Overview

overview

10

Static

static

10

artifacts.zip

windows11-21h2-x64

9

Analysis

  • max time kernel
    139s
  • max time network
    155s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    22-08-2024 14:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    artifacts.zip

  • Size

    139.8MB

  • MD5

    d0e1b50214b55a05c9c36f5d6af0e5e0

  • SHA1

    29d6d783b4f55c9293e75d63dc58c92ad757d7b0

  • SHA256

    d34d5d293ef589bc20d27d216385f34706a8a049460633a9476222e0a3bd0680

  • SHA512

    021c08bbc3e30ff672cc69210295598b84f8d2aa33a7c42e11fc09a1b6b70627aba5281bf2903040d06f2049f1b4cbbc6684d280531a9cf89cc812f65ed4810f

  • SSDEEP

    3145728:RyRREc3Z0CqFp83bUchCAXDSlBAvPkKkzc+wVlOljKhvsPnN4yo8EmQ/Wqu9:yJWHG3LhCVleHkYlOljtN4GQ/Wqu9

Score
9/10
steamdefense_evasiondiscoveryevasionexecutionpersistencephishing

Malware Config

Signatures

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file
  • Drops file in Drivers directory 3 IoCs
  • Manipulates Digital Signatures 1 TTPs 13 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 36 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Detected potential entity reuse from brand steam.
    phishingsteam
  • Drops file in System32 directory 34 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 38 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 18 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\artifacts.zip
    1⤵
      PID:3740
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2064
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4136
      • C:\Users\Admin\AppData\Local\Temp\Temp1_artifacts.zip\build\packaging\nsis\wireshark-4.5.0-x64.exe
        "C:\Users\Admin\AppData\Local\Temp\Temp1_artifacts.zip\build\packaging\nsis\wireshark-4.5.0-x64.exe"
        1⤵
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2200
        • C:\Program Files\wireshark\npcap-1.79.exe
          "C:\Program Files\wireshark\npcap-1.79.exe" /winpcap_mode=no /loopback_support=no
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1680
          • C:\Users\Admin\AppData\Local\Temp\nsq5CDE.tmp\NPFInstall.exe
            "C:\Users\Admin\AppData\Local\Temp\nsq5CDE.tmp\NPFInstall.exe" -n -check_dll
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:5308
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Get-ChildItem Cert:\LocalMachine\Root | Where-Object {$_.Thumbprint -eq '0563b8630d62d75abbc8ab1e4bdfb5a899b24d43'} | Sort-Object -Descending -Property FriendlyName | Select-Object -Skip 1 | Remove-Item"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5688
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "If (Get-ChildItem Cert:\LocalMachine\Root\0563b8630d62d75abbc8ab1e4bdfb5a899b24d43){certutil.exe -verifystore 'Root' '0563b8630d62d75abbc8ab1e4bdfb5a899b24d43';If($LASTEXITCODE -ne 0){Remove-Item Cert:\LocalMachine\Root\0563b8630d62d75abbc8ab1e4bdfb5a899b24d43}}"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5952
            • C:\Windows\SysWOW64\certutil.exe
              "C:\Windows\system32\certutil.exe" -verifystore Root 0563b8630d62d75abbc8ab1e4bdfb5a899b24d43
              4⤵
              • Manipulates Digital Signatures
              • System Location Discovery: System Language Discovery
              PID:6100
          • C:\Windows\SysWOW64\certutil.exe
            certutil.exe -verifystore "Root" "0563b8630d62d75abbc8ab1e4bdfb5a899b24d43"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:6112
          • C:\Windows\SysWOW64\certutil.exe
            certutil.exe -addstore -f "Root" "C:\Users\Admin\AppData\Local\Temp\nsq5CDE.tmp\0563b8630d62d75abbc8ab1e4bdfb5a899b24d43.sst"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1488
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Get-ChildItem Cert:\LocalMachine\Root | Where-Object {$_.Thumbprint -eq '5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25'} | Sort-Object -Descending -Property FriendlyName | Select-Object -Skip 1 | Remove-Item"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:488
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "If (Get-ChildItem Cert:\LocalMachine\Root\5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25){certutil.exe -verifystore 'Root' '5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25';If($LASTEXITCODE -ne 0){Remove-Item Cert:\LocalMachine\Root\5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25}}"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5612
            • C:\Windows\SysWOW64\certutil.exe
              "C:\Windows\system32\certutil.exe" -verifystore Root 5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25
              4⤵
              • System Location Discovery: System Language Discovery
              PID:5472
          • C:\Windows\SysWOW64\certutil.exe
            certutil.exe -verifystore "Root" "5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5580
          • C:\Windows\SysWOW64\certutil.exe
            certutil.exe -addstore -f "Root" "C:\Users\Admin\AppData\Local\Temp\nsq5CDE.tmp\5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25.sst"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5628
          • C:\Windows\SysWOW64\certutil.exe
            certutil.exe -addstore -f "TrustedPublisher" "C:\Users\Admin\AppData\Local\Temp\nsq5CDE.tmp\signing.p7b"
            3⤵
            • Manipulates Digital Signatures
            • System Location Discovery: System Language Discovery
            PID:5820
          • C:\Program Files\Npcap\NPFInstall.exe
            "C:\Program Files\Npcap\NPFInstall.exe" -n -c
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:5892
            • C:\Windows\SYSTEM32\pnputil.exe
              pnputil.exe -e
              4⤵
                PID:5880
            • C:\Program Files\Npcap\NPFInstall.exe
              "C:\Program Files\Npcap\NPFInstall.exe" -n -iw
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:5028
            • C:\Program Files\Npcap\NPFInstall.exe
              "C:\Program Files\Npcap\NPFInstall.exe" -n -i
              3⤵
              • Drops file in Drivers directory
              • Executes dropped EXE
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Suspicious use of SetWindowsHookEx
              PID:228
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Microsoft.PowerShell.Management\Start-Service -Name npcap -PassThru | Microsoft.PowerShell.Management\Stop-Service -PassThru | Microsoft.PowerShell.Management\Start-Service"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5812
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "ScheduledTasks\Register-ScheduledTask -Force -TaskName 'npcapwatchdog' -Description 'Ensure Npcap service is configured to start at boot' -Action (ScheduledTasks\New-ScheduledTaskAction -Execute 'C:\Program Files\Npcap\CheckStatus.bat') -Principal (ScheduledTasks\New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount) -Trigger (ScheduledTasks\New-ScheduledTaskTrigger -AtStartup) -Settings (ScheduledTasks\New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Compatibility Win8)"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5208
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe"
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:4440
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe"
            2⤵
            • Manipulates Digital Signatures
            • Subvert Trust Controls: Mark-of-the-Web Bypass
            • Checks processor information in registry
            • NTFS ADS
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2368
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1872 -prefMapHandle 1864 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {965f223e-2db0-4aeb-9c2b-1fdd4aeb98bc} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" gpu
              3⤵
                PID:2464
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2376 -parentBuildID 20240401114208 -prefsHandle 2368 -prefMapHandle 2364 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {82364828-16e5-4df5-934a-26eb83a24ff5} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" socket
                3⤵
                • Checks processor information in registry
                PID:2668
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3100 -childID 1 -isForBrowser -prefsHandle 3080 -prefMapHandle 3060 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {277d3356-32b7-4f5e-a2bb-c9ac0135f2a2} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" tab
                3⤵
                  PID:2932
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2708 -childID 2 -isForBrowser -prefsHandle 3692 -prefMapHandle 3100 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc6f1ace-5cf8-48b6-9bef-fb3321d700bd} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" tab
                  3⤵
                    PID:3588
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4700 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4632 -prefMapHandle 4712 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bef0a0a3-7c05-40e6-8968-cda3c2e7f1fb} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" utility
                    3⤵
                    • Checks processor information in registry
                    PID:4980
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5392 -childID 3 -isForBrowser -prefsHandle 1332 -prefMapHandle 1676 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e7d2bf8-fb20-4dc0-8006-701b70fb9d08} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" tab
                    3⤵
                      PID:4628
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1680 -childID 4 -isForBrowser -prefsHandle 2796 -prefMapHandle 2792 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9a8adea-1221-47b1-9bfe-d8d5e0228d2c} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" tab
                      3⤵
                        PID:1568
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5688 -childID 5 -isForBrowser -prefsHandle 5792 -prefMapHandle 5796 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06b97b83-2e3c-417c-b5e8-ae74b5ede740} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" tab
                        3⤵
                          PID:3980
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6152 -childID 6 -isForBrowser -prefsHandle 6088 -prefMapHandle 6092 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69bd25b2-94db-4dd4-8225-8edb29f18c72} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" tab
                          3⤵
                            PID:4532
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5516 -childID 7 -isForBrowser -prefsHandle 1404 -prefMapHandle 5552 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04d1395a-8e19-4e4b-bef3-968392a5ee05} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" tab
                            3⤵
                              PID:3972
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4320 -childID 8 -isForBrowser -prefsHandle 3948 -prefMapHandle 5268 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d7f6676-0a7d-4ffd-ab0c-0c0ae730447b} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" tab
                              3⤵
                                PID:4456
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5700 -parentBuildID 20240401114208 -prefsHandle 5980 -prefMapHandle 5976 -prefsLen 29397 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2edaf155-5467-4b6a-a2fd-03d0e89572a1} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" rdd
                                3⤵
                                  PID:5296
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6728 -childID 9 -isForBrowser -prefsHandle 6740 -prefMapHandle 6736 -prefsLen 27253 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b1c601e-6b43-4312-a620-1652b43c5e48} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" tab
                                  3⤵
                                    PID:5712
                                  • C:\Users\Admin\Downloads\SteamSetup.exe
                                    "C:\Users\Admin\Downloads\SteamSetup.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Adds Run key to start application
                                    • Drops file in Program Files directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5560
                                    • C:\Program Files (x86)\Steam\bin\steamservice.exe
                                      "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
                                      4⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5544
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                1⤵
                                • Drops file in Windows directory
                                • Checks SCSI registry key(s)
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5432
                                • C:\Windows\system32\DrvInst.exe
                                  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{9712ce58-344c-634f-b574-f3562eb8203f}\NPCAP.inf" "9" "405306be3" "000000000000015C" "WinSta0\Default" "000000000000016C" "208" "C:\Program Files\Npcap"
                                  2⤵
                                  • Drops file in System32 directory
                                  • Drops file in Windows directory
                                  • Checks SCSI registry key(s)
                                  • Modifies data under HKEY_USERS
                                  PID:5608
                              • C:\Program Files (x86)\Steam\steam.exe
                                "C:\Program Files (x86)\Steam\steam.exe"
                                1⤵
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • System Location Discovery: System Language Discovery
                                • Checks processor information in registry
                                • Modifies system certificate store
                                PID:5576
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe"
                                1⤵
                                  PID:1628
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe"
                                    2⤵
                                    • Checks processor information in registry
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5168
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1840 -parentBuildID 20240401114208 -prefsHandle 1756 -prefMapHandle 1748 -prefsLen 24418 -prefMapSize 245021 -appDir "C:\Program Files\Mozilla Firefox\browser" - {97c654ab-df16-49ed-a38f-a898725aea8a} 5168 "\\.\pipe\gecko-crash-server-pipe.5168" gpu
                                      3⤵
                                        PID:2904
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2180 -parentBuildID 20240401114208 -prefsHandle 2172 -prefMapHandle 2168 -prefsLen 24418 -prefMapSize 245021 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cadeec81-3f6c-49a3-8e38-6fc29cbb45fd} 5168 "\\.\pipe\gecko-crash-server-pipe.5168" socket
                                        3⤵
                                          PID:6112
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2428 -childID 1 -isForBrowser -prefsHandle 2904 -prefMapHandle 3116 -prefsLen 24917 -prefMapSize 245021 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {862c80c2-bedf-48bd-80e4-c92383417a5e} 5168 "\\.\pipe\gecko-crash-server-pipe.5168" tab
                                          3⤵
                                            PID:4636
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3788 -childID 2 -isForBrowser -prefsHandle 3776 -prefMapHandle 3768 -prefsLen 30150 -prefMapSize 245021 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {854dcb3a-b9cf-4269-ad51-51dfe981c4f6} 5168 "\\.\pipe\gecko-crash-server-pipe.5168" tab
                                            3⤵
                                              PID:4120
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4572 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4564 -prefMapHandle 4496 -prefsLen 30204 -prefMapSize 245021 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f7bda0b-a57f-436f-b312-e3413e945ba5} 5168 "\\.\pipe\gecko-crash-server-pipe.5168" utility
                                              3⤵
                                                PID:5448
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4544 -childID 3 -isForBrowser -prefsHandle 5044 -prefMapHandle 4996 -prefsLen 27721 -prefMapSize 245021 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7625d62c-b5e3-436f-b4a2-4cb5db7b52d5} 5168 "\\.\pipe\gecko-crash-server-pipe.5168" tab
                                                3⤵
                                                  PID:1988
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5180 -childID 4 -isForBrowser -prefsHandle 5188 -prefMapHandle 5192 -prefsLen 27721 -prefMapSize 245021 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60dd9366-6f3d-41e2-9bb7-76ed0807b288} 5168 "\\.\pipe\gecko-crash-server-pipe.5168" tab
                                                  3⤵
                                                    PID:4588
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5372 -childID 5 -isForBrowser -prefsHandle 5380 -prefMapHandle 5384 -prefsLen 27721 -prefMapSize 245021 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52d1e621-9870-4cae-b020-5f4ce19c7c46} 5168 "\\.\pipe\gecko-crash-server-pipe.5168" tab
                                                    3⤵
                                                      PID:5148
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6032 -childID 6 -isForBrowser -prefsHandle 6016 -prefMapHandle 6020 -prefsLen 27721 -prefMapSize 245021 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff3d7368-4600-4b28-9f68-ec83b70dbd8a} 5168 "\\.\pipe\gecko-crash-server-pipe.5168" tab
                                                      3⤵
                                                        PID:3176

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\PROGRA~1\Npcap\npcap.cat
                                                    Filesize

                                                    12KB

                                                    MD5

                                                    851cc374a87e0a83956a29c762c008c5

                                                    SHA1

                                                    1f1c907e687631c551caaaffb0de28dfcfb03c01

                                                    SHA256

                                                    f05d0dfba14aceb7cb27b49ec8c4f1ce179813e0cf89a32855d7ea2fda91e124

                                                    SHA512

                                                    260c822dbb2fd53cec2ad352e97a42a665fc030de9cf0b223fed3a945822ccbd7e0e12fa0873646aaf38f5f7b93428f29c0bed3709fbaaa83a3dab6dc39a2dc7

                                                    Download Submit

                                                  • C:\PROGRA~1\Npcap\npcap.sys
                                                    Filesize

                                                    68KB

                                                    MD5

                                                    1637086aa0ba4637d2788dc20a0cc67c

                                                    SHA1

                                                    4628fe7561526714361764ec637339b21ea88b60

                                                    SHA256

                                                    734c62543768e37c36386b4a07582bb5b322a60d5c997626465725c5b5cef978

                                                    SHA512

                                                    92fb3dd73873ef8a888823f14911f52fe7c11a06bf4172929783a3f3106ea6298d660389cfca902153424b8df64fbe9dc9c5651228d5eb72a650655df21f7cdc

                                                    Download Submit

                                                  • C:\Program Files (x86)\Steam\Steam.exe
                                                    Filesize

                                                    4.2MB

                                                    MD5

                                                    33bcb1c8975a4063a134a72803e0ca16

                                                    SHA1

                                                    ed7a4e6e66511bb8b3e32cbfb5557ebcb4082b65

                                                    SHA256

                                                    12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1

                                                    SHA512

                                                    13f3a7d6215bb4837ea0a1a9c5ba06a985e0c80979c25cfb526a390d71a15d1737c0290a899f4705c2749982c9f6c9007c1751fef1a97b12db529b2f33c97b49

                                                    Download Submit

                                                  • C:\Program Files\Npcap\NPCAP.inf
                                                    Filesize

                                                    8KB

                                                    MD5

                                                    ed7304fce3f5e3de28435d3f9e8b4156

                                                    SHA1

                                                    45bc86c10386c9368ac482f341999a289dd46897

                                                    SHA256

                                                    64be5edac3eba224120138c6dea3e4a75740e23324fba5a0799499402d96a258

                                                    SHA512

                                                    d7532a12b726869e430745da536b7e1e85ce5871bbf3c3cf5fb4261f5b3d5d4307e6267a8b5f53a6719369e261c66c85c05f3941974594ae4864b16242cae41b

                                                    Download Submit

                                                  • C:\Program Files\Npcap\NPCAP_wfp.inf
                                                    Filesize

                                                    2KB

                                                    MD5

                                                    8ca4504e8e9b66d925107a8f13d9babb

                                                    SHA1

                                                    a1d34e2a6e9ce395da0702a9b1e1ec815dc144f0

                                                    SHA256

                                                    d1b2726787010252e4dec2a1a47fdd42d86b917c9c41f8baab2219de938b90cb

                                                    SHA512

                                                    4c3fe98134c6e7c180829f82374b22ab052e1cadd2d2ff71ff6eefa4e2a7ff21b8bff14ff21677099d2656a0c216c40abb9246860e70be9f254d73d58b624c38

                                                    Download Submit

                                                  • C:\Program Files\Npcap\NPFInstall.log
                                                    Filesize

                                                    1KB

                                                    MD5

                                                    ce2e063c5e272a8699eec1a08a681103

                                                    SHA1

                                                    39566e10005a6733bc380f5ccd29c5b39e994233

                                                    SHA256

                                                    90bc8e312194b29181db9a78efc522972359b5b2c522e425c34b789f5d00dad3

                                                    SHA512

                                                    838962bb84b485cdc64451336771156d6e1d552a7a29b84acf3aa1719b6a04e1c65e2983ed7264d1f47913553b1724cb2c4f8f805fd276a9ff164d86c48220d5

                                                    Download Submit

                                                  • C:\Program Files\Npcap\NPFInstall.log
                                                    Filesize

                                                    2KB

                                                    MD5

                                                    9ceb07770b97e687994c1f9c71af6cb8

                                                    SHA1

                                                    f1be2c32f4d750ff9ceefa507e4a0a7d3df644f7

                                                    SHA256

                                                    c797c68a4f765008a685ad2841f2b08a33293ae6d94b61511696665def9aa1e5

                                                    SHA512

                                                    3d202a2099f8a2b80d8156c33ce5949ff5604873d050b958c648d4d1b85df49ac90b6c98ab9d1a870c1ed0355cd00329e625005bad8ad2395e794252820ecd7a

                                                    Download Submit

                                                  • C:\Program Files\Npcap\NPFInstall.log
                                                    Filesize

                                                    3KB

                                                    MD5

                                                    f45a33814aeaafb46462b71ab7075361

                                                    SHA1

                                                    cbc59a14235f7aeb4df393b64d4058698f9a5b47

                                                    SHA256

                                                    28286f473186c1c191b571699bec115cc77bb81952ab46dbaeae08e7369b8e25

                                                    SHA512

                                                    517b7110ab7da92b6806769e1d6b4dd8aa99f2df734342ab839307b53482f879d77f4130928808e613698cab540679bc4246caf105aaf3a13170e623b642887c

                                                    Download Submit

                                                  • C:\Program Files\Npcap\NPFInstall.log
                                                    Filesize

                                                    4KB

                                                    MD5

                                                    67fc09882f6c608c5bb2850bc0f27b32

                                                    SHA1

                                                    70cefe8ab831bd9f1370093cbad7d7fbaf2707cf

                                                    SHA256

                                                    cbef8736de2f39fefca1267f0efac62e955a6aaf080449720b21bd9d16a7d9fd

                                                    SHA512

                                                    882b16dd0539299b91c8318f90fcd8e5e4a0d4e5a215b30533dfe12ef207782080a53596e2f8af4eb3770fd119386080586a5697ff96e907e079b444e16f0967

                                                    Download Submit

                                                  • C:\Program Files\Npcap\NPFInstall.log
                                                    Filesize

                                                    4KB

                                                    MD5

                                                    c40a85f3975b853ed4a3f56a9f510fc0

                                                    SHA1

                                                    ba8e22270d84b45b5babecfff0cfc84017b83409

                                                    SHA256

                                                    fbdb12fa1d87f08f444fd5c00f6697d7b0f5b954b10dd54c0e05decbca441998

                                                    SHA512

                                                    1151bf1d1fc2b8e8b66f5fc8255e99ec4553dbd2d4d03a330175355c31a93504f484fa4f08848bf691bffa4a8e8f2bdf020ad37ec4ae6ce251d301c27d6df9e8

                                                    Download Submit

                                                  • C:\Program Files\wireshark\npcap-1.79.exe
                                                    Filesize

                                                    1.1MB

                                                    MD5

                                                    a4d7e47df742f62080bf845d606045b4

                                                    SHA1

                                                    723743dc9fa4a190452a7ffc971adfaac91606fa

                                                    SHA256

                                                    a95577ebbc67fc45b319e2ef3a55f4e9b211fe82ed4cb9d8be6b1a9e2425ce53

                                                    SHA512

                                                    8582b51b5fea23de43803fa925d13f1eb6d91b708be133be745d7d6155082cd131c9b62dc6a08b77f419a239efe6eb55a98f02f5783c7cd46e284ec3241fc2ee

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                    Filesize

                                                    2KB

                                                    MD5

                                                    08a41b2a5cba04117cc86ac7628814fd

                                                    SHA1

                                                    27ef154216bc996c5d6726072715f176ac349fc5

                                                    SHA256

                                                    8f2c523d6b851d6a91ebad962f18f005e8ab564efc5a2c3325a2d7ddd469f0a0

                                                    SHA512

                                                    df9d99b0cd8de5b2da7c74520c66a35acfa0dbf6fe927e3146a63d52c0808792a1cb56c36645810a4eccf3ada536f931e0e4b5e1472c01a709fda4d3eafb53e7

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    Filesize

                                                    17KB

                                                    MD5

                                                    a4a915ca0c7b72e215293d4fea352222

                                                    SHA1

                                                    f0722e80411fb5149245d547dbd643ad68cdc51d

                                                    SHA256

                                                    c909f83e04449015df940a1f43613f7dae9a1c95798179938c3f803a5ea5a756

                                                    SHA512

                                                    47bfee279e878951124214dc53e920617b3f33315fef41e628f95b2f1367fbb23dc31cc6c71447b4fcb4e382befacaee840d6eb7df1a052da75cd795706161d2

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    Filesize

                                                    16KB

                                                    MD5

                                                    380350013cc1e248b31ff8b1c6179c2f

                                                    SHA1

                                                    6df44e945b6fdb4e07a10e0f295c577c347d75d6

                                                    SHA256

                                                    7204ff2231d5d7c08c2ebd9e69d89817fe61679776cc07820f67b85ae0c9f6e8

                                                    SHA512

                                                    ed8bef1bc839370c3f5ac42ccf9900404c8fd48c507707cfaabbf101619c719d6b1f991a490036ad999b60cadfd243e7175fd99c272d99ab57168056ce4831e9

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    Filesize

                                                    17KB

                                                    MD5

                                                    67eef6b88c3edf39270c388f14b1048b

                                                    SHA1

                                                    b4808270b05b7b64ef5aae3502eae65824fef2a8

                                                    SHA256

                                                    e9763662e69d7d8d695f21eda8eed3be05d98bd0f147765e8b6104850f72e429

                                                    SHA512

                                                    10c9facf7ca40af73db537961868e186e6e236a05039a98a65666e96d02c1ffd11698f1c1a340bcdc9e85e8cd859bac1afb508b8e9e9019e3dbd47cc5c12bf2c

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    Filesize

                                                    16KB

                                                    MD5

                                                    b34914b6a8358ed742dea55e7fce98fc

                                                    SHA1

                                                    97bf17527f744818f2316e9ae919b18d80eb18da

                                                    SHA256

                                                    a9fad8fedd512551fe9f386502cf28a18210f4a9c8ac289c5d846bc40568505f

                                                    SHA512

                                                    f81e1ff12986fd1d423f792ba54e7809ea263ea43b665e83424969244bde288dc4144cbdb0823c8a5ee7f890d84e35e5a9faf224be618c2829ac4ce1a184b28e

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    Filesize

                                                    17KB

                                                    MD5

                                                    35205e8f661ad53c94143d9daae82258

                                                    SHA1

                                                    63d01b78081d880bdd20c134a27e46d907bd718a

                                                    SHA256

                                                    5110f85e98b0e45fca63269d7d27c660e553e53aaa97d3de69a8103de502088a

                                                    SHA512

                                                    265aaa942c5c756335ef32e726abcd26b53615d57eab70293e538664536c0c0a2a21ab958f3be044aaef0d09ddbfa7bca5cd8caa5a39f2e13bf366b0c5c10e94

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\activity-stream.discovery_stream.json
                                                    Filesize

                                                    39KB

                                                    MD5

                                                    009a6ffc352168eb6b7a7a9e242683af

                                                    SHA1

                                                    12f9ee1b75c4c0016cae5cf5c348baea05ae9a48

                                                    SHA256

                                                    547d86f33991bc782fdaa7b1a6a9c379869c9e124591f1e1c6cdfe181419155a

                                                    SHA512

                                                    08dba4416fb40c6a4348d554f20ea786888cea1e0d61e70deaefccd6a68286baddf529c06153e5fb77a2b28f762f357b63bce47bc5109067b21d9e80a7893157

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\cache2\entries\80E40493E66F98650D12C73CDEFE29BBACA89328
                                                    Filesize

                                                    221KB

                                                    MD5

                                                    1e7299602cc561e7b9c1f0c31c18bfd5

                                                    SHA1

                                                    eeadfddb15f09843eb95d554a2cc25233f1d911e

                                                    SHA256

                                                    1bf97a0dc28edd1e177322df234222147cca95af9df543b58f8c91c8f24623ce

                                                    SHA512

                                                    a1c348104f0d2564e89cda7e92f3edf5a6af09d92fbdfb0b5287e61c759ffef5604f09bb535bdb128a3c5e32e491c3fefa28a819e9056ce58d625bc70a24fe94

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\startupCache\webext.sc.lz4
                                                    Filesize

                                                    107KB

                                                    MD5

                                                    73d02317b2b7d017f87018d339285dd2

                                                    SHA1

                                                    339619661d973afcffcabcb82bfd1f7e524c7e50

                                                    SHA256

                                                    0da2a4186eedd502d6d85affc840182f740e9a78bcb972b9cd9d21927275a4a2

                                                    SHA512

                                                    8abdfc53336aaa05d25205b543320b4e1bfc56bc5a41249d82707091d2a3c0a89d0823e771608dba8ef92bb469daea3b1250dcaf1857aa9a67c01c983424f4a6

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
                                                    Filesize

                                                    10KB

                                                    MD5

                                                    a7f391566ceb7d310b04c1376aa66a07

                                                    SHA1

                                                    eda88e9134d3de209152481c9e8aa02054d4c2eb

                                                    SHA256

                                                    8ecb81fa22792fa6bb09abc86b9b5afb50773e2c5537def45dd8ba297f6c714e

                                                    SHA512

                                                    163bad20eaa9108286367367e6a54a9ac612026954ee2466b8f88f732a992695fe160d3fb5f092976ef15c1c1b71400e577a9a4833dfa616d7c9ee6a8237033c

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_litmdwlg.qmt.ps1
                                                    Filesize

                                                    60B

                                                    MD5

                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                    SHA1

                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                    SHA256

                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                    SHA512

                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsaF828.tmp\DonatePage.ini
                                                    Filesize

                                                    866B

                                                    MD5

                                                    f3c219a45fcb3618123ef6ee2de5a13f

                                                    SHA1

                                                    5c6ddf04c2d26c7b433b9db1d1157a7a199fc34c

                                                    SHA256

                                                    ca57ab9315d0b9209f4f50f553d4aa2bb0c28cbcbbff24c338b879674e0c311d

                                                    SHA512

                                                    ea0a8c11ae1190780b0a48730e286bfaa215c16204f3a3d946070510e9e6fc9f040e74c3e131c471503dc8716290c4f32b08b040c479be8509bcae3987ea9d39

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsaF828.tmp\InstallOptions.dll
                                                    Filesize

                                                    32KB

                                                    MD5

                                                    bef770535d2b98e4f24486a5292b16f0

                                                    SHA1

                                                    9107f8a6fa3cf0dc2b57e6c97c34c2aa7aaf54a6

                                                    SHA256

                                                    37a4507cff4d8e1ffd01fbab23661cc28a6c024977ea912ce2f49419049d0bf2

                                                    SHA512

                                                    faca2009e37eaf28a39f47c95b63892972583d79ed3d320d2ad81a4862371e0af0237a5675b5e66b10275692128ac488f8255d81b022fbe5dc825c42a5e9537d

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsaF828.tmp\NpcapPage.ini
                                                    Filesize

                                                    2KB

                                                    MD5

                                                    37770b23488380d4f8cdd4672e02d7b2

                                                    SHA1

                                                    489ca0f8323f023680a6bb3aa884e358e1d8d213

                                                    SHA256

                                                    7393a6dd3fd1d45433ded29c3697f3672702b86774a634a7067e99d47ded082e

                                                    SHA512

                                                    322ac98d16a627f78b9735e541fea23202618e86eafce9600eac1cb5a35f3687ff8c3e2632e733e04b45dfa6d259849543bc6560fad21c510f3e611a44ba98ac

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsaF828.tmp\NpcapPage.ini
                                                    Filesize

                                                    2KB

                                                    MD5

                                                    eab8bcb16963e82aabced55e12700034

                                                    SHA1

                                                    74e52ba9decb30f105ed6edfd385bdad2ef864fa

                                                    SHA256

                                                    39d03acf6c14c6c467f12f6d48f38b9550f54bb612085d7c899524329eabf255

                                                    SHA512

                                                    7c9ed1f777f74858cd79679eb635a1add38115efc04e90dd0f279de09d66b45946b015afdbf1452a9d5279e9902b208c2b7841baaabd74e8942f1ce7bf46328a

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsaF828.tmp\NpcapPage.ini
                                                    Filesize

                                                    2KB

                                                    MD5

                                                    05b3a50c4b7230582fb8f0b21c507b26

                                                    SHA1

                                                    983d88730a6b43e69a32ab91a1c495aae3690c58

                                                    SHA256

                                                    de67dcee3accc14461febae1a66d8791a7c5325532ad22725fa9d86fe018da70

                                                    SHA512

                                                    2001331eac256c5518b081d720c3a5a79d36bc12b5aff57db32760c4375875f109d6947881246b6dcd18aa1b242fb962344b9e6885951891db878063c37fd662

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsaF828.tmp\System.dll
                                                    Filesize

                                                    29KB

                                                    MD5

                                                    223b9d97f9bc580f7da1817ebf359223

                                                    SHA1

                                                    091ff63c957787916d1aed9f358b4e921d5312b3

                                                    SHA256

                                                    c90fea5a7efc0a4de0d37bd56b8552a42da2000ef7dc8e8487914c26117b232a

                                                    SHA512

                                                    f79a8e6448ef94f37075612e086b70847c4f59524773a8370cb4361cebf4537dbe0c8cb981f5247682a9fc89af147360e76f386d0d9825dc20d58bca7f0d7158

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsaF828.tmp\USBPcapPage.ini
                                                    Filesize

                                                    2KB

                                                    MD5

                                                    686a9d42c9e3e057e7b1c9417c365569

                                                    SHA1

                                                    d9b6f98a89a1bf172c175ef1898b040d83d8454e

                                                    SHA256

                                                    153786695f9b3eb696f287564a04ae125ac4c9845af908fecf46d5f3a9754084

                                                    SHA512

                                                    75d4f85be3dce14b54d3f29e9ec18342273463061956f7f29df339df56191c075669136f691bba3ae5000d4429a70eacfc7e398863027b85bb4157bc3ea368d6

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsaF828.tmp\nsDialogs.dll
                                                    Filesize

                                                    14KB

                                                    MD5

                                                    c133aca05825e450a97e1cb474c80964

                                                    SHA1

                                                    85ac1b4250993c54c852af1eab1f05e9fcd6b327

                                                    SHA256

                                                    7a7d812895c6c47474217f248d59464eb2a5f163599adf50595536bb9f41339e

                                                    SHA512

                                                    e752b04a9a68b252c153dc128b111d555b8d2d33f639f0445ebc7bcfd8e741730bc7f02a38c96cb4516cd8944c038c74fead3000f3b7daff57742a394dcb36bb

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nshA0FB.tmp\StdUtils.dll
                                                    Filesize

                                                    110KB

                                                    MD5

                                                    db11ab4828b429a987e7682e495c1810

                                                    SHA1

                                                    29c2c2069c4975c90789dc6d3677b4b650196561

                                                    SHA256

                                                    c602c44a4d4088dbf5a659f36ba1c3a9d81f8367577de0cb940c0b8afee5c376

                                                    SHA512

                                                    460d1ccfc0d7180eae4e6f1a326d175fec78a7d6014447a9a79b6df501fa05cd4bd90f8f7a85b7b6a4610e2fa7059e30ae6e17bc828d370e5750de9b40b9ae88

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nshA0FB.tmp\System.dll
                                                    Filesize

                                                    22KB

                                                    MD5

                                                    a36fbe922ffac9cd85a845d7a813f391

                                                    SHA1

                                                    f656a613a723cc1b449034d73551b4fcdf0dcf1a

                                                    SHA256

                                                    fa367ae36bfbe7c989c24c7abbb13482fc20bc35e7812dc377aa1c281ee14cc0

                                                    SHA512

                                                    1d1b95a285536ddc2a89a9b3be4bb5151b1d4c018ea8e521de838498f62e8f29bb7b3b0250df73e327e8e65e2c80b4a2d9a781276bf2a51d10e7099bacb2e50b

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nshA0FB.tmp\modern-wizard.bmp
                                                    Filesize

                                                    150KB

                                                    MD5

                                                    3614a4be6b610f1daf6c801574f161fe

                                                    SHA1

                                                    6edee98c0084a94caa1fe0124b4c19f42b4e7de6

                                                    SHA256

                                                    16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b

                                                    SHA512

                                                    06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nshA0FB.tmp\nsDialogs.dll
                                                    Filesize

                                                    20KB

                                                    MD5

                                                    4e5bc4458afa770636f2806ee0a1e999

                                                    SHA1

                                                    76dcc64af867526f776ab9225e7f4fe076487765

                                                    SHA256

                                                    91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0

                                                    SHA512

                                                    b6f529073a943bddbcb30a57d62216c78fcc9a09424b51ac0824ebfb9cac6cae4211bda26522d6923bd228f244ed8c41656c38284c71867f65d425727dd70162

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nshA0FB.tmp\nsExec.dll
                                                    Filesize

                                                    17KB

                                                    MD5

                                                    2095af18c696968208315d4328a2b7fe

                                                    SHA1

                                                    b1b0e70c03724b2941e92c5098cc1fc0f2b51568

                                                    SHA256

                                                    3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226

                                                    SHA512

                                                    60105dfb1cd60b4048bd7b367969f36ed6bd29f92488ba8cfa862e31942fd529cbc58e8b0c738d91d8bef07c5902ce334e36c66eae1bfe104b44a159b5615ae5

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nshA0FB.tmp\nsProcess.dll
                                                    Filesize

                                                    15KB

                                                    MD5

                                                    08072dc900ca0626e8c079b2c5bcfcf3

                                                    SHA1

                                                    35f2bfa0b1b2a65b9475fb91af31f7b02aee4e37

                                                    SHA256

                                                    bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8

                                                    SHA512

                                                    8981da7f225eb78c414e9fb3c63af0c4daae4a78b4f3033df11cce43c3a22fdbf3853425fe3024f68c73d57ffb128cba4d0db63eda1402212d1c7e0ac022353c

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsq5CDE.tmp\0563b8630d62d75abbc8ab1e4bdfb5a899b24d43.sst
                                                    Filesize

                                                    1KB

                                                    MD5

                                                    de825a838e33ccf3d06b82de337c06d8

                                                    SHA1

                                                    68956e777f646361eae3f06ce6899cd48bb9f593

                                                    SHA256

                                                    3b63b09dff7e4c5fe7ccafff74d9f845d1eb04809b0b77a536b2e4aa7dd1097e

                                                    SHA512

                                                    e935ef759abfcafa4d9cf70a1c5508179600fc85d237e53d3e7f2683fa2e14859e5eee167007328995606996a19f4fcc0c1f9a851011a6fa8db6b53c68160a12

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsq5CDE.tmp\5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25.sst
                                                    Filesize

                                                    1KB

                                                    MD5

                                                    a52f3195b5585e1d9a9b38fef66a1801

                                                    SHA1

                                                    986a5f05ff51d261fe595f0ab56598658aadc9c9

                                                    SHA256

                                                    40795f603b2eab75fbd886715b0103f2f362494576400ae88925ed1ba7063bdc

                                                    SHA512

                                                    e9eeb34c3667e56c425b91890f463b5d80e4e5e9f485c2bd3ac064e1784ad118c1460af461e5af8acbbb3bc02432e4f914e54e41d2bdaeaa8af528f0e669b64a

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsq5CDE.tmp\InstallOptions.dll
                                                    Filesize

                                                    22KB

                                                    MD5

                                                    170c17ac80215d0a377b42557252ae10

                                                    SHA1

                                                    4cbab6cc189d02170dd3ba7c25aa492031679411

                                                    SHA256

                                                    61ea114d9d0cd1e884535095aa3527a6c28df55a4ecee733c8c398f50b84cc3d

                                                    SHA512

                                                    0fd65cad0fcaa98083c2021de3d6429e79978658809c62ae9e4ed630c016915ced36aa52f2f692986c3b600c92325e79fd6d757634e8e02d5e582ff03679163f

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsq5CDE.tmp\NPFInstall.exe
                                                    Filesize

                                                    300KB

                                                    MD5

                                                    c01beb6c3526554ec9dfad40502317f2

                                                    SHA1

                                                    89f468496bd7e6d993a032f918c5baabb21c11be

                                                    SHA256

                                                    5d54a5e7230baf2b80689ee49d263612a6011bc46ec52843e7b4297e9656d32d

                                                    SHA512

                                                    a7fdb3d69cc2b12c9795c8f5e34f64014273e471dc0639ff4693f18e3d5ea758f38f58a5dfc4d1800511ce3e130a7454fd371579e31dbba049770fb74b889339

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsq5CDE.tmp\System.dll
                                                    Filesize

                                                    19KB

                                                    MD5

                                                    f020a8d9ede1fb2af3651ad6e0ac9cb1

                                                    SHA1

                                                    341f9345d669432b2a51d107cbd101e8b82e37b1

                                                    SHA256

                                                    7efe73a8d32ed1b01727ad4579e9eec49c9309f2cb7bf03c8afa80d70242d1c0

                                                    SHA512

                                                    408fa5a797d3ff4b917bb4107771687004ba507a33cb5944b1cc3155e0372cb3e04a147f73852b9134f138ff709af3b0fb493cd8fa816c59e9f3d9b5649c68c4

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsq5CDE.tmp\final.ini
                                                    Filesize

                                                    568B

                                                    MD5

                                                    cae757421db8d011e41266bfd9439885

                                                    SHA1

                                                    7108a9f0740ee4e3a118f6ac9212e0446f074181

                                                    SHA256

                                                    ff350a68202aadb145f590c8579f9284d2e3c324b0369fde39e5a3a31d7b8204

                                                    SHA512

                                                    785d19c796834065c823a7da99036378bba54b932ea1e47d4ba0c1d123a0a09ec307a3459fb862221de74ce61d9a8d7ec73901c9de007d31e7b39eb7a19b16b5

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsq5CDE.tmp\nsExec.dll
                                                    Filesize

                                                    14KB

                                                    MD5

                                                    f9e61a25016dcb49867477c1e71a704e

                                                    SHA1

                                                    c01dc1fa7475e4812d158d6c00533410c597b5d9

                                                    SHA256

                                                    274e53dc8c5ddc273a6f5683b71b882ef8917029e2eaf6c8dbee0c62d999225d

                                                    SHA512

                                                    b4a6289ef9e761e29dd5362fecb1707c97d7cb3e160f4180036a96f2f904b2c64a075b5bf0fea4a3bb94dea97f3cfa0d057d3d6865c68da65fdcb9c3070c33d8

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsq5CDE.tmp\options.ini
                                                    Filesize

                                                    2KB

                                                    MD5

                                                    d5b270807bd5e8e117db66010fd51afa

                                                    SHA1

                                                    4ef5f4835c4db596cc641d2de63187de8ee5c6b3

                                                    SHA256

                                                    5a5e297948d13919e4432a5f7544da14de5accbe6d228f32162669148853edf5

                                                    SHA512

                                                    ee06c81076891a0716cba6f4696a6c7e8033322e6a3378a9e41cef0f3baa9483898df7bd0058da6faf857660d1a5e36ba5ccb6f55e6648ca6450420eb595fca6

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsq5CDE.tmp\options.ini
                                                    Filesize

                                                    2KB

                                                    MD5

                                                    3adb4eaa905fb2a6ec877e1fbcab5688

                                                    SHA1

                                                    10bbe89f010262e4f8c6a405075f8b694bdd2f72

                                                    SHA256

                                                    fc1e8703ddb46f35f48f592d026e3fdff9bd753ffb57d46f74d917da93990892

                                                    SHA512

                                                    fa5832d84c79b043ab44f4934b1cc8be605f5a09803c6464095ee54b212a522095d9515d7904c22c59b7178fd36562e6c9d404ba94448caaee7613a686b730b0

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsq5CDE.tmp\options.ini
                                                    Filesize

                                                    2KB

                                                    MD5

                                                    3986168f4cb431761a88c380c06d0fd7

                                                    SHA1

                                                    d413c585524b0483adbb807b05680eee5c6100dd

                                                    SHA256

                                                    a424f3b999f4fcc42c35f51f195b47e59c4015e5625adc1ecf4c2642e6aba111

                                                    SHA512

                                                    d01f6d535b5b67d7dc2a9a9d55e1030b5b18572280c05f7917dd052bb92db4f94ebbc5a07a0cfac3b8ebafaf925bd75b193eb9ca9ce358ec2dd4ffd98aec1257

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsq5CDE.tmp\signing.p7b
                                                    Filesize

                                                    7KB

                                                    MD5

                                                    dd4bc901ef817319791337fb345932e8

                                                    SHA1

                                                    f8a3454a09d90a09273935020c1418fdb7b7eb7c

                                                    SHA256

                                                    8e681692403c0f7c0b24160f4642daa1eb080ce5ec754b6f47cc56b43e731b71

                                                    SHA512

                                                    0a67cc346f9752e1c868b7dc60b25704255ab1e6ea745850c069212f2724eba62ffaaa48309d5eba6ae0235223518610fb4b60fc422e4babba4f33d331c71db5

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                    Filesize

                                                    479KB

                                                    MD5

                                                    09372174e83dbbf696ee732fd2e875bb

                                                    SHA1

                                                    ba360186ba650a769f9303f48b7200fb5eaccee1

                                                    SHA256

                                                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                    SHA512

                                                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin
                                                    Filesize

                                                    12KB

                                                    MD5

                                                    68348cef6b2a4c33fb2c596506253797

                                                    SHA1

                                                    eed306c7aff2b5c3272bba0756a1fe79e637d720

                                                    SHA256

                                                    6deb81fa360a8e24f7cc9daee9de4ce19c2eba2a554f9b42c26983517b266660

                                                    SHA512

                                                    ee0d5cd4a8571a05c1c672d4a1d5cbb99111bbcd31223bcaf1f2ce60dcc7aae1036cc65ab68a65f2b75d24798e64fe0bee59c8cba5839eb240d7fcbcbc9acc75

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin
                                                    Filesize

                                                    12KB

                                                    MD5

                                                    83480739f967b0e90bb3634ea628acfc

                                                    SHA1

                                                    fb74fe27acec80a8184490298ffd9dd304ec695f

                                                    SHA256

                                                    5b336b81df91168f8d23956cdfb1ddb1ad1dcc5ef988d3ab746af8e88b08ae4d

                                                    SHA512

                                                    65b14c2517277199ac1da20db3e11a874be24d479f4fb6d09dca14d6ac77d2f05a9d168379c59a0df3558bdcc3378ad2ac5d80770915488d3c725a804e6ad965

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin
                                                    Filesize

                                                    8KB

                                                    MD5

                                                    156a088673b239d3989b61a7474afe9d

                                                    SHA1

                                                    b3a8f121454a8ae5e5645f79004a71f1e4b65e1a

                                                    SHA256

                                                    86783a64b59464bc6c53fa93da89bc97553b9593e6287f2fc65cb411056ec5d9

                                                    SHA512

                                                    55b6f07e3dfc88cd57461e095c941dd49eb97da59a864db4ff1c72fac67a2fcb4f1f7c98d34c77218d7694f274ed6f4d454e4dc21a1fac0b49efb587aee34ab1

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp
                                                    Filesize

                                                    5KB

                                                    MD5

                                                    0e74cc315a769bafcc855da5331eb83f

                                                    SHA1

                                                    74b5ae2f9e686fc4cb030a04340e35375e3ee5f3

                                                    SHA256

                                                    b4b8f7d41468a83b101a2bce21840f1b752f78b9b8e3f95bdd0c4f3231976945

                                                    SHA512

                                                    85a167cd49e56733102a948d57fca1e0fded6624cd0662b0f2f8ed0cb62f509ae1052982ba2ad940328217fa9a86498e8fe0a767d5e456d29872d92d3d9653f7

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp
                                                    Filesize

                                                    7KB

                                                    MD5

                                                    35df5896460e2132968b93cd452c2564

                                                    SHA1

                                                    146e258eaf395ef38ecb016c7b2bfd432e279e45

                                                    SHA256

                                                    da9055a4d39a1e4b39b0af71a9c8369d8a0b90d5ee9c996d62e3639971b1c892

                                                    SHA512

                                                    cb4cf70203805d7201aa3886ba36aa594c806aecc94e64b6a049bbdd2bd2471e2dc4ec32dae611679018d2ba3f6155af0b6464d1aaaccb435e20274b0316a207

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp
                                                    Filesize

                                                    5KB

                                                    MD5

                                                    470616fdfa4ae83daed1084c40354ca4

                                                    SHA1

                                                    2424bd9577984d17c4fecadbaf77d06c909394cb

                                                    SHA256

                                                    6101e79b4890e1aca54eee8e6a70f889aa0e64da49762b526914d40eb6e16980

                                                    SHA512

                                                    e5bf5ca16dd71eee052c7ac1d5452c4618f37769577a2c99fb152e7a4ffb4a7ea4146ab31b94f749e72185bf71f9b17de3f7c78700b944ab753a37e5a187018c

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp
                                                    Filesize

                                                    6KB

                                                    MD5

                                                    1e16709c86081315c5a428118d43aa5d

                                                    SHA1

                                                    bae5fdf924bfeea2a4ca4bd47ebc7bc902f9c5b3

                                                    SHA256

                                                    ef67f558396bb10255a77956400fddae28e3f861cbc39c2c31378484f3662063

                                                    SHA512

                                                    0d2b27c48905030e4f0a8e78e3f9368974256f6bf608194f78cc099174d6110e38f18cb5196a527bf7bb2cf88e9c28f7c78e39d562ee3b072c769032e67ebb14

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp
                                                    Filesize

                                                    6KB

                                                    MD5

                                                    ef23247b52dd3188feb92e39e321e1b3

                                                    SHA1

                                                    ced4585f0cf7a8b7c4edc15a6e5f5256bff7927d

                                                    SHA256

                                                    1155ac102c49e071d4cded7b34e049314181fdcf3752a467887d61f43d253f2d

                                                    SHA512

                                                    3f7b650df0a173c8f145a8edca0fd3e381c2a9565483a56c7a959e533d27c23b2ab7b92aa1c43e6e714cce2a77f4e00a700278df99f1ed1360e60f67853e3535

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp
                                                    Filesize

                                                    45KB

                                                    MD5

                                                    a4d7b234b185ae7b51fb935d3c9be040

                                                    SHA1

                                                    1050be5826fa8d4bc7d4ab58ccc536da9523f22a

                                                    SHA256

                                                    2d373d8719083e686f8018e34d8b28e91aa6c042d5b0ff0165807135516f460b

                                                    SHA512

                                                    b21c00ec046e9b39b4388fc2a40a39cc20dfd145cd55dc61f125566c01fde728d4f5a584b8ab861173f8ea80c8a4c9310859a63d0c4e763ee28ac6566ff242c2

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp
                                                    Filesize

                                                    45KB

                                                    MD5

                                                    9ba05e813c42a4698100263e0844b798

                                                    SHA1

                                                    14f45b697e5616c55654284c57671b5236424933

                                                    SHA256

                                                    b1704ec056fbd2d853c49deaabc131512a9b28781cd1f3405244cfeb044c0c00

                                                    SHA512

                                                    769fec490822f97da917f27e50daf6f91e61a7cedbad800014cb686b50e929a6c21f06a5d519bf37d8aabc6125add4d16f7ca73eb65c2fc5ad17562e0978bea4

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\0e64a7aa-8e6e-452d-a252-ae4e523ff1bd
                                                    Filesize

                                                    671B

                                                    MD5

                                                    22be978205b0a0dc5b95a079a793d80b

                                                    SHA1

                                                    5288ed97e227439afa94e9c2bed7ba5b926a2a36

                                                    SHA256

                                                    11adc3ffd7c624010aebe978041f8e4080268623d84378d506b7f071a427deee

                                                    SHA512

                                                    15f95a06f06e2abfe629e0fde13e4b9036f520e64963f3b473c4d2002861584076a064bdf49a21641795bda05d6f0a30495780ade7274c61ac381d2cb2d6fa3f

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\9557c11b-7152-4f93-aa08-dff2ecbf85bc
                                                    Filesize

                                                    982B

                                                    MD5

                                                    f8c55acf50b54c702d7be80d835b8460

                                                    SHA1

                                                    bc5e6e28923128db2887c0dd9e6023980870213f

                                                    SHA256

                                                    8715c1f3dd11d9215702a2dbd4799e699c96eb2889d59901ca78a7a22e4b87dc

                                                    SHA512

                                                    6395015019d31eae70bbbc4bc4ed7c2fa6d066e64767eb6d26ff464206bf00aa40e767ae4f5aecbe6d697d632f2e73cc1885c893f949ffaa1d1164f1d61c79fc

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\a88eb4e1-3516-405e-90d5-8839662012fa
                                                    Filesize

                                                    1KB

                                                    MD5

                                                    c877368440b480eebff6fa985ca158d6

                                                    SHA1

                                                    429ceeab514007decf5a08208afcd391437acfcd

                                                    SHA256

                                                    6e5c2df4516c2cb5338585c1370c3ca10564c2fd3f2ac18a89c326573496862d

                                                    SHA512

                                                    86009ff5a4fdc9b7c8ae9f200e2cd4f3425ef2c6929127291c78327c510609d4151eda25df2582316cb7d85182efa117fd320b882ec8442a45497d22b3266c82

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\c64e1e23-0dce-484c-bf63-27c8669b281d
                                                    Filesize

                                                    734B

                                                    MD5

                                                    def4a20c90c70a48ee948ee5a766039d

                                                    SHA1

                                                    c9345e4d911c71e5270574e5ffbe16d05794c599

                                                    SHA256

                                                    adbbc20496f55288c355bc370cf2e4ad3daa45edb6d977f13f746a498f4a65da

                                                    SHA512

                                                    1d282ef953be64b012e3ea0fa7328204090f63e39a4440c37c9c1bdb2b55870efaeeca2dd6fab7476c138b44a9922a59e49d2f79fd5046a6736690f1f31630c9

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\f9ff8e00-5bdc-4b7d-b923-c4fdaa1ad9eb
                                                    Filesize

                                                    25KB

                                                    MD5

                                                    6419435d378793c41f0c6d2274b4191a

                                                    SHA1

                                                    0797e2a2fc52aa4ecae68dcdba8d0c0cce6fc293

                                                    SHA256

                                                    93d8fd3ce2836d6f6c472469cbfb492062b6209a511546d364f552852e47e676

                                                    SHA512

                                                    ad5e89aa9d28ce669048390d1fc92d2b0b3abd14fb17a3d57a745c2d727a4f13151271452ad6b1fc57b85746c573782234865e463605e933b8351bb057974415

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\fd87b586-6d35-46c8-94e1-3f687ed622d5
                                                    Filesize

                                                    2KB

                                                    MD5

                                                    9018c88419e87897f43110492dc65a04

                                                    SHA1

                                                    4c8e69eca1e2b82470f98a3453ac215e6272e252

                                                    SHA256

                                                    6d998e411d629e909fa0536a62d762918d446303a493c95a03555b06e3df5beb

                                                    SHA512

                                                    0c5d8fa0c4f10dcdeb294f6ee0913f42796882e92019e8bd1c8672befba8fe15c88d3470bef453797dc386166aaa504de54cc6d4f9b075c8329c68932b9342af

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                                    Filesize

                                                    1.1MB

                                                    MD5

                                                    842039753bf41fa5e11b3a1383061a87

                                                    SHA1

                                                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                    SHA256

                                                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                    SHA512

                                                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                                    Filesize

                                                    116B

                                                    MD5

                                                    2a461e9eb87fd1955cea740a3444ee7a

                                                    SHA1

                                                    b10755914c713f5a4677494dbe8a686ed458c3c5

                                                    SHA256

                                                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                    SHA512

                                                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs-1.js
                                                    Filesize

                                                    11KB

                                                    MD5

                                                    b4866c996073b80c514990bc1557d7bb

                                                    SHA1

                                                    09db8c39f3dba99808a2ea51b506d2dc46a74b80

                                                    SHA256

                                                    3ba3c83ab66faecc0f90c5ae64f7327c8785fdd14ede4ae0bb8bf6de699f46d1

                                                    SHA512

                                                    bb549d890d90a12330c5932c21421fb0a5f0688a818781c72fb4791144c1a8702db529f4493dc40acb6bcd87c25214c13eed66e98503452a03ca73909357e088

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs-1.js
                                                    Filesize

                                                    12KB

                                                    MD5

                                                    1861cca3e577e1e283ba964c9a7dfafe

                                                    SHA1

                                                    be98d79a2ae34ae80f3f9a3e396a3947fe2c52fe

                                                    SHA256

                                                    ac533f2da6ff6c510142d3f7c9985b389c1572478f903acd695684da9a9d56f3

                                                    SHA512

                                                    d91dde23a3b3cff778cdf82c8eb56396535def893d105950445881a7b7b846bf6949e1835b1d1793d7680169ee9aade4e801982acbda31d79b90ce89fd57ea80

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs-1.js
                                                    Filesize

                                                    12KB

                                                    MD5

                                                    62f77acd33dfe3022eb0a748fde5499c

                                                    SHA1

                                                    985ddc80732966074f96193af9dbe7c8c7bb813a

                                                    SHA256

                                                    28b581b63bb0a5479e5ffd0bb5f6ba5acf74bb3fe898a91eca8eb474a4ff9b61

                                                    SHA512

                                                    d0e7ba53de186f7d183da09505f0b3b0047315b6b2b2818e04b08138f377ee0ea145f9bc7b180876be9db82f2238488866cbb4634266c5f07276aeb7b90dc096

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs.js
                                                    Filesize

                                                    10KB

                                                    MD5

                                                    63e62f0a11ee11b3a500da3e4a03ccf1

                                                    SHA1

                                                    a1c1ca3e66a04545e5c2a25a3c635702cefa0ac7

                                                    SHA256

                                                    59ef6b272261ba1aed0f2c572231d0185481a289544ff5b617582d14d54707f7

                                                    SHA512

                                                    17d024320a9de65b44c92ad9e53a7d1896218c54d3a0cfa39e0c98ee22feeb7399db36c136fbde1b67becdf98f91ee8660bf8aa77f733d95a15046ca908b77a3

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionCheckpoints.json
                                                    Filesize

                                                    90B

                                                    MD5

                                                    c4ab2ee59ca41b6d6a6ea911f35bdc00

                                                    SHA1

                                                    5942cd6505fc8a9daba403b082067e1cdefdfbc4

                                                    SHA256

                                                    00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

                                                    SHA512

                                                    71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionCheckpoints.json
                                                    Filesize

                                                    53B

                                                    MD5

                                                    ea8b62857dfdbd3d0be7d7e4a954ec9a

                                                    SHA1

                                                    b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

                                                    SHA256

                                                    792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

                                                    SHA512

                                                    076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionstore-backups\recovery.baklz4
                                                    Filesize

                                                    4KB

                                                    MD5

                                                    cf4460d41eb07b24383f496ca6fbb1f6

                                                    SHA1

                                                    d4fe9ec3046dd369c0bde4e2106b590a7f5acff3

                                                    SHA256

                                                    80dec03c70ff4f7a4408ff71b3bf1357601a8d10b0bb837948fa35621114e8ff

                                                    SHA512

                                                    ad11ab3fa1f2ed41cab5ffc839225d6e79eefc22b13e26878f94f576f1c6907a695bb50ed5c26e316a559bf8dcbbf3f5fe9f6265582b7567ae92f8b249447cdb

                                                    Download Submit

                                                  • C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier
                                                    Filesize

                                                    147B

                                                    MD5

                                                    6fac30c6aeb8579559e615cab61c553e

                                                    SHA1

                                                    ccaac9d9a91496a2ff6d94272e67ccf853e5d6f8

                                                    SHA256

                                                    f3340a0498a1387b2e127b112d6c5301fc8701aa5ba7f0948e34b2875b277702

                                                    SHA512

                                                    10637368708137544065ef625c968ebcdfab6c4fbe63515eb5f40009a7fa45f596c46905d26442d43dc6419207fb73d8a3599e40cf41a2c755a068e724fe3103

                                                    Download Submit

                                                  • C:\Users\Admin\Downloads\SteamSetup.sjT4x_ux.exe.part
                                                    Filesize

                                                    2.3MB

                                                    MD5

                                                    1b54b70beef8eb240db31718e8f7eb5d

                                                    SHA1

                                                    da5995070737ec655824c92622333c489eb6bce4

                                                    SHA256

                                                    7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb

                                                    SHA512

                                                    fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb

                                                    Download Submit

                                                  • memory/488-1808-0x0000000005F70000-0x00000000062C7000-memory.dmp

                                                    Filesize

                                                    3.3MB

                                                    Download

                                                  • memory/2200-1715-0x0000000000400000-0x00000000006AD000-memory.dmp

                                                    Filesize

                                                    2.7MB

                                                    Download

                                                  • memory/2200-761-0x0000000000400000-0x00000000006AD000-memory.dmp

                                                    Filesize

                                                    2.7MB

                                                    Download

                                                  • memory/2200-424-0x0000000000400000-0x00000000006AD000-memory.dmp

                                                    Filesize

                                                    2.7MB

                                                    Download

                                                  • memory/2200-425-0x00000000741E0000-0x00000000741EF000-memory.dmp

                                                    Filesize

                                                    60KB

                                                    Download

                                                  • memory/2200-4114-0x00000000741E0000-0x00000000741EF000-memory.dmp

                                                    Filesize

                                                    60KB

                                                    Download

                                                  • memory/2200-4113-0x0000000000400000-0x00000000006AD000-memory.dmp

                                                    Filesize

                                                    2.7MB

                                                    Download

                                                  • memory/2200-426-0x0000000074000000-0x000000007400C000-memory.dmp

                                                    Filesize

                                                    48KB

                                                    Download

                                                  • memory/5208-2250-0x0000000006F10000-0x0000000006F44000-memory.dmp

                                                    Filesize

                                                    208KB

                                                    Download

                                                  • memory/5612-1834-0x0000000006500000-0x0000000006857000-memory.dmp

                                                    Filesize

                                                    3.3MB

                                                    Download

                                                  • memory/5688-1738-0x0000000004680000-0x00000000046B6000-memory.dmp

                                                    Filesize

                                                    216KB

                                                    Download

                                                  • memory/5688-1741-0x0000000004C70000-0x0000000004C92000-memory.dmp

                                                    Filesize

                                                    136KB

                                                    Download

                                                  • memory/5688-1742-0x0000000005550000-0x00000000055B6000-memory.dmp

                                                    Filesize

                                                    408KB

                                                    Download

                                                  • memory/5688-1752-0x0000000005630000-0x0000000005987000-memory.dmp

                                                    Filesize

                                                    3.3MB

                                                    Download

                                                  • memory/5688-1755-0x0000000006B90000-0x0000000006C26000-memory.dmp

                                                    Filesize

                                                    600KB

                                                    Download

                                                  • memory/5688-1753-0x0000000005AF0000-0x0000000005B0E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                    Download

                                                  • memory/5688-1761-0x0000000006B50000-0x0000000006B8D000-memory.dmp

                                                    Filesize

                                                    244KB

                                                    Download

                                                  • memory/5688-1760-0x0000000007E10000-0x000000000848A000-memory.dmp

                                                    Filesize

                                                    6.5MB

                                                    Download

                                                  • memory/5688-1758-0x00000000071E0000-0x0000000007786000-memory.dmp

                                                    Filesize

                                                    5.6MB

                                                    Download

                                                  • memory/5688-1757-0x0000000006050000-0x0000000006072000-memory.dmp

                                                    Filesize

                                                    136KB

                                                    Download

                                                  • memory/5688-1743-0x00000000055C0000-0x0000000005626000-memory.dmp

                                                    Filesize

                                                    408KB

                                                    Download

                                                  • memory/5688-1739-0x0000000004CF0000-0x000000000531A000-memory.dmp

                                                    Filesize

                                                    6.2MB

                                                    Download

                                                  • memory/5688-1756-0x0000000005FD0000-0x0000000005FEA000-memory.dmp

                                                    Filesize

                                                    104KB

                                                    Download

                                                  • memory/5688-1754-0x0000000005B30000-0x0000000005B7C000-memory.dmp

                                                    Filesize

                                                    304KB

                                                    Download

                                                  • memory/5812-2086-0x0000000005E50000-0x00000000061A7000-memory.dmp

                                                    Filesize

                                                    3.3MB

                                                    Download

                                                  • memory/5952-1772-0x00000000055B0000-0x0000000005907000-memory.dmp

                                                    Filesize

                                                    3.3MB

                                                    Download