1d426603da

Filesize
746B

MD5
3cd391d5e7cff4eb7ebfae6b0c995fa6

SHA1
32926435ec67b9ffba2c6fcea22bbf010a4ef5a2

SHA256
85f4476fa0541ab1a93a9e4606d6564e1da8513f4fc2a528a9635e4034d4de90

SHA512
7c024b6bbaa57c4a1fe854a8261efd417e2fcb26c7037a1298eb7e7166fefe79e0d10d71a8bcae1fa6e0e2c6c36731c928ced6f234255e7c9e2b6ab6425a8b56

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\prefs-1.js

Filesize
6KB

MD5
e439405ec433df7d0172a4d68b4c324e

SHA1
2fd6750f251c12147d658ad5261f99e7b5c36612

SHA256
bd308364f4bfcde41ccd233a754fb7619e508b2e14290af6fe49ea84343025c3

SHA512
712fba68b85d47227c309ea9e3ab34616e042e2d891bebb194acac6bc589451cc512b935e31fb3c010e68015cceed2236e5b1e06bdf4e9eebb58f945c43c43a1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
990B

MD5
8e12a4ae5447e9ff202a0c2c921b4789

SHA1
ca295870ba1353a2622eef0438077a307b56783d

SHA256
1de78f366cbd9f69e563114858c33b211a9518b188a4e3acf8d679ece0aa13fb

SHA512
7d85cce996c1ef9398ca7645f1e307fb59877899fc44298ec53979ce837ac5f8fe3a9e2785de3f7e15b3fb6be90647ac4800d3020f804dcc7fa7ef92889fd64d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1016B

MD5
5ea39b220ac6cfcc4b5b45998906f93b

SHA1
51d57687b7fc157c21c4b4ee9b5cda086b4a0a47

SHA256
e597429133a5dd8ccc20f6db2f2035cecd9f494298884cc61a5b5d89bfff9f40

SHA512
2723ffe888a9cae15eda1e1d71ded47c069d1a02f453e52db0b3f4b17f4f04922d0136260616f534218f12c6f8997dc6ea36eaffb16e595f45f5fcf2fac4f4df

Download Submit
C:\Users\Admin\Downloads\TheAltening.vuwGUBj5.zip.part

Filesize
1.5MB

MD5
2f7d7741a4cef3459bd5fe1384ee034c

SHA1
7ae589b4803e541284f82ff380264ad185cb40a6

SHA256
ab0ed35abc5c9e5e63d6ce095d5c5bf9f646813a0d5232373c71ed3b9b396ad8

SHA512
3ec0dbd59f771aef5ffdca61dfa74c82a971d5e52bcc523420b9ca4ef7fae423ecbc9068512f482bbbef208dec0b2f1bbd0619afd6b1ea7b4a0ca100bc93bd74

Download Submit
memory/768-159-0x00000001805C0000-0x0000000181517000-memory.dmp

Filesize
15.3MB

Download
memory/768-213-0x0000027BD68C0000-0x0000027BD6931000-memory.dmp

Filesize
452KB

Download
memory/768-174-0x0000000080360000-0x0000000080BA1000-memory.dmp

Filesize
8.3MB

Download
memory/768-177-0x0000000180050000-0x00000001800CA000-memory.dmp

Filesize
488KB

Download
memory/768-180-0x0000027BB1630000-0x0000027BB1634000-memory.dmp

Filesize
16KB

Download
memory/768-182-0x0000027BB2F20000-0x0000027BB2F24000-memory.dmp

Filesize
16KB

Download
memory/768-168-0x0000027BD3760000-0x0000027BD38BB000-memory.dmp

Filesize
1.4MB

Download
memory/768-188-0x00000644A00E0000-0x00000644A01CD000-memory.dmp

Filesize
948KB

Download
memory/768-191-0x00000644A0020000-0x00000644A0032000-memory.dmp

Filesize
72KB

Download
memory/768-194-0x0000027BD6220000-0x0000027BD6264000-memory.dmp

Filesize
272KB

Download
memory/768-197-0x00000644A0040000-0x00000644A005D000-memory.dmp

Filesize
116KB

Download
memory/768-207-0x0000027BD6520000-0x0000027BD6682000-memory.dmp

Filesize
1.4MB

Download
memory/768-210-0x0000027BD63F0000-0x0000027BD6422000-memory.dmp

Filesize
200KB

Download
memory/768-166-0x0000027BB15C0000-0x0000027BB15CA000-memory.dmp

Filesize
40KB

Download
memory/768-163-0x0000000180110000-0x0000000180329000-memory.dmp

Filesize
2.1MB

Download
memory/768-171-0x00000644A0060000-0x00000644A00A5000-memory.dmp

Filesize
276KB

Download
memory/768-216-0x0000000180010000-0x000000018001D000-memory.dmp

Filesize
52KB

Download
memory/768-220-0x0000027BD54A0000-0x0000027BD54B0000-memory.dmp

Filesize
64KB

Download
memory/768-160-0x00007FFC045F0000-0x00007FFC04AFF000-memory.dmp

Filesize
5.1MB

Download
memory/768-153-0x000006448A000000-0x000006448A8F5000-memory.dmp

Filesize
9.0MB

Download
memory/768-241-0x0000027BD54A0000-0x0000027BD54B0000-memory.dmp

Filesize
64KB

Download
memory/768-245-0x00007FFC045F0000-0x00007FFC04AFF000-memory.dmp

Filesize
5.1MB

Download
memory/768-246-0x00000644A0C80000-0x00000644A18E6000-memory.dmp

Filesize
12.4MB

Download
memory/768-257-0x0000027BDB900000-0x0000027BDB914000-memory.dmp

Filesize
80KB

Download
memory/768-255-0x0000027BDB7B0000-0x0000027BDB7B5000-memory.dmp

Filesize
20KB

Download
memory/768-252-0x0000027BDBB70000-0x0000027BDBC67000-memory.dmp

Filesize
988KB

Download
memory/768-249-0x0000027BDB9A0000-0x0000027BDBA52000-memory.dmp

Filesize
712KB

Download
memory/768-263-0x0000027BD54A0000-0x0000027BD54B0000-memory.dmp

Filesize
64KB

Download
memory/768-264-0x0000027BD54A0000-0x0000027BD54B0000-memory.dmp

Filesize
64KB

Download
memory/768-265-0x0000027BD54A0000-0x0000027BD54B0000-memory.dmp

Filesize
64KB

Download