Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-09-2024 16:01

General

  • Target

    file.exe

  • Size

    1.8MB

  • MD5

    c1e46f1401c04757c91547389beeeaf7

  • SHA1

    01d473dfb92775647b01d7259bfa946140b7db72

  • SHA256

    bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7

  • SHA512

    09b44d3701bff0cf1f3950ab02d56160ac7e3dc60afcc2cdd45d6dfd5ed8776a1650ddaeab4c7a77734387764194dd094bcf878efd682dd277eb0868c3909ea7

  • SSDEEP

    49152:lZCx/fLFnGNRednWQ0wOfHbgdwttgmsmhpXoJGxgTrzAQrBmZv:aHnGEW6OfbgWgK1WGyrMQrBmd

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

95.179.250.45:26212

Extracted

Family

redline

Botnet

@LOGSCLOUDYT_BOT

C2

65.21.18.51:45580

Extracted

Family

stealc

Botnet

default2

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

stealc

Botnet

default

C2

http://91.202.233.158

Attributes
  • url_path

    /e96ea2db21fa9a1b.php

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

C2

89.105.223.196:29862

Extracted

Family

stealc

Botnet

save

C2

http://185.215.113.37

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

redline

Botnet

newbundle2

C2

185.215.113.67:15206

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

cryptbot

C2

fivevh5vt.top

analforeverlovyu.top

Attributes
  • url_path

    /v1/upload.php

Extracted

Family

amadey

Version

4.41

Botnet

1176f2

C2

http://185.215.113.19

Attributes
  • install_dir

    417fd29867

  • install_file

    ednfoki.exe

  • strings_key

    183201dc3defc4394182b4bff63c4065

  • url_paths

    /CoreOPT/index.php

rc4.plain

Extracted

Family

lumma

C2

https://racedsuitreow.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Detects ZharkBot payload 2 IoCs

    ZharkBot is a botnet written C++.

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • ZharkBot

    ZharkBot is a botnet written C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 20 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 35 IoCs
  • Identifies Wine through registry keys 2 TTPs 10 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 12 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 7 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Detects Pyinstaller 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 47 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3596
      • C:\Users\Admin\AppData\Local\Temp\file.exe
        "C:\Users\Admin\AppData\Local\Temp\file.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1496
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5116
          • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
            "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4744
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              • Suspicious use of AdjustPrivilegeToken
              PID:1448
          • C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
            "C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2840
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:452
              • C:\Users\Admin\AppData\Roaming\IB6Z0Aw5fa.exe
                "C:\Users\Admin\AppData\Roaming\IB6Z0Aw5fa.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:3204
              • C:\Users\Admin\AppData\Roaming\FZWfYiuujT.exe
                "C:\Users\Admin\AppData\Roaming\FZWfYiuujT.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:2084
          • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
            "C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4732
            • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
              "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3332
          • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
            "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            PID:2320
          • C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
            "C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2260
            • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
              C:\Users\Admin\AppData\Local\Temp\svchost015.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5024
          • C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
            "C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4268
          • C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe
            "C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe"
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:1920
          • C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe
            "C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3992
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
              5⤵
                PID:2216
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 412
                  6⤵
                  • Program crash
                  PID:2328
            • C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe
              "C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe"
              4⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2344
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1264
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  6⤵
                  • Enumerates processes with tasklist
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1516
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /I "wrsa opssvc"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:3348
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  6⤵
                  • Enumerates processes with tasklist
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2916
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:4640
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c md 607698
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:3708
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /V "MaskBathroomCompositionInjection" Participants
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:4216
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:1960
                • C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
                  Waters.pif Q
                  6⤵
                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:3628
                • C:\Windows\SysWOW64\choice.exe
                  choice /d y /t 5
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:1012
            • C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
              "C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:1396
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:4384
            • C:\Users\Admin\AppData\Local\Temp\1000308001\5ce66b4209.exe
              "C:\Users\Admin\AppData\Local\Temp\1000308001\5ce66b4209.exe"
              4⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              PID:2924
            • C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe
              "C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4600
            • C:\Users\Admin\AppData\Local\Temp\1000318001\66ed86be077bb_12.exe
              "C:\Users\Admin\AppData\Local\Temp\1000318001\66ed86be077bb_12.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3124
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                5⤵
                  PID:4640
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2400
              • C:\Users\Admin\AppData\Local\Temp\1000321001\2.exe
                "C:\Users\Admin\AppData\Local\Temp\1000321001\2.exe"
                4⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                PID:2652
                • C:\Users\Admin\AppData\Local\Temp\service123.exe
                  "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:2892
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:5804
              • C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
                "C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:224
              • C:\Users\Admin\AppData\Local\Temp\1000340001\Blenar.exe
                "C:\Users\Admin\AppData\Local\Temp\1000340001\Blenar.exe"
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1372
                • C:\Users\Admin\AppData\Local\Temp\1000340001\Blenar.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000340001\Blenar.exe"
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:3844
              • C:\Users\Admin\AppData\Roaming\1000341000\22268a6107.exe
                "C:\Users\Admin\AppData\Roaming\1000341000\22268a6107.exe"
                4⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Checks computer location settings
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                PID:1336
                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
                  5⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Adds Run key to start application
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:2544
                  • C:\Users\Admin\AppData\Local\Temp\1000002001\57677cb8e3.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000002001\57677cb8e3.exe"
                    6⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    PID:2432
                  • C:\Users\Admin\1000015002\de5bc11dbf.exe
                    "C:\Users\Admin\1000015002\de5bc11dbf.exe"
                    6⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    PID:4960
                  • C:\Users\Admin\AppData\Local\Temp\1000019101\a31758881b.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000019101\a31758881b.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:2248
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
                      7⤵
                        PID:2132
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
                          8⤵
                          • Checks processor information in registry
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          • Suspicious use of SetWindowsHookEx
                          PID:1960
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23602 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e53d9ad-e968-44f1-ae9c-f779bb69c6f6} 1960 "\\.\pipe\gecko-crash-server-pipe.1960" gpu
                            9⤵
                              PID:2836
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2432 -prefMapHandle 2428 -prefsLen 24522 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f56941e6-b635-4177-9f42-6a30084fe8e7} 1960 "\\.\pipe\gecko-crash-server-pipe.1960" socket
                              9⤵
                                PID:3916
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3012 -childID 1 -isForBrowser -prefsHandle 3016 -prefMapHandle 3056 -prefsLen 22590 -prefMapSize 244628 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3db44d4-940c-4330-ab61-82c02af11d52} 1960 "\\.\pipe\gecko-crash-server-pipe.1960" tab
                                9⤵
                                  PID:2288
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3892 -childID 2 -isForBrowser -prefsHandle 2724 -prefMapHandle 3880 -prefsLen 29012 -prefMapSize 244628 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {46351e71-6f29-4b26-91f1-f705a956349b} 1960 "\\.\pipe\gecko-crash-server-pipe.1960" tab
                                  9⤵
                                    PID:2772
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4484 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4528 -prefMapHandle 4524 -prefsLen 29012 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7459f58c-2099-4d54-bdfb-f3b06ba1e07d} 1960 "\\.\pipe\gecko-crash-server-pipe.1960" utility
                                    9⤵
                                    • Checks processor information in registry
                                    PID:5644
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5112 -childID 3 -isForBrowser -prefsHandle 5072 -prefMapHandle 5076 -prefsLen 26882 -prefMapSize 244628 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b49d844-472c-4193-93b5-cd347a26fd92} 1960 "\\.\pipe\gecko-crash-server-pipe.1960" tab
                                    9⤵
                                      PID:5188
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5332 -childID 4 -isForBrowser -prefsHandle 5232 -prefMapHandle 5256 -prefsLen 26882 -prefMapSize 244628 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3ef8014-8576-4143-9c41-bb4b24f8a6b7} 1960 "\\.\pipe\gecko-crash-server-pipe.1960" tab
                                      9⤵
                                        PID:5232
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5468 -childID 5 -isForBrowser -prefsHandle 5476 -prefMapHandle 5480 -prefsLen 26882 -prefMapSize 244628 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b64c33b-2c8a-4204-b4d6-47d531adce93} 1960 "\\.\pipe\gecko-crash-server-pipe.1960" tab
                                        9⤵
                                          PID:5244
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
                            2⤵
                            • System Location Discovery: System Language Discovery
                            PID:1704
                            • C:\Windows\SysWOW64\schtasks.exe
                              schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Scheduled Task/Job: Scheduled Task
                              PID:3916
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & echo URL="C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & exit
                            2⤵
                            • Drops startup file
                            • System Location Discovery: System Language Discovery
                            PID:1092
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4080,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
                          1⤵
                            PID:4704
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=2968,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
                            1⤵
                              PID:660
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2216 -ip 2216
                              1⤵
                                PID:2512
                              • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                1⤵
                                • Executes dropped EXE
                                PID:3588
                              • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:3832
                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:3264
                              • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                1⤵
                                • Executes dropped EXE
                                PID:4164
                              • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:528
                              • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                1⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:5468

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\ProgramData\mozglue.dll

                                Filesize

                                593KB

                                MD5

                                c8fd9be83bc728cc04beffafc2907fe9

                                SHA1

                                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                SHA256

                                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                SHA512

                                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                              • C:\ProgramData\nss3.dll

                                Filesize

                                2.0MB

                                MD5

                                1cc453cdf74f31e4d913ff9c10acdde2

                                SHA1

                                6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                SHA256

                                ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                SHA512

                                dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

                                Filesize

                                2KB

                                MD5

                                e34b053c93dcb4160094249280888117

                                SHA1

                                bd7cd93042c200c5fb012bccf3cd9f72d7e79cef

                                SHA256

                                2bc71ddd63acfb9d101892e29033c75b4023727e1cadc489ecb2421c1960eaa8

                                SHA512

                                f8753ec3f9f413e1fac84caa1905509a978dfc63211dcd0a889a4283840ae2e6e9101e1f7ee7d582acc5e0ae722fdab8f6047aa02cee28869a094b4f494897f2

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

                                Filesize

                                2B

                                MD5

                                d751713988987e9331980363e24189ce

                                SHA1

                                97d170e1550eee4afc0af065b78cda302a97674c

                                SHA256

                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                SHA512

                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmd08l7e.default-release\cache2\entries\22386449CA13D8975B935875780066C6EF52CE37

                                Filesize

                                13KB

                                MD5

                                8a9a4de8a4b099ed50c9af02052ae739

                                SHA1

                                6f4ca8bd4850af921bca6a3e85ad1f528c0162c9

                                SHA256

                                4ba43844ce4d5fd9bcf7a90a289c8d8ebd4f98a9d9eaa8d67dcb6dea816ffc79

                                SHA512

                                c7ade497431b96db16bfb4321909725b49d932b5d55042dbd03022153ab0b49f276e52a8987ff5f1c7c070fa23c7c805a9689bf5f66dc6ef487b96dd6caac77a

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmd08l7e.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                                Filesize

                                7KB

                                MD5

                                c460716b62456449360b23cf5663f275

                                SHA1

                                06573a83d88286153066bae7062cc9300e567d92

                                SHA256

                                0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0

                                SHA512

                                476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30

                              • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

                                Filesize

                                312KB

                                MD5

                                389881b424cf4d7ec66de13f01c7232a

                                SHA1

                                d3bc5a793c1b8910e1ecc762b69b3866e4c5ba78

                                SHA256

                                9d1211b3869ca43840b7da1677b257ad37521aab47719c6fcfe343121760b746

                                SHA512

                                2b9517d5d9d972e8754a08863a29e3d3e3cfde58e20d433c85546c2298aad50ac8b069cafd5abb3c86e24263d662c6e1ea23c0745a2668dfd215ddbdfbd1ab96

                              • C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe

                                Filesize

                                1.1MB

                                MD5

                                6c9e7815208530b2574368f8a70e5790

                                SHA1

                                61d5d998abbbfe9c6efd9d38b8c99a3b48f8a7de

                                SHA256

                                c0f8b5afad6fab4136affd308519c36e3779d597413d00e79e7f939bd7bae782

                                SHA512

                                013b6ce1104d05cdd4587197c4e177ef13409db9c81084551450674833d3876a050035a4545a647a257538a2cb44aafaada534c9bfe8e2b5bcf6a9f2dcff134d

                              • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

                                Filesize

                                416KB

                                MD5

                                f5d7b79ee6b6da6b50e536030bcc3b59

                                SHA1

                                751b555a8eede96d55395290f60adc43b28ba5e2

                                SHA256

                                2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

                                SHA512

                                532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

                              • C:\Users\Admin\AppData\Local\Temp\1000019101\a31758881b.exe

                                Filesize

                                900KB

                                MD5

                                5f5bc442ea1800f78d91bae0b11532fd

                                SHA1

                                1241f25a7c7324183742d964b349f5ebbb5324cf

                                SHA256

                                b1b33f8b0819298f102db9ec8ffd1b76a6ee3528331c1924ba408e2f3ffeecad

                                SHA512

                                0429d7e2d9d76435411b3f426063694ec7823bd704285a1d740bdfe23099379c7b4642b3cff78586092b54ceb00cf4b18e13baf414255390b14265077302a329

                              • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

                                Filesize

                                187KB

                                MD5

                                7a02aa17200aeac25a375f290a4b4c95

                                SHA1

                                7cc94ca64268a9a9451fb6b682be42374afc22fd

                                SHA256

                                836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e

                                SHA512

                                f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

                              • C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

                                Filesize

                                4.1MB

                                MD5

                                7fa5c660d124162c405984d14042506f

                                SHA1

                                69f0dff06ff1911b97a2a0aa4ca9046b722c6b2f

                                SHA256

                                fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2

                                SHA512

                                d50848adbfe75f509414acc97096dad191ae4cef54752bdddcb227ffc0f59bfd2770561e7b3c2a14f4a1423215f05847206ad5c242c7fd5b0655edf513b22f6c

                              • C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

                                Filesize

                                494KB

                                MD5

                                6760374f17416485fa941b354d3dd800

                                SHA1

                                d88389ec19ac3e87bc743ba3f8b7c518601fdbf9

                                SHA256

                                9dc31fbd03da881700908423eb50c6b0c42c87fec28e817449d3dd931802c9f5

                                SHA512

                                6e4d2f17cb93fe831198c2eaa35bf030d6a06d620645d3e1452c6bd6e77e42baa9dc323fd60a2c5ae1d89124adde69972c489739d4bd73ba01b95b829a777eab

                              • C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe

                                Filesize

                                454KB

                                MD5

                                37d198ad751d31a71acc9cb28ed0c64e

                                SHA1

                                8eb519b7a6df66d84c566605da9a0946717a921d

                                SHA256

                                1ed4a8b4c74aab435ea5cd459d5ac961e5a8ca28924801bd84d336135f30efde

                                SHA512

                                60923c0a8ce5fd397d49749ccee68ca3fe294d7323551ce9755410ac16bfff56a35bee3e6b9a67d57cdfcb43e4f164712f33cd255b76689174dcf4c475976c96

                              • C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe

                                Filesize

                                673KB

                                MD5

                                b859d1252109669c1a82b235aaf40932

                                SHA1

                                b16ea90025a7d0fad9196aa09d1091244af37474

                                SHA256

                                083d9bc8566b22e67b553f9e0b2f3bf6fe292220665dcc2fc10942cdc192125c

                                SHA512

                                9c0006055afd089ef2acbb253628494dd8c29bab9d5333816be8404f875c85ac342df82ae339173f853d3ebdb2261e59841352f78f6b4bd3bff3d0d606f30655

                              • C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe

                                Filesize

                                1.3MB

                                MD5

                                2b01c9b0c69f13da5ee7889a4b17c45e

                                SHA1

                                27f0c1ae0ddeddc9efac38bc473476b103fef043

                                SHA256

                                d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29

                                SHA512

                                23d4a0fc82b70cd2454a1be3d9b84b8ce7dd00ad7c3e8ad2b771b1b7cbca752c53feec5a3ac5a81d8384a9fc6583f63cc39f1ebe7de04d3d9b08be53641ec455

                              • C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe

                                Filesize

                                314KB

                                MD5

                                ff5afed0a8b802d74af1c1422c720446

                                SHA1

                                7135acfa641a873cb0c4c37afc49266bfeec91d8

                                SHA256

                                17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10

                                SHA512

                                11724d26e11b3146e0fc947c06c59c004c015de0afea24ec28a4eb8145fcd51e9b70007e17621c83f406d9aeb7cd96601245671d41c3fcc88a27c33bd7cf55ac

                              • C:\Users\Admin\AppData\Local\Temp\1000308001\5ce66b4209.exe

                                Filesize

                                1.7MB

                                MD5

                                fcb880e354cdb48b5d2bf9c6c1f1e850

                                SHA1

                                396963052c5e8ad636794d2eab0336f08a3397be

                                SHA256

                                63024f0cd841c5d20ee8461e079cc3985a55ee276af284dd9e189fb06e60cef9

                                SHA512

                                47c8624dbc36ade2f0a9d00deb054437edb04fcab40aa00b815e5cb497b64bc029e6013fa7855ba4b2036962eeb3df65c83ffef377d86feac3e60dfeeeb3ff93

                              • C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe

                                Filesize

                                352KB

                                MD5

                                2f1d09f64218fffe7243a8b44345b27e

                                SHA1

                                72553e1b3a759c17f54e7b568f39b3f8f1b1cdbe

                                SHA256

                                4a553c39728410eb0ebd5e530fc47ef1bdf4b11848a69889e8301974fc26cde2

                                SHA512

                                5871e2925ca8375f3c3ce368c05eb67796e1fbec80649d3cc9c39b57ee33f46476d38d3ea8335e2f5518c79f27411a568209f9f6ef38a56650c7436bbaa3f909

                              • C:\Users\Admin\AppData\Local\Temp\1000318001\66ed86be077bb_12.exe

                                Filesize

                                10.3MB

                                MD5

                                489f9c4fc0afa8d1be37bc5e2f57833b

                                SHA1

                                c2bac602a73c19b345b64e0b7cf2f837be307b61

                                SHA256

                                d9dbfbc8294cbf6a32d43413ed328594ee058d7356c26eb5cd196f9f4867c078

                                SHA512

                                7f43d972f58a025d09143c57351221fe7b10c1756a0c5578ac42698c21ea05986d4bbc0c7ff4be339c2d0930b505e4f4dda53c0800d84b059a21be938adb678e

                              • C:\Users\Admin\AppData\Local\Temp\1000321001\2.exe

                                Filesize

                                6.3MB

                                MD5

                                d09d52b00ae2fd3ea3135aa31d7cb323

                                SHA1

                                40c053b5a7f8e6e3c78895382662cf2556e3b2ea

                                SHA256

                                fcfb14707aa5abe3cf84d6059717246e6593cd43d60c609fe3095825827637c7

                                SHA512

                                1a126471a5972babceebd66008dc136e098b37a64a25521c8213887daf6a7cf3ece3058286c68e3ebec85a40b5a3e53a84e243381ffef4283941c70fc814f6a4

                              • C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe

                                Filesize

                                304KB

                                MD5

                                58e8b2eb19704c5a59350d4ff92e5ab6

                                SHA1

                                171fc96dda05e7d275ec42840746258217d9caf0

                                SHA256

                                07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834

                                SHA512

                                e7655762c5f2d10ec246d11f82d437a2717ad05be847b5e0fd055e3241caaca85430f424055b343e3a44c90d76a0ba07a6913c2208f374f59b61f8aa4477889f

                              • C:\Users\Admin\AppData\Local\Temp\1000340001\Blenar.exe

                                Filesize

                                5.2MB

                                MD5

                                e277dbb7afa4631d4abcef9183671836

                                SHA1

                                71ef01646fa13b0a49550283d5be12539526c724

                                SHA256

                                3a72e66e73b857a6e2e004cfa4e6ef4efa872aedf7941e94637bf74b5591deb3

                                SHA512

                                e9de17db72ef4db18615e411823a2d6a3bb8ab870b508defcca8045f75c1d89f52ef7f3a9b1bc957dad1311ef0bfb2f1a0d411f82fa3f596f1fefb6b48f8b770

                              • C:\Users\Admin\AppData\Local\Temp\170637797568

                                Filesize

                                16KB

                                MD5

                                2dc97cb882513dca615e7481305b5fe7

                                SHA1

                                18eb978224d56cc68489c85c367ac8ba00e31f9a

                                SHA256

                                b63f402268f24e0759aecfa2d6339a304cbfc81f93cb9f6d226e7f57d169e051

                                SHA512

                                d4548f7180017aa46c83819303a8d26adc01a9154fb1a1f8f624469cb692b93f63f77b3b9dc863dff743b6ab6583069f806568bc6bd560f1ada2452717d3bc5f

                              • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

                                Filesize

                                1.8MB

                                MD5

                                c1e46f1401c04757c91547389beeeaf7

                                SHA1

                                01d473dfb92775647b01d7259bfa946140b7db72

                                SHA256

                                bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7

                                SHA512

                                09b44d3701bff0cf1f3950ab02d56160ac7e3dc60afcc2cdd45d6dfd5ed8776a1650ddaeab4c7a77734387764194dd094bcf878efd682dd277eb0868c3909ea7

                              • C:\Users\Admin\AppData\Local\Temp\607698\Q

                                Filesize

                                794KB

                                MD5

                                7b5632dcd418bcbae2a9009dbaf85f37

                                SHA1

                                32aaf06166854718f0bcbb2f7173c2732cfb4d33

                                SHA256

                                361e9c3b62719b79bc280420b5f710e160fd55f2250bf605911ded7162483db4

                                SHA512

                                c834e90ccf2d35529c294319b8e9a49db7a7d67d0567e0739131d5af51170db32076d68147dc101f8047a75cb5b2275b25a9c8346a99a146a6798b9764316838

                              • C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif

                                Filesize

                                872KB

                                MD5

                                18ce19b57f43ce0a5af149c96aecc685

                                SHA1

                                1bd5ca29fc35fc8ac346f23b155337c5b28bbc36

                                SHA256

                                d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd

                                SHA512

                                a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

                              • C:\Users\Admin\AppData\Local\Temp\Asbestos

                                Filesize

                                60KB

                                MD5

                                19121d99734080f4fdd9ca3008168360

                                SHA1

                                b00acbdd3fa952df781ca9ad5c86ded9f2d51ec6

                                SHA256

                                37576e4b3a1e0004b4cf7da625b865a62d895411ed157c538f5f4cd3aa6fab7a

                                SHA512

                                e2e863d19e2f560c1deb018c3c2748be170b11fcb520ed7e7ea20727646bcacb0b5c3ed04e856943c67e51f5083c90aa3dd1f8794a83901a203c8bac4fa51c92

                              • C:\Users\Admin\AppData\Local\Temp\Ashley

                                Filesize

                                52KB

                                MD5

                                e522956891659c41bd8550b8d5e16231

                                SHA1

                                4380c8a0c30db1532728cdb72707f9f1847cc87d

                                SHA256

                                ddb7f60ab5f8957955dd20f2dc270e3ef833d3727f374a8c4c444634bd05609d

                                SHA512

                                35c81ef1a2c040dbd52cad9f38fda43d8836d955b62e478ae941a4ba67d297dc1c4b40d6b30959c5d2f784d5cb0d19c795307906d52ad0e7eb72bd0e4235172f

                              • C:\Users\Admin\AppData\Local\Temp\Bet

                                Filesize

                                55KB

                                MD5

                                0f3f07b667e947c4da38813d6d651e2a

                                SHA1

                                692622d5e5705f8f65db96f70d8c7c2f7fd5a640

                                SHA256

                                32b3d9d5bc58659ea524aa2cabd9cfc81b73e679e3d2cc899dfb00439612f5ff

                                SHA512

                                449ab13dd860b08570c589dc24e468dd880434c3be774ba4f078d8f116d710326fc546de621dce8a27e134f70f651d44642ec0ece37375332a7d7725e9ddcf9c

                              • C:\Users\Admin\AppData\Local\Temp\Emotions

                                Filesize

                                19KB

                                MD5

                                b98d78c3abe777a5474a60e970a674ad

                                SHA1

                                079e438485e46aff758e2dff4356fdd2c7575d78

                                SHA256

                                2bc28afb291ece550a7cd2d0c5c060730eb1981d1cf122558d6971526c637eb4

                                SHA512

                                6218413866237bc1f6eada6554658a00c9fc55402e104576b33a2e8d4adf0fd952d8cc8d1ae3a02ebcfa030115fc388fc1a6f23b9d372f808e11e1b551064e5d

                              • C:\Users\Admin\AppData\Local\Temp\Ensures

                                Filesize

                                75KB

                                MD5

                                c6fa82d60cfbf9e83b4cf3cbd1f01552

                                SHA1

                                a310c3577c5e439aa306a0a5dae2c75ea39c126e

                                SHA256

                                2686b284d1c21d06ab10829c16657334e13428210ccda89f68bfb8acbfc72b42

                                SHA512

                                e35a67a63fac7db37431bc0ab910a9c33a41e5a910ae79181a74aaf13ed23d65ef500a9e5a482e749cd9666c146d8403f83c6be2d9aa013d6d7c6bc0f07fac9c

                              • C:\Users\Admin\AppData\Local\Temp\Fla

                                Filesize

                                82KB

                                MD5

                                e139e52f93ae3e19ab47f437cbe8b3de

                                SHA1

                                2d5b56c3c0a454fefbf7c7a466ad000c05258bd6

                                SHA256

                                e0c1c46fa4582a3826f7aed2f7fb454d3ee42a425f214321910c25cc1d8879d5

                                SHA512

                                4feba8bf6916c979fa45e16a368f22a165985e1dfd75697fd7a7534f5e64afe438206074b2f8aa884d5666e80c55544c62d5cc48f8429e7c843c01d1af060878

                              • C:\Users\Admin\AppData\Local\Temp\Language

                                Filesize

                                72KB

                                MD5

                                5de7106df85e2f96f46f642d98433ad1

                                SHA1

                                f77a8182904a897a8d41858c6f5b87c3e8b21195

                                SHA256

                                9201319c9c07e4312717845e59c9fe3a987f70575cd63e4c042db778ebe4d5e9

                                SHA512

                                7c4b04d513e80873ea3030162702e5eff8ea17b44844ba2809805f92c6a7d6ed396ef660b78e274334448f31c447f26212c6779e801f330611d6a01f04449047

                              • C:\Users\Admin\AppData\Local\Temp\Navy

                                Filesize

                                56KB

                                MD5

                                d4eb107cfd9fc38ed7e7b253562e155a

                                SHA1

                                7fc17c27c9f4739c19211600398bf1ee9df84dc5

                                SHA256

                                68e9a8d57ba2a484dd28a1afed5262a86aff4d81467b93b4072f329fab984f4c

                                SHA512

                                3a95c48e7a61239cbaa857459a6a106536dfd8190205275e2549a9939116833141276dd5b6c81ff337d2340eedba633d9ca01a03fb490eb27184becc97626e0f

                              • C:\Users\Admin\AppData\Local\Temp\Participants

                                Filesize

                                2KB

                                MD5

                                f0e725addf4ec15a56aa0bde5bd8b2a7

                                SHA1

                                1f54a49195d3f7fd93c5fec06cc5904c57995147

                                SHA256

                                7cbd6810cb4dd516eeb75df79d1db55f74471c11594333ac225f24bfc0fca7ca

                                SHA512

                                00f14e435e0f8396f6c94fd5ace3f3645e87511b9e41e8c7c7caadb751ed826f60362ac007c80e9c3bd16f8f31b3a9107cbb39bf5c26d20a0ab5129e695f5269

                              • C:\Users\Admin\AppData\Local\Temp\Rick

                                Filesize

                                869KB

                                MD5

                                e0d37e7b879f4b4e0dde5006da5009bd

                                SHA1

                                33d19bdb8a0ae45a38ab6899381ca8bc1ea7c1a5

                                SHA256

                                27014daa44b8b92e1684970350c43bb1701d3a592572e650e1e00be1470e5f77

                                SHA512

                                68b2f357b3f02f3181df095ddc6fe8ff1810a150e832c245e428f973a096301b1d13fce00ad28af662c4aea371f872d56348fe7b5d2070ed3f1c49388efd3f60

                              • C:\Users\Admin\AppData\Local\Temp\Streaming

                                Filesize

                                97KB

                                MD5

                                1501de696d22f872db44b548cba0e4fa

                                SHA1

                                ed8a2948aaf041bfd0196a180f5888bdddcb9879

                                SHA256

                                dcf4784ea71a3e1a42318c09183d4b5981009d296814d3679ca68eb0a7c9e2ef

                                SHA512

                                fa931ce9f6ab6928cec1c999f1aa6082bd7c5c74eff317fc6b1bd0d9f88de2753e157ebd4d6a2719c5861f7fdc12bcde5859945633c1a2b8e0967684771f84bc

                              • C:\Users\Admin\AppData\Local\Temp\Temperature

                                Filesize

                                89KB

                                MD5

                                249d56cbe275c2258ccd964f0c6241d9

                                SHA1

                                8ac982fe39012b8812ed9dcf16e8e00c9a74b0bc

                                SHA256

                                7c16e21e29d442bf0b459d083198b22ee9c6d9926e3aa61f43dc3a1ee3ecb731

                                SHA512

                                440d7ff539e737e4e3b74549be7495d0f3b3230888355bc93eeca8084c80f255d988839ef455b4f6841fbaa64aabfdef9233130663aa3c24f711d01edb8e6be8

                              • C:\Users\Admin\AppData\Local\Temp\Tmp726C.tmp

                                Filesize

                                2KB

                                MD5

                                1420d30f964eac2c85b2ccfe968eebce

                                SHA1

                                bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                SHA256

                                f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                SHA512

                                6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                              • C:\Users\Admin\AppData\Local\Temp\Viruses

                                Filesize

                                89KB

                                MD5

                                7c9dd6f9fa719321b72805df762a82da

                                SHA1

                                64b135116d963e47848e29a002a3207bc01ab2c0

                                SHA256

                                98232a6528beb079d8fa9d77751722159d4974e6859df867efb3ba7a3eec4bec

                                SHA512

                                480d16e0d1e5021b9042378df235323324fc8341461e59d117471aa0da07fe8ef6367d0e14479b4bbb854f29d1f092ba3e9776fa2bf56b34ab73f5a858e6b3d0

                              • C:\Users\Admin\AppData\Local\Temp\Width

                                Filesize

                                67KB

                                MD5

                                12d9ad507c856d833101c9e367466555

                                SHA1

                                b6398b345226279cfab1559bf3847e3d9526dcff

                                SHA256

                                8e7415ed2d0d5c6e69d6a02bc3928c9adf685a43932e4543084b917946361974

                                SHA512

                                0ba3913d4a3ca266f0812263245a25caa0bbd9b81766992c8dc05466d9cd86cb79843c53c29bb26c005ef15c0f90ab97978209038181501135a7b27fb5b34d62

                              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe

                                Filesize

                                2.9MB

                                MD5

                                b826dd92d78ea2526e465a34324ebeea

                                SHA1

                                bf8a0093acfd2eb93c102e1a5745fb080575372e

                                SHA256

                                7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

                                SHA512

                                1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

                              • C:\Users\Admin\AppData\Local\Temp\tmp97A8.tmp

                                Filesize

                                56KB

                                MD5

                                7872fbf0a1bb518682babda3d8dc7b4e

                                SHA1

                                9714d4f9f7e7c3b9a99f656b88b3a10cbd9c65e4

                                SHA256

                                a821fa964b5c5273f0e4696e98815f07113c85436cc468f41f39722e7d2767c2

                                SHA512

                                f91bb32e1675f822af53ebc91dc5764625b13bc2e365dcf795e1132525857e5d43a18b2f53b4bb70722aef7a0eafd5b3e4d1805f8567d325d34ae41c281832c0

                              • C:\Users\Admin\AppData\Local\Temp\tmp97E9.tmp

                                Filesize

                                232KB

                                MD5

                                3d04081f6ad600307660003ea6d2728f

                                SHA1

                                fa29a177d8dd978414b1222a0e265caecc125773

                                SHA256

                                3b85617381d7a468f717844747ae200fc96feca36eccd7dd16a04b2306852ac4

                                SHA512

                                e376aeb19f117f49ef79714651b79fceb090c1b283699d62fced3b8c857470928ee43ebc8dd7115eecd1d3745428bcf96eafa36040707a6dd0070ca8b0f71857

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                Filesize

                                479KB

                                MD5

                                09372174e83dbbf696ee732fd2e875bb

                                SHA1

                                ba360186ba650a769f9303f48b7200fb5eaccee1

                                SHA256

                                c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                SHA512

                                b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                Filesize

                                13.8MB

                                MD5

                                0a8747a2ac9ac08ae9508f36c6d75692

                                SHA1

                                b287a96fd6cc12433adb42193dfe06111c38eaf0

                                SHA256

                                32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                SHA512

                                59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                              • C:\Users\Admin\AppData\Roaming\1000341000\22268a6107.exe

                                Filesize

                                1.8MB

                                MD5

                                0b7a487b6b6b37b35715c0e7ca2e8fc7

                                SHA1

                                5d8335795289387282d8da03fd77ddfc878474ea

                                SHA256

                                61d99341bf7f380109f40b3a1e2c2f67fcb4e400964364225a7c4a512965b06a

                                SHA512

                                18a35470e0b2870cb00dfc5aeb37038a43cd83f409df546ae4843b483afd0179e65dbc6ef583e8017c01b1419aeb6141ab3cb17e230541f3e6010774ea5d7958

                              • C:\Users\Admin\AppData\Roaming\FZWfYiuujT.exe

                                Filesize

                                304KB

                                MD5

                                12f13e368d8f8a329c94302ca0bd5d8a

                                SHA1

                                17fdaeb0122b61c702ec7a4c809fc26ca4cb73bf

                                SHA256

                                570aaaf62baff05ca992f53356044c86f85f46014451b85f8306915fef498a24

                                SHA512

                                031c116d0fe92912363eb7e580dea59504d4de5ac4fc51a1cf8d85393585c0acc712256142a88d33ebdf5b616068ca02066806cea6f4c0072a50f0b0144440da

                              • C:\Users\Admin\AppData\Roaming\IB6Z0Aw5fa.exe

                                Filesize

                                563KB

                                MD5

                                7909fbb384c65c469c877dda84add34c

                                SHA1

                                3280b2d39ccd8b669e95e971652ef6578136e377

                                SHA256

                                402b94a9f6fbbf5822c2f8c60f0dcb373cdeb9508b4730de6bdccbb6a52ba8ee

                                SHA512

                                a003ecaf93f5343275c8baa75d420266825a8cde7bf3ec8b3ae6ab2ff60c619a9d9dad20256c717ed8a5d925c8c16f31a63ac9c4edc01689a3584ce04810b788

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2170637797-568393320-3232933035-1000\76b53b3ec448f7ccdda2063b15d2bfc3_76278eb0-9988-43b4-9423-af5897ebbcb4

                                Filesize

                                2KB

                                MD5

                                4340ddbf9a210065c1f94642182471b3

                                SHA1

                                f24e312c8c8836fc8b5ff42406b2123fe86e4962

                                SHA256

                                772daf5f723e72c1321891c3b85883bc3a2cc5e5f7938c785247687f5b42ed7d

                                SHA512

                                ede0c6001690c7cb42cd8e41176e21469b5909d960f8e421e34237eba176701dca0be4f389e80b5fd7b95997f2df6b27046860e4ed7c28899d9e5b1148c174b0

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\AlternateServices.bin

                                Filesize

                                7KB

                                MD5

                                36a04fb03844674c69f80f4deb7e5fbd

                                SHA1

                                85fd968dbcd11a57210a61bb92747ffde0577aab

                                SHA256

                                0e710c55031c334cb7edc88e5a776b194636c99a99c6d1349da56453eac9f9ac

                                SHA512

                                0a715209114cb6957b378a27f28f082270d20e25f7390b5d4723c19947fd88b73d47d1d3a272b336233f23e90645eb7b10bc23f5c4cfecafac1f7c4a2dce4396

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\AlternateServices.bin

                                Filesize

                                12KB

                                MD5

                                80251a069e1b064a15e7677a0f3bac56

                                SHA1

                                9b11193bdbaeb640f3d7d510af6300f4be99cc99

                                SHA256

                                25a2967b6c598e674f012876bd558ddf3ff528691f2192cfcb6cd9aa490fd4ea

                                SHA512

                                40bde28a09c6340c623ff695636eccdddbcd8fc33b15df7fbbe575968432fa78db24aa9f04468a49d907490c076e27f6600a0d3c014c350208b465ea1c6273e3

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\AlternateServices.bin

                                Filesize

                                17KB

                                MD5

                                b19ba01de98132813a9ea5ae18afb57f

                                SHA1

                                e580615efacfa6edbd5ae1b1e4448959095f17ed

                                SHA256

                                cde20317fe42d871fe2b32974fca073fec2a0d6fdaaa8c582775544d1bb915fc

                                SHA512

                                e7ad2e27fd748a543094f30a604736cc4ce3d7f615208778036a471124d8e0c22a4f99a494fdaee04238737291d27b7f641ac7cbacbb7b6d6782f217ba1cfe71

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\AlternateServices.bin

                                Filesize

                                6KB

                                MD5

                                30b845a5e18d4a5aa59c6f71acf0a21d

                                SHA1

                                2d08ba1e646464f807fbda38b990eba9fbf62ee0

                                SHA256

                                60f969fceaf4032bd76ebdc5f2e3a179e32ffb0b42bdb6b27d42c1c9e3a35d1b

                                SHA512

                                a4e09096fd8fd01a12763fe0bbcf4f281d6e0f535b3777817f9295905fc593ec6e7b2db2c25e8d14bd1a5594a0dfe9cabe30f1699168bef5209ed4b4417f2848

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\db\data.safe.tmp

                                Filesize

                                14KB

                                MD5

                                a622223a4ac496935d70e431b00f7c67

                                SHA1

                                ccf4f4f6d1f952fe3e0bfb28071e692d1f008e6f

                                SHA256

                                1fccd6cdc1bd7fd0fed58541662880192675af6bb558ca6089eb3e2f6b23eb9f

                                SHA512

                                6816165d282a90fa764ea7dc2113a2f114720da69616e1e8f483a09a27d8673e7e00b3f5293503ccfaae0ce7e7b55003d261532a98da6c30b40a43ca94f2c4f7

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\db\data.safe.tmp

                                Filesize

                                5KB

                                MD5

                                c267a1e0c1a93acc4c40c87cb0902fda

                                SHA1

                                6730839bfd93d6c4eea0659eb7f1c19de807ac94

                                SHA256

                                bb25a2af095e4b9a552fb9e04d193fedcc895b04590ec0666b4590070c6280ae

                                SHA512

                                86dc7b1004b22a94aef52211c478d89744dc5b255f92234e2904b7526ee97ab9d9f20518c986a800fe77dffe8a331810c1866e3d019ee86b2a15dfa03a547f3c

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\db\data.safe.tmp

                                Filesize

                                14KB

                                MD5

                                7d44cc217fdb53fb8fac25442c4ad0c3

                                SHA1

                                4770bc15b538929d1c70582f3c616489f40b79fe

                                SHA256

                                4258527ba29b4a99f036004ae06c09ebf406ac456713e8fc6e48be0c120782c2

                                SHA512

                                697e13a2f5a1d16b5cc205b770d29f494bc3519786a302097b62bf566bd00f65d1a07cbea96807915bee2aa05f914fe5577b3e8ea37b60d790433da3869e5004

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\pending_pings\30bbafc9-b8a8-42f1-ae8b-db35a9453bdc

                                Filesize

                                671B

                                MD5

                                734919a5a58a4904830e490fafd2d38c

                                SHA1

                                bc1f6154f5c475dfb063b29256774fc1743491fd

                                SHA256

                                97c7f1ab8b480bdfaaad7ad52046143d8d93b3583733d76c05fb64724daddc1d

                                SHA512

                                239c85d43e87a99ff5b4068fd4777c9bcc57746c82d2afcf74bc05004efbbfe966f20c8a269f7bc4b4502dc50ddd368dd2a7189acbbbc4f776feeb99c9ae3a8a

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\pending_pings\64bbd1b7-7295-4b42-afb8-588ec4415054

                                Filesize

                                28KB

                                MD5

                                12cf9dd2f03eddb559746a9d1006eada

                                SHA1

                                3d752239f09abe8bcd6bf27da059aa4774425ab3

                                SHA256

                                1a6a3e5c3e77659f2c9a0bfd53f88c09e164142ee312cc9ee140f157e46264cb

                                SHA512

                                2f81ce4da4aa0676043efc09403a818ebe85833b5452363ca709e2e0d8b13c1fb01fdb0c1261695c8dd6f941d37d3209fddcf7b997ca23eb473b0452192fd7b2

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\pending_pings\be1799e6-c56e-479d-ae6e-3d046396732b

                                Filesize

                                982B

                                MD5

                                b540f41745f7c7fddd724ef68430a755

                                SHA1

                                16027c324ff9bbe8956b6ace019d5175073bee3a

                                SHA256

                                af01db9a235dff49ae3b36a8c707d0e42d329b8370e07b615b338188427c2ff1

                                SHA512

                                759df5b5412fcb3fac40d9e72e9eda6d2e22b1884e72c86656d201f23c5b2663697863044ca765d4ee0c9b7319519087a655e3af532d83d781692b69ae790a89

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                Filesize

                                1.1MB

                                MD5

                                842039753bf41fa5e11b3a1383061a87

                                SHA1

                                3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                SHA256

                                d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                SHA512

                                d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                Filesize

                                116B

                                MD5

                                2a461e9eb87fd1955cea740a3444ee7a

                                SHA1

                                b10755914c713f5a4677494dbe8a686ed458c3c5

                                SHA256

                                4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                SHA512

                                34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                Filesize

                                372B

                                MD5

                                bf957ad58b55f64219ab3f793e374316

                                SHA1

                                a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                SHA256

                                bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                SHA512

                                79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                Filesize

                                17.8MB

                                MD5

                                daf7ef3acccab478aaa7d6dc1c60f865

                                SHA1

                                f8246162b97ce4a945feced27b6ea114366ff2ad

                                SHA256

                                bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                SHA512

                                5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs-1.js

                                Filesize

                                11KB

                                MD5

                                b575284ec5d4f6788711c460ea940905

                                SHA1

                                a4d985974a5c6c5593ec4776c74ee11ba0adcd3e

                                SHA256

                                014e00bec2f1b6e871303e0d7adddd9fc3c71b78d5f461d2a9d22d80e50d1733

                                SHA512

                                9496a44e55d2e495ebb3fca333cb0c3b2ce7c1f0f4bc371716f0f756554d7288b593d3b0dcc61b80c34acadd4dfc499c909f65afce122c1d740e1e65cdb5f70a

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs-1.js

                                Filesize

                                15KB

                                MD5

                                d1900ed0528934b3f13fe84023000472

                                SHA1

                                ad964cc81fd3e54a6ad4b56ff4ccf2c3928f3341

                                SHA256

                                8d5bf4e8c6c4c1fc2f306853edcdd0cd4d416ed95d22a5f9cf24001611780c5e

                                SHA512

                                e6764be635c65a7bb2b6e7aa8dfd6e873528dae2c1c2702ec00890157056ce8202662fbe625d9c87fc1c0349e067e8c7a1f42c66be4f31bd6c4a199197602f93

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs-1.js

                                Filesize

                                10KB

                                MD5

                                fd4ffa17aeb36e63415cb0c1fcb9d0a3

                                SHA1

                                6a86e4ee972b9717afbc4158b09008271fcc10a2

                                SHA256

                                bccbb71c8a5e553f740da24d7d8cb3dd936a4e7b2271ec5e3de18cdf68100ebb

                                SHA512

                                6da76af44b2b3c3e3adadb12dfc56274e3f6fd9f01e1aef4de3c8d4effd5f814684f703dfd7767f0b2e6fded52e90234df69bc55b0cd3b9336cb1969a8de22f7

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs.js

                                Filesize

                                11KB

                                MD5

                                7a1bc1f1504d191e2499e69678ba2b4e

                                SHA1

                                384a682d8d19548ec7430a0de621aea6aa5da1d8

                                SHA256

                                090150ba2de4f49fcbaa83ec473b844f8a9337b97480d6741d500d4ba79a4478

                                SHA512

                                a434dd84e9499ddb66f2ba50e6d4b8bab11a21414ea142589ff5956d17461a630648fe80970dd7aa207f53e66af22df1c492b96470daac1ad961aef5a5dd90d0

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                Filesize

                                568KB

                                MD5

                                04ba987191866760904331c5d9e5f42b

                                SHA1

                                9c764b68508b1a87c3d559c63e716c814f04767d

                                SHA256

                                dbe5f5480711f6612825505d3f53fddb3ca3de6bbddb2e7d2008a7f61c3643e0

                                SHA512

                                49801185471523c3749e7d97af70baf2b1f07508f4e9bbe83566c0b5325711e321ca8c386ba1256b3c70ed5c1a932c0aa60d2f1e2432b1e0fd54bf0385918190

                              • C:\Users\Admin\AppData\Roaming\d3d9.dll

                                Filesize

                                534KB

                                MD5

                                a6da8d868dbd5c9fe6b505db0ee7eb71

                                SHA1

                                3dad32b3b3230ad6f44b82d1eb1749c67800c6f8

                                SHA256

                                4ad69afb341c6d8021db1d9b0b7e56d14b020a0d70739e31f0b65861f3c4eb2c

                                SHA512

                                132f54ac3116fd644c57840c893dae2128f571a784ceaa6dd78bafa3e05fc8f2a9d2458f1e1cf321b6cecc2423d3c57ff6d3c4b6b60f92a41b665105a3262dd0

                              • C:\Users\Admin\Desktop\Microsoft Edge.lnk

                                Filesize

                                2KB

                                MD5

                                e744166dd68aaafe90aa1bb6e75af74a

                                SHA1

                                4f4756913ffbb951cb95a6ec854d7357e5fbfd64

                                SHA256

                                59175932409805e45eaf02809e385859b3e306bc5e9bfd309ba34df0b192248f

                                SHA512

                                78429a53838568fcbaab6900f6b074deb62df077a2c90ec05e5b83e2cb8520d470cb109048e9b0c6cf8dfc70a7d79ae3abbbbaa7a17bfc6294d290fba7116469

                              • C:\Users\Public\Desktop\Google Chrome.lnk

                                Filesize

                                2KB

                                MD5

                                aac5f4ec2d1c4c6de526c560be1321a7

                                SHA1

                                ad0bf4e7a78040add16b8c5b0c7c1c8e379eef92

                                SHA256

                                8cc07a2f0d7d04b149bcd0a6a54823428e267a69816e07dc4173567c847f7f07

                                SHA512

                                1e99f45d1884c97776d3e038fb509e3f48fa8fd89df4dd2709f1daa0af97e5afefc216a64f820a6ed753cf203fbe9a90aee09943dc782556db13b4d8bf21fa2b

                              • memory/224-603-0x0000000000780000-0x00000000007D2000-memory.dmp

                                Filesize

                                328KB

                              • memory/224-622-0x00000000069C0000-0x0000000006A0C000-memory.dmp

                                Filesize

                                304KB

                              • memory/452-113-0x0000000000400000-0x0000000000511000-memory.dmp

                                Filesize

                                1.1MB

                              • memory/452-146-0x0000000000400000-0x0000000000511000-memory.dmp

                                Filesize

                                1.1MB

                              • memory/452-115-0x0000000000400000-0x0000000000511000-memory.dmp

                                Filesize

                                1.1MB

                              • memory/452-116-0x0000000000400000-0x0000000000511000-memory.dmp

                                Filesize

                                1.1MB

                              • memory/452-111-0x0000000000400000-0x0000000000511000-memory.dmp

                                Filesize

                                1.1MB

                              • memory/528-1839-0x0000000000C70000-0x0000000001112000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/528-1809-0x0000000000C70000-0x0000000001112000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/1336-678-0x0000000000C20000-0x00000000010D2000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/1336-691-0x0000000000C20000-0x00000000010D2000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/1396-458-0x0000000000B00000-0x0000000000B54000-memory.dmp

                                Filesize

                                336KB

                              • memory/1448-48-0x0000000005270000-0x0000000005302000-memory.dmp

                                Filesize

                                584KB

                              • memory/1448-85-0x0000000005EA0000-0x0000000005F16000-memory.dmp

                                Filesize

                                472KB

                              • memory/1448-231-0x00000000092D0000-0x0000000009320000-memory.dmp

                                Filesize

                                320KB

                              • memory/1448-93-0x0000000006F90000-0x0000000006FDC000-memory.dmp

                                Filesize

                                304KB

                              • memory/1448-92-0x0000000006F50000-0x0000000006F8C000-memory.dmp

                                Filesize

                                240KB

                              • memory/1448-47-0x00000000058F0000-0x0000000005E94000-memory.dmp

                                Filesize

                                5.6MB

                              • memory/1448-44-0x0000000000400000-0x0000000000452000-memory.dmp

                                Filesize

                                328KB

                              • memory/1448-57-0x0000000005320000-0x000000000532A000-memory.dmp

                                Filesize

                                40KB

                              • memory/1448-89-0x0000000006FF0000-0x0000000007608000-memory.dmp

                                Filesize

                                6.1MB

                              • memory/1448-86-0x0000000006660000-0x000000000667E000-memory.dmp

                                Filesize

                                120KB

                              • memory/1448-91-0x0000000006EF0000-0x0000000006F02000-memory.dmp

                                Filesize

                                72KB

                              • memory/1448-90-0x0000000008870000-0x000000000897A000-memory.dmp

                                Filesize

                                1.0MB

                              • memory/1448-211-0x0000000006A40000-0x0000000006AA6000-memory.dmp

                                Filesize

                                408KB

                              • memory/1496-2-0x0000000000D81000-0x0000000000DAF000-memory.dmp

                                Filesize

                                184KB

                              • memory/1496-18-0x0000000000D80000-0x0000000001222000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/1496-4-0x0000000000D80000-0x0000000001222000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/1496-3-0x0000000000D80000-0x0000000001222000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/1496-0-0x0000000000D80000-0x0000000001222000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/1496-1-0x0000000076FC4000-0x0000000076FC6000-memory.dmp

                                Filesize

                                8KB

                              • memory/1920-343-0x0000000000C50000-0x0000000000CC8000-memory.dmp

                                Filesize

                                480KB

                              • memory/1920-501-0x00000000066F0000-0x000000000670A000-memory.dmp

                                Filesize

                                104KB

                              • memory/2084-149-0x0000000000B50000-0x0000000000BA2000-memory.dmp

                                Filesize

                                328KB

                              • memory/2216-373-0x0000000000400000-0x0000000000454000-memory.dmp

                                Filesize

                                336KB

                              • memory/2216-371-0x0000000000400000-0x0000000000454000-memory.dmp

                                Filesize

                                336KB

                              • memory/2260-377-0x0000000000400000-0x000000000081B000-memory.dmp

                                Filesize

                                4.1MB

                              • memory/2320-196-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                Filesize

                                972KB

                              • memory/2320-464-0x0000000000240000-0x0000000000483000-memory.dmp

                                Filesize

                                2.3MB

                              • memory/2320-184-0x0000000000240000-0x0000000000483000-memory.dmp

                                Filesize

                                2.3MB

                              • memory/2400-759-0x0000000000400000-0x00000000005E1000-memory.dmp

                                Filesize

                                1.9MB

                              • memory/2400-754-0x0000000000400000-0x00000000005E1000-memory.dmp

                                Filesize

                                1.9MB

                              • memory/2400-755-0x0000000000400000-0x00000000005E1000-memory.dmp

                                Filesize

                                1.9MB

                              • memory/2432-708-0x0000000000520000-0x0000000000BB3000-memory.dmp

                                Filesize

                                6.6MB

                              • memory/2432-710-0x0000000000520000-0x0000000000BB3000-memory.dmp

                                Filesize

                                6.6MB

                              • memory/2544-1169-0x0000000000840000-0x0000000000CF2000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/2544-1099-0x0000000000840000-0x0000000000CF2000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/2544-724-0x0000000000840000-0x0000000000CF2000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/2544-1307-0x0000000000840000-0x0000000000CF2000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/2544-689-0x0000000000840000-0x0000000000CF2000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/2544-729-0x0000000000840000-0x0000000000CF2000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/2652-728-0x0000000000400000-0x000000000106B000-memory.dmp

                                Filesize

                                12.4MB

                              • memory/2652-1167-0x0000000000400000-0x000000000106B000-memory.dmp

                                Filesize

                                12.4MB

                              • memory/2652-692-0x0000000000400000-0x000000000106B000-memory.dmp

                                Filesize

                                12.4MB

                              • memory/2840-84-0x00000000004E0000-0x00000000005F6000-memory.dmp

                                Filesize

                                1.1MB

                              • memory/2892-1204-0x0000000000530000-0x0000000000541000-memory.dmp

                                Filesize

                                68KB

                              • memory/2892-1205-0x0000000073240000-0x000000007337C000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/2924-500-0x0000000000560000-0x0000000000BF3000-memory.dmp

                                Filesize

                                6.6MB

                              • memory/2924-502-0x0000000000560000-0x0000000000BF3000-memory.dmp

                                Filesize

                                6.6MB

                              • memory/3124-752-0x00000000060B0000-0x0000000006346000-memory.dmp

                                Filesize

                                2.6MB

                              • memory/3124-750-0x0000000005E10000-0x00000000060B2000-memory.dmp

                                Filesize

                                2.6MB

                              • memory/3124-569-0x00000000006E0000-0x0000000001126000-memory.dmp

                                Filesize

                                10.3MB

                              • memory/3124-753-0x0000000006340000-0x0000000006362000-memory.dmp

                                Filesize

                                136KB

                              • memory/3124-570-0x0000000005A70000-0x0000000005B0C000-memory.dmp

                                Filesize

                                624KB

                              • memory/3204-159-0x00000000004D0000-0x0000000000562000-memory.dmp

                                Filesize

                                584KB

                              • memory/3204-239-0x0000000009EF0000-0x000000000A0B2000-memory.dmp

                                Filesize

                                1.8MB

                              • memory/3204-240-0x000000000A5F0000-0x000000000AB1C000-memory.dmp

                                Filesize

                                5.2MB

                              • memory/3264-1827-0x0000000000840000-0x0000000000CF2000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/3264-1808-0x0000000000840000-0x0000000000CF2000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/3628-1077-0x0000000004DB0000-0x0000000004E21000-memory.dmp

                                Filesize

                                452KB

                              • memory/3628-1062-0x0000000004DB0000-0x0000000004E21000-memory.dmp

                                Filesize

                                452KB

                              • memory/3628-1068-0x0000000004DB0000-0x0000000004E21000-memory.dmp

                                Filesize

                                452KB

                              • memory/3628-1069-0x0000000004DB0000-0x0000000004E21000-memory.dmp

                                Filesize

                                452KB

                              • memory/3628-1070-0x0000000004DB0000-0x0000000004E21000-memory.dmp

                                Filesize

                                452KB

                              • memory/3628-1065-0x0000000004DB0000-0x0000000004E21000-memory.dmp

                                Filesize

                                452KB

                              • memory/3628-1059-0x0000000004DB0000-0x0000000004E21000-memory.dmp

                                Filesize

                                452KB

                              • memory/3832-662-0x0000000000C70000-0x0000000001112000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/3832-638-0x0000000000C70000-0x0000000001112000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/3992-364-0x00000000000B0000-0x000000000015E000-memory.dmp

                                Filesize

                                696KB

                              • memory/4268-321-0x0000000000960000-0x00000000009E0000-memory.dmp

                                Filesize

                                512KB

                              • memory/4384-461-0x0000000000400000-0x0000000000452000-memory.dmp

                                Filesize

                                328KB

                              • memory/4744-40-0x0000000072BDE000-0x0000000072BDF000-memory.dmp

                                Filesize

                                4KB

                              • memory/4744-41-0x00000000007A0000-0x00000000007F4000-memory.dmp

                                Filesize

                                336KB

                              • memory/4960-725-0x00000000006B0000-0x0000000000D43000-memory.dmp

                                Filesize

                                6.6MB

                              • memory/4960-726-0x00000000006B0000-0x0000000000D43000-memory.dmp

                                Filesize

                                6.6MB

                              • memory/5024-376-0x0000000000400000-0x0000000000643000-memory.dmp

                                Filesize

                                2.3MB

                              • memory/5024-380-0x0000000000400000-0x0000000000643000-memory.dmp

                                Filesize

                                2.3MB

                              • memory/5024-519-0x0000000000400000-0x0000000000643000-memory.dmp

                                Filesize

                                2.3MB

                              • memory/5116-1168-0x0000000000C70000-0x0000000001112000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/5116-1306-0x0000000000C70000-0x0000000001112000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/5116-222-0x0000000000C70000-0x0000000001112000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/5116-191-0x0000000000C70000-0x0000000001112000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/5116-190-0x0000000000C70000-0x0000000001112000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/5116-189-0x0000000000C70000-0x0000000001112000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/5116-727-0x0000000000C70000-0x0000000001112000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/5116-680-0x0000000000C70000-0x0000000001112000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/5116-1083-0x0000000000C70000-0x0000000001112000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/5116-459-0x0000000000C70000-0x0000000001112000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/5116-20-0x0000000000C70000-0x0000000001112000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/5116-21-0x0000000000C70000-0x0000000001112000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/5116-571-0x0000000000C70000-0x0000000001112000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/5116-19-0x0000000000C70000-0x0000000001112000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/5116-550-0x0000000000C70000-0x0000000001112000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/5116-16-0x0000000000C70000-0x0000000001112000-memory.dmp

                                Filesize

                                4.6MB