Overview

overview

10

Static

static

3

65d41daec7...0c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-12-2024 13:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    65d41daec75d44ef22be91e6270ab3a1e6dfbf28928dd698c76e3842383db80c.exe

  • Size

    6.8MB

  • MD5

    c9975ee9d29770b7b8f679cfd3abead9

  • SHA1

    7a0e349e511136de774c41027229cab0991b004a

  • SHA256

    65d41daec75d44ef22be91e6270ab3a1e6dfbf28928dd698c76e3842383db80c

  • SHA512

    93634ff0fb60e8f730e52d3dc587cc036a930c956170ce275c032aca20c98caf14f1ab1428de2d93b6de9b8f3e3e0c78c35c9d822ab6a87f6d9a57b4a3b63855

  • SSDEEP

    196608:k2Ue8HJGgoYwANhrM+JRcCrfCyUe1F/yji:OtHJGg5wANS+JRnrrh1lMi

Score
10/10
amadeycryptbotgcleanerlummastealc9c9aa5default_valencigadrumfed3aacredential_accessdiscoveryevasionexecutionloaderpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

https://drive-connect.cyou/api

https://crib-endanger.sbs/api

https://faintbl0w.sbs/api

https://300snails.sbs/api

https://bored-light.sbs/api

https://3xc1aimbl0w.sbs/api

https://pull-trucker.sbs/api

https://fleez-inc.sbs/api

https://thicktoys.sbs/api

https://ratiomun.cyou/api

Extracted

Family

stealc

Botnet

default_valenciga

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

stealc

Botnet

drum

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

gcleaner

C2

92.63.197.221

45.91.200.135

Extracted

Family

cryptbot

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

https://dwell-exclaim.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://drive-connect.cyou/api

https://ratiomun.cyou/api

https://dare-curbys.biz/api

https://print-vexer.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 21 IoCs
    evasion
  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 42 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 44 IoCs
  • Identifies Wine through registry keys 2 TTPs 20 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 7 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 8 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 48 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies data under HKEY_USERS 50 IoCs
  • Modifies registry class 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\65d41daec75d44ef22be91e6270ab3a1e6dfbf28928dd698c76e3842383db80c.exe
    "C:\Users\Admin\AppData\Local\Temp\65d41daec75d44ef22be91e6270ab3a1e6dfbf28928dd698c76e3842383db80c.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5032
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\P8T75.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\P8T75.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3184
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i0S89.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i0S89.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3424
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1i63S2.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1i63S2.exe
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3568
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3700
            • C:\Users\Admin\AppData\Local\Temp\1011459001\ace78b3df8.exe
              "C:\Users\Admin\AppData\Local\Temp\1011459001\ace78b3df8.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Checks computer location settings
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:3972
              • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
                7⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Checks computer location settings
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Adds Run key to start application
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:760
                • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Checks processor information in registry
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4332
                • C:\Users\Admin\AppData\Local\Temp\1001527001\alex2022.exe
                  "C:\Users\Admin\AppData\Local\Temp\1001527001\alex2022.exe"
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1720
                  • C:\Users\Admin\AppData\Local\Temp\1001527001\alex2022.exe
                    "C:\Users\Admin\AppData\Local\Temp\1001527001\alex2022.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:3464
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 1408
                      10⤵
                      • Program crash
                      PID:6604
                • C:\Users\Admin\AppData\Local\Temp\1002824001\715a1ae824.exe
                  "C:\Users\Admin\AppData\Local\Temp\1002824001\715a1ae824.exe"
                  8⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2544
                • C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe
                  "C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe"
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3716
                  • C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
                    "C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe"
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:720
                    • C:\Users\Admin\AppData\Local\Temp\10000331101\Office2024.exe
                      "C:\Users\Admin\AppData\Local\Temp\10000331101\Office2024.exe"
                      10⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      PID:5896
                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                        11⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious use of AdjustPrivilegeToken
                        PID:6156
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                        11⤵
                          PID:628
                          • C:\Windows\system32\wusa.exe
                            wusa /uninstall /kb:890830 /quiet /norestart
                            12⤵
                              PID:2796
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe stop UsoSvc
                            11⤵
                            • Launches sc.exe
                            PID:2832
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe stop WaaSMedicSvc
                            11⤵
                            • Launches sc.exe
                            PID:1236
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe stop wuauserv
                            11⤵
                            • Launches sc.exe
                            PID:1116
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe stop bits
                            11⤵
                            • Launches sc.exe
                            PID:6620
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe stop dosvc
                            11⤵
                            • Launches sc.exe
                            PID:6604
                          • C:\Windows\system32\powercfg.exe
                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                            11⤵
                            • Power Settings
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1212
                          • C:\Windows\system32\powercfg.exe
                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                            11⤵
                            • Power Settings
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2532
                          • C:\Windows\system32\powercfg.exe
                            C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                            11⤵
                            • Power Settings
                            • Suspicious use of AdjustPrivilegeToken
                            PID:6636
                          • C:\Windows\system32\powercfg.exe
                            C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                            11⤵
                            • Power Settings
                            • Suspicious use of AdjustPrivilegeToken
                            PID:6664
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe delete "QKJNEQWA"
                            11⤵
                            • Launches sc.exe
                            PID:6668
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe create "QKJNEQWA" binpath= "C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe" start= "auto"
                            11⤵
                            • Launches sc.exe
                            PID:6860
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe stop eventlog
                            11⤵
                            • Launches sc.exe
                            PID:4456
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe start "QKJNEQWA"
                            11⤵
                            • Launches sc.exe
                            PID:2344
                        • C:\Users\Admin\AppData\Local\Temp\10000351101\stail.exe
                          "C:\Users\Admin\AppData\Local\Temp\10000351101\stail.exe"
                          10⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:6820
                          • C:\Users\Admin\AppData\Local\Temp\is-PAA01.tmp\stail.tmp
                            "C:\Users\Admin\AppData\Local\Temp\is-PAA01.tmp\stail.tmp" /SL5="$C0296,3485671,54272,C:\Users\Admin\AppData\Local\Temp\10000351101\stail.exe"
                            11⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of FindShellTrayWindow
                            PID:6864
                            • C:\Windows\SysWOW64\net.exe
                              "C:\Windows\system32\net.exe" pause raf_encoder_1252
                              12⤵
                              • System Location Discovery: System Language Discovery
                              PID:7052
                              • C:\Windows\SysWOW64\net1.exe
                                C:\Windows\system32\net1 pause raf_encoder_1252
                                13⤵
                                • System Location Discovery: System Language Discovery
                                PID:7148
                            • C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder.exe
                              "C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder.exe" -i
                              12⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              PID:7024
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "lDBNode59" -Value "C:\ProgramData\DNodedbtable\DNodedbtable.exe"
                                13⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Adds Run key to start application
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:7164
                    • C:\Users\Admin\AppData\Local\Temp\1003620001\trru7rd2.exe
                      "C:\Users\Admin\AppData\Local\Temp\1003620001\trru7rd2.exe"
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:7060
                    • C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe
                      "C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe"
                      8⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:5728
                      • C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe
                        "C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe"
                        9⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:7268
                        • C:\Windows\SysWOW64\rundll32.exe
                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                          10⤵
                          • Blocklisted process makes network request
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:6524
                    • C:\Users\Admin\AppData\Local\Temp\1005242001\v_dolg.exe
                      "C:\Users\Admin\AppData\Local\Temp\1005242001\v_dolg.exe"
                      8⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      PID:4596
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 1440
                        9⤵
                        • Program crash
                        PID:8172
                    • C:\Users\Admin\AppData\Local\Temp\1005402001\961cfaa53a.exe
                      "C:\Users\Admin\AppData\Local\Temp\1005402001\961cfaa53a.exe"
                      8⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      PID:4624
                    • C:\Users\Admin\AppData\Local\Temp\1005403001\61c17d924a.exe
                      "C:\Users\Admin\AppData\Local\Temp\1005403001\61c17d924a.exe"
                      8⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      PID:5620
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 1596
                        9⤵
                        • Program crash
                        PID:6836
                • C:\Users\Admin\AppData\Local\Temp\1011782001\GI59vO6.exe
                  "C:\Users\Admin\AppData\Local\Temp\1011782001\GI59vO6.exe"
                  6⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1608
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 1640
                    7⤵
                    • Program crash
                    PID:6404
                • C:\Users\Admin\AppData\Local\Temp\1012056001\BhD8htX.exe
                  "C:\Users\Admin\AppData\Local\Temp\1012056001\BhD8htX.exe"
                  6⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1388
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 1668
                    7⤵
                    • Program crash
                    PID:6692
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 1628
                    7⤵
                    • Program crash
                    PID:6708
                • C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe
                  "C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2212
                  • C:\Users\Admin\AppData\Local\Temp\is-F72Q6.tmp\i1A5m12.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-F72Q6.tmp\i1A5m12.tmp" /SL5="$7011C,3291517,54272,C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe"
                    7⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of WriteProcessMemory
                    PID:5096
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\system32\net.exe" pause raf_encoder_1252
                      8⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:936
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 pause raf_encoder_1252
                        9⤵
                        • System Location Discovery: System Language Discovery
                        PID:2440
                    • C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder.exe
                      "C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder.exe" -i
                      8⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:3976
                • C:\Users\Admin\AppData\Local\Temp\1012387001\22265c8938.exe
                  "C:\Users\Admin\AppData\Local\Temp\1012387001\22265c8938.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:2332
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM firefox.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3828
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM chrome.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1968
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM msedge.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:800
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM opera.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1728
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM brave.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1752
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                    7⤵
                      PID:3880
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                        8⤵
                        • Checks processor information in registry
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        PID:2452
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2040 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3a88d33-9df8-4ddb-87e7-150151e16328} 2452 "\\.\pipe\gecko-crash-server-pipe.2452" gpu
                          9⤵
                            PID:3424
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2476 -parentBuildID 20240401114208 -prefsHandle 2452 -prefMapHandle 2448 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {18a1a871-f94b-48ec-89c5-ee3c31fa0000} 2452 "\\.\pipe\gecko-crash-server-pipe.2452" socket
                            9⤵
                              PID:3896
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3280 -childID 1 -isForBrowser -prefsHandle 2712 -prefMapHandle 2664 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1080 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2edf31f-035a-4c21-baab-25ed10b1ae4a} 2452 "\\.\pipe\gecko-crash-server-pipe.2452" tab
                              9⤵
                                PID:1520
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3888 -childID 2 -isForBrowser -prefsHandle 3880 -prefMapHandle 3844 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1080 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1621160-ffa1-4b37-8183-c51271616452} 2452 "\\.\pipe\gecko-crash-server-pipe.2452" tab
                                9⤵
                                  PID:5204
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4468 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4236 -prefMapHandle 4460 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55e736d0-5d20-4ea7-b639-6a44f9f2d60d} 2452 "\\.\pipe\gecko-crash-server-pipe.2452" utility
                                  9⤵
                                  • Checks processor information in registry
                                  PID:7272
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5548 -childID 3 -isForBrowser -prefsHandle 5740 -prefMapHandle 5736 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1080 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfa63e21-f226-42c5-b1fe-045d65135b39} 2452 "\\.\pipe\gecko-crash-server-pipe.2452" tab
                                  9⤵
                                    PID:5368
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5952 -childID 4 -isForBrowser -prefsHandle 5944 -prefMapHandle 5940 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1080 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3450d8ac-7c3b-472e-ad50-05f172493afb} 2452 "\\.\pipe\gecko-crash-server-pipe.2452" tab
                                    9⤵
                                      PID:5388
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6064 -childID 5 -isForBrowser -prefsHandle 6140 -prefMapHandle 6136 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1080 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {219bbe16-5f5c-47e4-90a4-91427948cbfe} 2452 "\\.\pipe\gecko-crash-server-pipe.2452" tab
                                      9⤵
                                        PID:5404
                                • C:\Users\Admin\AppData\Local\Temp\1012388001\f20d54380a.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1012388001\f20d54380a.exe"
                                  6⤵
                                  • Modifies Windows Defender Real-time Protection settings
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Windows security modification
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2572
                                • C:\Users\Admin\AppData\Local\Temp\1012389001\de9d19d804.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1012389001\de9d19d804.exe"
                                  6⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:6024
                                • C:\Users\Admin\AppData\Local\Temp\1012390001\5e74145c03.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1012390001\5e74145c03.exe"
                                  6⤵
                                  • Enumerates VirtualBox registry keys
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:7904
                                • C:\Users\Admin\AppData\Local\Temp\1012391001\rhnew.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1012391001\rhnew.exe"
                                  6⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  PID:5556
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5556 -s 1648
                                    7⤵
                                    • Program crash
                                    PID:1380
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5556 -s 1636
                                    7⤵
                                    • Program crash
                                    PID:5900
                            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2P0360.exe
                              C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2P0360.exe
                              4⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5020
                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3D63U.exe
                            C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3D63U.exe
                            3⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4196
                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4h334A.exe
                          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4h334A.exe
                          2⤵
                          • Modifies Windows Defender Real-time Protection settings
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Windows security modification
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:7536
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1608 -ip 1608
                        1⤵
                          PID:6376
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3464 -ip 3464
                          1⤵
                            PID:6584
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1388 -ip 1388
                            1⤵
                              PID:6648
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1388 -ip 1388
                              1⤵
                                PID:6656
                              • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:5840
                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:5844
                              • C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
                                C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
                                1⤵
                                • Executes dropped EXE
                                PID:6220
                              • C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe
                                C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe
                                1⤵
                                • Executes dropped EXE
                                PID:6272
                              • C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe
                                C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe
                                1⤵
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                • Suspicious use of SetThreadContext
                                PID:1052
                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                  2⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • Drops file in System32 directory
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:7156
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                  2⤵
                                    PID:7312
                                    • C:\Windows\system32\wusa.exe
                                      wusa /uninstall /kb:890830 /quiet /norestart
                                      3⤵
                                        PID:6268
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop UsoSvc
                                      2⤵
                                      • Launches sc.exe
                                      PID:8180
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                      2⤵
                                      • Launches sc.exe
                                      PID:5240
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop wuauserv
                                      2⤵
                                      • Launches sc.exe
                                      PID:3224
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop bits
                                      2⤵
                                      • Launches sc.exe
                                      PID:5328
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop dosvc
                                      2⤵
                                      • Launches sc.exe
                                      PID:5104
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                      2⤵
                                      • Power Settings
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:6008
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                      2⤵
                                      • Power Settings
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:6016
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                      2⤵
                                      • Power Settings
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:6032
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                      2⤵
                                      • Power Settings
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:6044
                                    • C:\Windows\system32\conhost.exe
                                      C:\Windows\system32\conhost.exe
                                      2⤵
                                        PID:6040
                                      • C:\Windows\system32\cmd.exe
                                        cmd.exe
                                        2⤵
                                        • Blocklisted process makes network request
                                        • Modifies data under HKEY_USERS
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:6176
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5556 -ip 5556
                                      1⤵
                                        PID:6692
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5556 -ip 5556
                                        1⤵
                                          PID:3832
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4596 -ip 4596
                                          1⤵
                                            PID:8132
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5620 -ip 5620
                                            1⤵
                                              PID:6220
                                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                              C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                              1⤵
                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                              • Checks BIOS information in registry
                                              • Executes dropped EXE
                                              • Identifies Wine through registry keys
                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                              PID:6368
                                            • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                              C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                              1⤵
                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                              • Checks BIOS information in registry
                                              • Executes dropped EXE
                                              • Identifies Wine through registry keys
                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                              PID:1620
                                            • C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
                                              C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
                                              1⤵
                                              • Executes dropped EXE
                                              PID:1596
                                            • C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe
                                              C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe
                                              1⤵
                                              • Executes dropped EXE
                                              PID:4016

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Reconnaissance

                                            Resource Development

                                            Initial Access

                                            Execution

                                            Command and Scripting Interpreter

                                            1
                                            T1059

                                            PowerShell

                                            1
                                            T1059.001

                                            System Services

                                            2
                                            T1569

                                            Service Execution

                                            2
                                            T1569.002

                                            Persistence

                                            Boot or Logon Autostart Execution

                                            1
                                            T1547

                                            Registry Run Keys / Startup Folder

                                            1
                                            T1547.001

                                            Create or Modify System Process

                                            3
                                            T1543

                                            Windows Service

                                            3
                                            T1543.003

                                            Power Settings

                                            1
                                            T1653

                                            Privilege Escalation

                                            Boot or Logon Autostart Execution

                                            1
                                            T1547

                                            Registry Run Keys / Startup Folder

                                            1
                                            T1547.001

                                            Create or Modify System Process

                                            3
                                            T1543

                                            Windows Service

                                            3
                                            T1543.003

                                            Defense Evasion

                                            Impair Defenses

                                            3
                                            T1562

                                            Disable or Modify Tools

                                            2
                                            T1562.001

                                            Modify Registry

                                            3
                                            T1112

                                            Virtualization/Sandbox Evasion

                                            3
                                            T1497

                                            Credential Access

                                            Credentials from Password Stores

                                            1
                                            T1555

                                            Credentials from Web Browsers

                                            1
                                            T1555.003

                                            Unsecured Credentials

                                            4
                                            T1552

                                            Credentials In Files

                                            4
                                            T1552.001

                                            Discovery

                                            Query Registry

                                            8
                                            T1012

                                            System Information Discovery

                                            5
                                            T1082

                                            System Location Discovery

                                            1
                                            T1614

                                            System Language Discovery

                                            1
                                            T1614.001

                                            Virtualization/Sandbox Evasion

                                            3
                                            T1497

                                            Lateral Movement

                                            Collection

                                            Data from Local System

                                            3
                                            T1005

                                            Command and Control

                                            Web Service

                                            1
                                            T1102

                                            Exfiltration

                                            Impact

                                            Service Stop

                                            1
                                            T1489

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\ProgramData\mozglue.dll
                                              Filesize

                                              593KB

                                              MD5

                                              c8fd9be83bc728cc04beffafc2907fe9

                                              SHA1

                                              95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                              SHA256

                                              ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                              SHA512

                                              fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                              Download Submit

                                            • C:\ProgramData\nss3.dll
                                              Filesize

                                              2.0MB

                                              MD5

                                              1cc453cdf74f31e4d913ff9c10acdde2

                                              SHA1

                                              6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                              SHA256

                                              ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                              SHA512

                                              dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n4zftpal.default-release\activity-stream.discovery_stream.json
                                              Filesize

                                              19KB

                                              MD5

                                              a501eac964e47cac330c997ac0b8194c

                                              SHA1

                                              c309419804c2e1c9f3d2dfb75ab11badc4c47c86

                                              SHA256

                                              49dddefe2ff4cb4f478fa1befbb190d6ec6f061034837bf6bc0aa64b33cbc4cd

                                              SHA512

                                              533dcec372d9c6a21842c44256fe5f6e294989a6687b600157b1a7fdfd269d3d3d94cb1cebb7d4c695616073b37da98b3b9a9c818110cf45f6722885db2d14f6

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n4zftpal.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                                              Filesize

                                              13KB

                                              MD5

                                              4aba4824cfad1d3929cd44f973af6870

                                              SHA1

                                              69269d1b010ff7efa161b2bf26ca1b1a62139326

                                              SHA256

                                              47e37a8ae3d1304812debc044e13eaa2ecdf0e46720b58fb63bbf55d075a20db

                                              SHA512

                                              540716d576ec5bcf869a6054d70244cfd5fc12f09537eb7a7e54a82063db9006c0b336b69d0e5a991b21ea2039440f01082007dcfae23c613182480e7b747965

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n4zftpal.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                              Filesize

                                              15KB

                                              MD5

                                              96c542dec016d9ec1ecc4dddfcbaac66

                                              SHA1

                                              6199f7648bb744efa58acf7b96fee85d938389e4

                                              SHA256

                                              7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                              SHA512

                                              cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\bjpeg23.dll
                                              Filesize

                                              172KB

                                              MD5

                                              fec4ff0c2967a05543747e8d552cf9df

                                              SHA1

                                              b4449dc0df8c0afcc9f32776384a6f5b5cede20c

                                              SHA256

                                              5374148ebcf4b456f8711516a58c9a007a393ca88f3d9759041f691e4343c7d6

                                              SHA512

                                              93e3f48cd393314178cbc86f6142d577d5eaae52b47c4d947dba4dfb706860b150ff5b0e546cb83114ca44666e9df6021964d79d064b775a58698daa9550ef13

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\gdiplus.dll
                                              Filesize

                                              1.6MB

                                              MD5

                                              871c903a90c45ca08a9d42803916c3f7

                                              SHA1

                                              d962a12bc15bfb4c505bb63f603ca211588958db

                                              SHA256

                                              f1da32183b3da19f75fa4ef0974a64895266b16d119bbb1da9fe63867dba0645

                                              SHA512

                                              985b0b8b5e3d96acfd0514676d9f0c5d2d8f11e31f01acfa0f7da9af3568e12343ca77f541f55edda6a0e5c14fe733bda5dc1c10bb170d40d15b7a60ad000145

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\ltkrn13n.dll
                                              Filesize

                                              435KB

                                              MD5

                                              cac7e17311797c5471733638c0dc1f01

                                              SHA1

                                              58e0bd1b63525a2955439cb9be3431cea7ff1121

                                              SHA256

                                              19248357ed7cff72dead18b5743bf66c61438d68374bda59e3b9d444c6f8f505

                                              SHA512

                                              a677319ac8a2096d95ffc69f22810bd4f083f6bf55b8a77f20d8fb8ee01f2fee619ce318d1f55c392a8f3a4d635d9285712e2c572e62997014641c36edc060a2

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\msvcp71.dll
                                              Filesize

                                              488KB

                                              MD5

                                              561fa2abb31dfa8fab762145f81667c2

                                              SHA1

                                              c8ccb04eedac821a13fae314a2435192860c72b8

                                              SHA256

                                              df96156f6a548fd6fe5672918de5ae4509d3c810a57bffd2a91de45a3ed5b23b

                                              SHA512

                                              7d960aa8e3cce22d63a6723d7f00c195de7de83b877eca126e339e2d8cc9859e813e05c5c0a5671a75bb717243e9295fd13e5e17d8c6660eb59f5baee63a7c43

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\msvcr71.dll
                                              Filesize

                                              340KB

                                              MD5

                                              86f1895ae8c5e8b17d99ece768a70732

                                              SHA1

                                              d5502a1d00787d68f548ddeebbde1eca5e2b38ca

                                              SHA256

                                              8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe

                                              SHA512

                                              3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder.chm
                                              Filesize

                                              76KB

                                              MD5

                                              b1b9e6d43319f6d4e52ed858c5726a97

                                              SHA1

                                              5033047a30cccf57783c600fd76a6d220021b19d

                                              SHA256

                                              8003a4a0f9f5dfb62befbf81f8c05894b0c1f987acfc8654a6c6ce02b6213910

                                              SHA512

                                              e56d6ec9170debac28bb514942f794f73d4c194d04c54eff9227b6ee3c74ba4fcf239fff0bb6556dc8b847fa89d382af206a2c481c41a3510936b0a74192d2c2

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder.exe
                                              Filesize

                                              2.8MB

                                              MD5

                                              b466bf1dc60388a22cb73be01ca6bf57

                                              SHA1

                                              21eb9665e42d6c4a8d9e764627049b2a6e3a69a4

                                              SHA256

                                              e5f0f0c3383080fc2702779e3040c490ab022af69a4bc8c61bf9b1f6514ae7ad

                                              SHA512

                                              6cb51dae17b3bcef6254ecf6538ecc49cdd53c40c979fd743f49987b28d05c033781b1047dbf25b203b02bf70ce4205dcc1cc5bbea46119cb0e2cd0ce140cbe2

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\sqlite3.dll
                                              Filesize

                                              630KB

                                              MD5

                                              e477a96c8f2b18d6b5c27bde49c990bf

                                              SHA1

                                              e980c9bf41330d1e5bd04556db4646a0210f7409

                                              SHA256

                                              16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

                                              SHA512

                                              335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\10000331101\Office2024.exe
                                              Filesize

                                              2.7MB

                                              MD5

                                              df92abd264b50c9f069246a6e65453f0

                                              SHA1

                                              f5025a44910ceddf26fb3fffb5da28ea93ee1a20

                                              SHA256

                                              bc7d010eb971dbc9cbeedc543f93bb1b6924d57597e213dbe10c2c1efd8d0296

                                              SHA512

                                              a3f48831efa65cea6a2cf313f698b59d84119023196e11b1266d937a5b4c05aa4aab67c6d40450bef5c9245b46316980906fa73196d892f2880abc2b1b863455

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\10000351101\stail.exe
                                              Filesize

                                              3.6MB

                                              MD5

                                              523facd979d21e1028c43514c7acdd3c

                                              SHA1

                                              efa961bdfb8970748792c7a625ac11f2d7549a87

                                              SHA256

                                              39d16c9639b98bfcecc5197a512b9faeda8b6b13d2e37c5aa1709fef9fac710b

                                              SHA512

                                              2186802f7f0d235b35146f095966206aa628cca91d5b2bc54eea4a6d1bec8b328ce422991501aa4614c35a15a17ce2ffa7a8aa00bc2544fb6a5db8ae0608cace

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
                                              Filesize

                                              307KB

                                              MD5

                                              68a99cf42959dc6406af26e91d39f523

                                              SHA1

                                              f11db933a83400136dc992820f485e0b73f1b933

                                              SHA256

                                              c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

                                              SHA512

                                              7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\1001527001\alex2022.exe
                                              Filesize

                                              1.1MB

                                              MD5

                                              0984009f07548d30f9df551472e5c399

                                              SHA1

                                              a1339aa7c290a7e6021450d53e589bafa702f08a

                                              SHA256

                                              80ec0ec77fb6e4bbb4f01a2d3b8d867ddd0dfe7abdb993ef1401f004c18377be

                                              SHA512

                                              23a6a8d0d5c393adc33af6b5c90a4dd0539015757e2dbbd995fd5990aff516e0e2d379b7903e07399c476a7ec9388ed5253252276df6053063d2ed08f1a351e9

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\1002824001\715a1ae824.exe
                                              Filesize

                                              2.8MB

                                              MD5

                                              6a3268db51b26c41418351e516bc33a6

                                              SHA1

                                              57a12903fff8cd7ea5aa3a2d2308c910ac455428

                                              SHA256

                                              eaebfc5e60378bbc47a603ca1310440c290a396cb2446de36ff6e7afb624ee0c

                                              SHA512

                                              43f257dbb7e444355e29a8023e8c8838c9e0ca7538a86c25ac41db1e0308bf73c3adda1b0fe5d0bcf536387b9ce5f8fed216f5f7d92c80bcc12e7bffde979b33

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe
                                              Filesize

                                              429KB

                                              MD5

                                              c07e06e76de584bcddd59073a4161dbb

                                              SHA1

                                              08954ac6f6cf51fd5d9d034060a9ae25a8448971

                                              SHA256

                                              cf67a50598ee170e0d8596f4e22f79cf70e1283b013c3e33e36094e1905ba8d9

                                              SHA512

                                              e92c9fcd0448591738daedb19e8225ff05da588b48d1f15479ec8af62acd3ea52b5d4ba3e3b0675c2aa1705185f5523dcafdf14137c6e2984588069a2e05309f

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\1003620001\trru7rd2.exe
                                              Filesize

                                              6.3MB

                                              MD5

                                              7b5e89271f2f7e9a42d00cd1f1283d0f

                                              SHA1

                                              8e2a8d2f63713f0499d0df70e61db3ce0ff88b4f

                                              SHA256

                                              fd51fd3388f72dd5eef367bd8848a9e92ae1b218be128e9e75dffdf39ed9438a

                                              SHA512

                                              3779e92bd1d68644ceb2ef327c7d24667e13d8c927df3f77ec3b542278538b424ea2fa58a7c03554f7bec245e0ba7702853d8d520c528745dafd67653234ab22

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe
                                              Filesize

                                              429KB

                                              MD5

                                              ce27255f0ef33ce6304e54d171e6547c

                                              SHA1

                                              e594c6743d869c852bf7a09e7fe8103b25949b6e

                                              SHA256

                                              82c683a7f6e0b4a99a6d3ab519d539a3b0651953c7a71f5309b9d08e4daa7c3c

                                              SHA512

                                              96cfafbab9138517532621d0b5f3d4a529806cfdf6191c589e6fb6ebf471e9df0777fb74e9abbfe4e8cd8821944ad02b1f09775195e190ee8ca5d3fd151d20d9

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\1005242001\v_dolg.exe
                                              Filesize

                                              3.6MB

                                              MD5

                                              378706614b22957208e09fc84fceece8

                                              SHA1

                                              d35e1f89f36aed26553b665f791cd69d82136fb8

                                              SHA256

                                              df6e6d5bead4aa34f8e0dd325400a5829265b0f615cd1da48d155cc30b89ad6d

                                              SHA512

                                              bef7a09ce1ffd0a0b169a6ec7c143ca322c929139ca0af40353502ae22fed455fe10a9b80ba93cc399a88add94f921b7aa801033ddae351f8f8d477781ca476e

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\1011459001\ace78b3df8.exe
                                              Filesize

                                              1.9MB

                                              MD5

                                              c6e9356bc487ed6abf260afac2f22982

                                              SHA1

                                              a724d90baec4c68a1a305c9e627d199ff7c59645

                                              SHA256

                                              45a92bb18d63759c9dee2c8135e437a7849126db4dcb11562646edfdc3fb4ddd

                                              SHA512

                                              d14895acdb5ba3a8467d4e0fb7dd22ed71b6ab6a0d67b8ff4c2b84252e8a55a19365deeea6bfeb10ee52152b4f57d0c55a3974ad964d2e69c0b1f9b8cfc9f654

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\1011782001\GI59vO6.exe
                                              Filesize

                                              1.8MB

                                              MD5

                                              5fa72774e9d750628857a68d84275833

                                              SHA1

                                              7eebff7d14817544cc11829e354c1dfc7f603628

                                              SHA256

                                              a170fa6fefc8b753ef0f88384b906ca2338365d8552012ed7aa1c0c8c7cb5a56

                                              SHA512

                                              9ac2715f35e107effef9f4526e6430271ca141bc5a729993e88dfa50eb20f61b15502c54f64e9596cd9bb449a1bb25c1cc98f1d12d857afdda742cdce3280838

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\1012056001\BhD8htX.exe
                                              Filesize

                                              1.7MB

                                              MD5

                                              ff4cf493ac5f7663d1cfc243e6646eb7

                                              SHA1

                                              ff7184eae695580f1e86fac340925c7f01f4de6d

                                              SHA256

                                              72a99a945b705fc1c8fa59c3db6810be2aadeaecc34f954f5ab314574002d748

                                              SHA512

                                              1eef407d5bfa8b94bb98cb0a64e7c73cb94176507fa924642c6cf21192965ba8856390214379fddf192b88e19377768ead94fb4d393831e47ca230b6b168f14b

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe
                                              Filesize

                                              3.4MB

                                              MD5

                                              3a16d0e4e4522073da3c8a5a9f9e790b

                                              SHA1

                                              7a42a21a348d2e49c67b426d333a5c354ed2c83e

                                              SHA256

                                              ccc4dd64df98c26da462a17a8df9f927d02e202d88ada8cfba92b7bbeb954c3e

                                              SHA512

                                              1213c3e077b660afa65133f0b5943bd866f02d736284791dc99ae4d30c6ed7705eb55999cb4a3be1cc0a394111904154bc72a2d0f1fdc453893ecf9a4a25b99a

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\1012387001\22265c8938.exe
                                              Filesize

                                              948KB

                                              MD5

                                              5d07496592fcbb447233327756e6605f

                                              SHA1

                                              8b443c3fe93a1da708859be38bb3f54b3b749a55

                                              SHA256

                                              844bfb44822d04e6ddfebd86492bb85af519234b1675e178402f7f61723bee8e

                                              SHA512

                                              ebbc673400d148251458067b41b9139ab36015a8802724b1e92b3b7196a597807c475fc18b04817ec6fe17ba831a24fcbdd4f561cd879d77a8cdca15e23f5a82

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\1012388001\f20d54380a.exe
                                              Filesize

                                              2.7MB

                                              MD5

                                              a5ebf91bcc1e092e07a46d6c90127358

                                              SHA1

                                              19459f6f1a555563c2f86d1ddd48072e2f5e32a2

                                              SHA256

                                              af6c8125aaedec62ccfc4eec54c4dd8687c4baec2c82b968997c2410f360b553

                                              SHA512

                                              5fb412413b505da08effcc0f5e59f53491796d826a14b3e4878b010788aa3c5532dfcacb08c1f248c31466b64e17a62aa9718d8084883fefd5de1ffa3c857b5f

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\1012389001\de9d19d804.exe
                                              Filesize

                                              1.9MB

                                              MD5

                                              6d00ea43be88c32392e2a3b543d0a1f4

                                              SHA1

                                              1dfb0cb50425d6bf72467ae0894d614f26f0b987

                                              SHA256

                                              747ebc458a95ab80f371b899d4b6e54eaefba46bf5343ae39eeeafba61ba8365

                                              SHA512

                                              f111a1b9812891d9ddda571e798545743ff9628bcf2c258a9fcb34a89b3d5286a2882d9d635c16062d974aac4d11904ac95fcbb45ecce38aa0e314cba7e7bbbf

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\1012390001\5e74145c03.exe
                                              Filesize

                                              4.3MB

                                              MD5

                                              72950603b12d5d99f2ebcedeb3aed5d6

                                              SHA1

                                              3587c298d27279b481f9efa0c02be575b6a06599

                                              SHA256

                                              76d86e157a4fa1f1b3abf649b931cdc91af733e2b50a863cc9a1dcbb131148b4

                                              SHA512

                                              1fbcb1f8793eab0107924f6ec8789eb1752fd39eb4683193b6962803911abbb7ff1d05a362dec349c768e656f7f84144150b06a35e13f74d60afe422cbb407c8

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\1012391001\rhnew.exe
                                              Filesize

                                              1.8MB

                                              MD5

                                              f7286fef9317fe91e24cda721ec0be81

                                              SHA1

                                              0e0197c0f87200f7c1ebb4bba314f7bb875a638c

                                              SHA256

                                              4dcf1cc20990dace1f3e7c5a4b94ea7b823f90eb6de639b2b1b6494838f1cc62

                                              SHA512

                                              314b3f5cf1a0c15db568d33647b97887b37e987ba253ee9f5ded045446328307ebd04acd832fbdf66ad29be9510bd0c378e2fcb889509dca84df9b9106602c6e

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\P8T75.exe
                                              Filesize

                                              5.2MB

                                              MD5

                                              b04cd1dff802a93a245735fac6173cab

                                              SHA1

                                              0bb3f803ec9e33354a43a6abb83befe8c29c73d0

                                              SHA256

                                              295402a31804927453bc9390f5f59c7b6192113a7e3be03a49b4c63d2495e68c

                                              SHA512

                                              7271fbe5f28064fcc7b7ba572ce44b1b893b98a3494d918a46e5a50e256575262824e57eafd9b4635a734cf6adcef29a565ff38a8f0a4fe886ad56824acac3ac

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3D63U.exe
                                              Filesize

                                              4.9MB

                                              MD5

                                              941507da4995f8296b61a3a35d8b406d

                                              SHA1

                                              a90f5209ca0d56938957ed8f5122de984e6ebbe4

                                              SHA256

                                              50e4484fb6ee4b27ba6e22b5d65e5da71a5699e92999cc0ea450d5c90f3b5361

                                              SHA512

                                              9762bca1fe65fcd816dc08e45a167a3321ee50778161a8241f0f42cb573528d9ffd714857d31192033b25f5654b2f3ec5e655c2238a7756403d77bf227109efd

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i0S89.exe
                                              Filesize

                                              3.6MB

                                              MD5

                                              fc8531305055d32622f6811e56dbb92a

                                              SHA1

                                              eaf8d7056e2f649451f91b995899322daacf6b2c

                                              SHA256

                                              c3d5fd58b4f6c23ad665656e5485b0d9f5782285a2a607c7d7ccd9954f481b88

                                              SHA512

                                              59813147cebcb22b65b13d0e89d8793ba504b75461a56af2a484f0e3480c4e057ea1c63573812e4d29412a25ad8c8a77088c5cabbe6d2cce8075840b8f56b16b

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1i63S2.exe
                                              Filesize

                                              3.1MB

                                              MD5

                                              adda161ed911255889132a0cd67b587a

                                              SHA1

                                              c1000389b0f756a47b86c67672c4a91dee8670ee

                                              SHA256

                                              e3aa3253019a984c83f1e01e43a821e4436eb848a33df82672b29f62f07866a6

                                              SHA512

                                              5f8c0e4d2ad1df6d0512289f2cddbbcadf8e9e81b32cb645e235a7e61d1b2c73aa72f80501757172f884b43490425be04339ce7ea03a76b8cd8bda40c8920fce

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2P0360.exe
                                              Filesize

                                              1.8MB

                                              MD5

                                              8679b0deef4b3d4f9cd8f90d0b339072

                                              SHA1

                                              ca4b77ad94e677808c5f830c0dd1912c0ae73636

                                              SHA256

                                              0d1fea700dd2a7efde5e2b34ad0416bcb65200b6253297c9b3fa157ca7d581b3

                                              SHA512

                                              502f101ccc1ba0fc03d6f68dd19768befc7ff84be3a0eba94ee66d0b75465ad48543636e486e9dd7cb879150b449ae324b7ee924e379bd3c43e9488b2a411b20

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ykbtt5is.qn0.ps1
                                              Filesize

                                              60B

                                              MD5

                                              d17fe0a3f47be24a6453e9ef58c94641

                                              SHA1

                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                              SHA256

                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                              SHA512

                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\is-A8B90.tmp\_isetup\_iscrypt.dll
                                              Filesize

                                              2KB

                                              MD5

                                              a69559718ab506675e907fe49deb71e9

                                              SHA1

                                              bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                              SHA256

                                              2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                              SHA512

                                              e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\is-F72Q6.tmp\i1A5m12.tmp
                                              Filesize

                                              689KB

                                              MD5

                                              e672d5907f1ce471d9784df64d8a306b

                                              SHA1

                                              6d094cae150d72b587c5480c15127d7059e16932

                                              SHA256

                                              9f9250be71bd6254790a9630990f4560d53995db3d8737b7f49986e3551283e5

                                              SHA512

                                              9cf10e997d8d99e6eb2f6ccac00ab365f63e03d96c2e2354fdf67683b85553a60cd9542cfb21cbea468c6a2bda454cde71937c0d21c4b738451b5e2c30690c39

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\is-HM0M5.tmp\_isetup\_shfoldr.dll
                                              Filesize

                                              22KB

                                              MD5

                                              92dc6ef532fbb4a5c3201469a5b5eb63

                                              SHA1

                                              3e89ff837147c16b4e41c30d6c796374e0b8e62c

                                              SHA256

                                              9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                                              SHA512

                                              9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                              Filesize

                                              479KB

                                              MD5

                                              09372174e83dbbf696ee732fd2e875bb

                                              SHA1

                                              ba360186ba650a769f9303f48b7200fb5eaccee1

                                              SHA256

                                              c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                              SHA512

                                              b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon-2
                                              Filesize

                                              13.8MB

                                              MD5

                                              0a8747a2ac9ac08ae9508f36c6d75692

                                              SHA1

                                              b287a96fd6cc12433adb42193dfe06111c38eaf0

                                              SHA256

                                              32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                              SHA512

                                              59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin
                                              Filesize

                                              12KB

                                              MD5

                                              f74f0de39842a83cbec95ec1dded4c1b

                                              SHA1

                                              d609af1c28f9edc491de40139401dcd45a7605ce

                                              SHA256

                                              bd4328a57ac0dec313527c64fd9832ab00a152b086d46dfd3cfba6220c912253

                                              SHA512

                                              3dcdeb6f656d4b8c5cf45c2cef2d08fa2f214cb82b825ee5b1901109ca26b7f7651ba03171ef3a5b27fc5612c3bb873d252bc86883d396ecd8da0b260a2a3c25

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin
                                              Filesize

                                              17KB

                                              MD5

                                              98d07627479d5105cf2fca7372760c9f

                                              SHA1

                                              bc5893dced851ba6ed5d4a4fba32a2874afcc2ca

                                              SHA256

                                              4894f00bb0993beea20c5aa2511ae5d88331778ce4daecc10353ff42de878131

                                              SHA512

                                              fedc37179d9b649594ad789de6b1d75612a33b397088e819adfdda1ce401538d7ec1edbc3bca8286454460d1186aafbd66c0b9586cb4ff0be5c01c9e3f88a6c5

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin
                                              Filesize

                                              6KB

                                              MD5

                                              d072c9bf17cc097bb0012f25afd78208

                                              SHA1

                                              21ea4b11d632a1239bce442b5195fdbd368a1e31

                                              SHA256

                                              d0ed7c40a1d9422711591d55b5e5b0e6c15987d477ffdae8b299281401adf43d

                                              SHA512

                                              5050cd658b1736709ee8099684e7db19a1e22b46611c5f2c825a0fd68856037640c9ca481213b6115dbcd70d80613c5e3c0b44a83e84a86b07cfc183acabc947

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin
                                              Filesize

                                              8KB

                                              MD5

                                              2ec9fd6e4300905b486241d3f30e7863

                                              SHA1

                                              f3f092d2af06a19cf8ac9249b835e37372f21285

                                              SHA256

                                              6e1d4097b599a5385676cb577c35e4e2be1d5d8715726330172e447398d3c914

                                              SHA512

                                              b35f6dc78522064a01142522186d7e9f5264fe351228db109c7d5eb42cc0623172cc08cf6eff5380765ef7d44b48efd829472791899deaa14fc08cfcd120fd03

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\cookies.sqlite-wal
                                              Filesize

                                              256KB

                                              MD5

                                              7d89d25f3563fd6a7fe1184eb97185b1

                                              SHA1

                                              094dc8e59b0538e04a52d7877321db5920ead2a9

                                              SHA256

                                              54e3b2e216de4308de420833fab221c4b672691bbf445424b0cd8a5f5811fa12

                                              SHA512

                                              2850aeadc47ce67c2800307622d06c21c5deb2f5a6758213d85b131c09bb9262cace3dd5d8938fe0271d44b12e81d9f24477fa2fb2c347d7dc08cb523d2bf0f3

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.bin
                                              Filesize

                                              27KB

                                              MD5

                                              3387a201525aa0fecd2fbf55d87e4ca8

                                              SHA1

                                              07ffcf6b875adb32dba8fba742d64a9647a00203

                                              SHA256

                                              884fc5ac5d4ce9192c5caa0b09ed2ebffec300b9a98e6ff0ffdd9039c0a334cf

                                              SHA512

                                              ea55fb2b6fc698c07df750f412cc5e84d033159b3aacca0cf1eac6ce3315f9242f876b8b3cdc589b25a91255670c65c99863a203c3ea3c6aeefbdde0fd649f14

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.bin
                                              Filesize

                                              23KB

                                              MD5

                                              77ee91159b155356b14a3c00a43329b0

                                              SHA1

                                              3788c18aa8b7ab6c433a4859caf2e4da08ad0d64

                                              SHA256

                                              2fc43178c6c7911eafe1984277c795d6ac9815b0ce44817d648ad09624d5004c

                                              SHA512

                                              e8b7724d518c625e36405aeff8c17b7f652e659611a4de58673ff47246502275d5fd3a6c40da6afad20507229f38860e6ab7803150206780778e54fdefe45694

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.bin
                                              Filesize

                                              5KB

                                              MD5

                                              99bb61ccf147a23882007a5f29de90bf

                                              SHA1

                                              d8bffad13de890b877dfaba12d44b7948ba79efd

                                              SHA256

                                              d33cda5964abaf76cf18cfac5771795efb768b81bf7720af63bef7c0f9aceb2c

                                              SHA512

                                              9ea87916dcfa7816e3ab2b6e23fa098c6fe0b55cdf912e8b0f7da4521e69b856dc8488378125bfbd126ce9f543886f4bb28127ee2baaf99346fdc84abfe205b0

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp
                                              Filesize

                                              27KB

                                              MD5

                                              d3b6fc6c50287e76334e6ba9349ff5b7

                                              SHA1

                                              03cdfccf3c20bccde6dba090135a3a5a22d05ccb

                                              SHA256

                                              ddc8982d85c39b66473fa4af9ece11f80978a64b993a6e62d5e40f5cc36d6b1a

                                              SHA512

                                              88eb572b4b6c4a8a88563eb76a2bd078bab0cd2435b1f76c70aa0ef7b004c499ed8d788afb18b454c92cc0ee03a03f47d1e0720bb27719b1c91a69cbc4f8c3cd

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp
                                              Filesize

                                              27KB

                                              MD5

                                              2df802d1c4f68ec14bbe16dc7b78e69c

                                              SHA1

                                              f2c9befc1facbdfa7ac9c42c1863340abd727429

                                              SHA256

                                              9182c0dd37fc3a6d6faab8a362e5a9be525d1c9833b50f8430db4af92c330529

                                              SHA512

                                              d3662680e629b68eac325f5d3d2c13b0847d13f962aee24f0ead43dcdee8ea062ae36ef43794a29178dc6e3944aa3ed490465b84a4b964f0b2d9a36069e77e1a

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp
                                              Filesize

                                              5KB

                                              MD5

                                              ef4310b7ea83210b9e0fadd4bddbc4e2

                                              SHA1

                                              8f09f6547a22e3b8e6f3c324ec670c614bc7ed5a

                                              SHA256

                                              a46a382960f1e7879b055ed9d9c949575d4592210ad2e4ef6673975795826e42

                                              SHA512

                                              7960e1f9ac4721fed1b4bef8b1e28b43cd9c752f00822d16bf0590efe24da095a71b146de81c035f72222829809f591cea953ebb9b5cd261f69a52ca2f8f0741

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp
                                              Filesize

                                              6KB

                                              MD5

                                              e8b085b1072672ffadecae226b922092

                                              SHA1

                                              544f4f424437c074c1a9ec32bd0232cdd17af39f

                                              SHA256

                                              58b1b852b4f38b23d3758619a610f7e5ee34e80d17b7be562517d02190578f29

                                              SHA512

                                              c1070706b52b27031aafd3d820cad8461b10ff1af32b3fb91a3068cf97559f88e43829e2f075d4e68b544772b591d1d0529813a0be4e034c1381829dca4e604c

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\8006e345-e529-4300-9d1c-dfb025899548
                                              Filesize

                                              982B

                                              MD5

                                              471de061c42459ea28f96a9630befa7f

                                              SHA1

                                              97202a3e55cd201afd21ca4d089e198b8a17c878

                                              SHA256

                                              52db89268d9eef281c361d3488383464dc6d8859a7f9985b5d0ecaf820b1991f

                                              SHA512

                                              814d36f5a2bcfe42367348765e9a03268af7336738ad36dd890f2d04b4186e9bd4f104ddb7251b3a01b1d40d4e8494ed5e3f7cffdf8f438e05f762a16566b3a0

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\a64d6696-6256-468d-88db-ed4c783716cb
                                              Filesize

                                              26KB

                                              MD5

                                              6d769b3e5c2f1abed49d6529334491a5

                                              SHA1

                                              bb423363f6ca77df25be3bb6c1902e39d3c30eae

                                              SHA256

                                              06d26a5e5afea703b1da829772571f1bd7ed6953b76232431a12af4f5906b662

                                              SHA512

                                              1915ea1ddcd573a0e074e72e495df65d64c1471dd4c758ffa99b93187c3d9548505ccfd2932402acadbc2d356c3673501519cf10e7f76451b70f9f98a340cd8d

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\bbdad8c3-acb5-4791-abd4-9c0111c3704f
                                              Filesize

                                              671B

                                              MD5

                                              16fd487f605169a9a99628074383bd11

                                              SHA1

                                              0367b789ae1fd7cbfe4379dfe3af85afd3407127

                                              SHA256

                                              cdc503fe293685d81fcd7c07860f926e6789714a008dbe01334046cc630ce8af

                                              SHA512

                                              e87d7afe67eef136d26ec40745856e38d9a140169ac886c830daa132a4e9f54e27dba7cc8c3b49979a619f0a6028d8ee0c3affddb2df2f3d20c886a9fcb019f4

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                              Filesize

                                              1.1MB

                                              MD5

                                              842039753bf41fa5e11b3a1383061a87

                                              SHA1

                                              3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                              SHA256

                                              d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                              SHA512

                                              d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                              Filesize

                                              116B

                                              MD5

                                              2a461e9eb87fd1955cea740a3444ee7a

                                              SHA1

                                              b10755914c713f5a4677494dbe8a686ed458c3c5

                                              SHA256

                                              4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                              SHA512

                                              34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-widevinecdm\4.10.2710.0\LICENSE.txt.tmp
                                              Filesize

                                              479B

                                              MD5

                                              49ddb419d96dceb9069018535fb2e2fc

                                              SHA1

                                              62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                              SHA256

                                              2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                              SHA512

                                              48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                              Filesize

                                              372B

                                              MD5

                                              bf957ad58b55f64219ab3f793e374316

                                              SHA1

                                              a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                              SHA256

                                              bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                              SHA512

                                              79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                              Filesize

                                              17.8MB

                                              MD5

                                              daf7ef3acccab478aaa7d6dc1c60f865

                                              SHA1

                                              f8246162b97ce4a945feced27b6ea114366ff2ad

                                              SHA256

                                              bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                              SHA512

                                              5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.lib.tmp
                                              Filesize

                                              1KB

                                              MD5

                                              688bed3676d2104e7f17ae1cd2c59404

                                              SHA1

                                              952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                              SHA256

                                              33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                              SHA512

                                              7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.sig.tmp
                                              Filesize

                                              1KB

                                              MD5

                                              36e5ee071a6f2f03c5d3889de80b0f0d

                                              SHA1

                                              cf6e8ddb87660ef1ef84ae36f97548a2351ac604

                                              SHA256

                                              6be809d16e0944386e45cf605eae0cd2cf46f111d1a6fe999fec813d2c378683

                                              SHA512

                                              99b61896659e558a79f0e9be95286ebf01d31d13b71df6db4923406e88b3ba72584ef2b62e073b2f5e06901af2c7d1b92d3d12187fe5b4b29c9dd2678444f34e

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\places.sqlite-wal
                                              Filesize

                                              1.4MB

                                              MD5

                                              a0c423d98bc6891e8bc6fdefaee5ccf8

                                              SHA1

                                              35a5e2c7d9cb7f5467bb3463e8e4aebfd1cf4c6c

                                              SHA256

                                              e12a4865ff868f2ff18850b50ba9af75f760230945a224935f19221d79fd4e37

                                              SHA512

                                              ec8022034fffe931e9ff0af467a405850b42ffeabfa58ac2a7df3a9445fdd49d27c6ddc89295318f67f2752f43d7b7eb29e9646a82f63717ca579d503a4d5a8e

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs-1.js
                                              Filesize

                                              10KB

                                              MD5

                                              a9732cadf34ee9e3a2d6af34726599e4

                                              SHA1

                                              0df24593bf867b8fa954167392c49ce517438edd

                                              SHA256

                                              32b31adbbc6d0120cb94983e9b1f0279692f0cc6f8b25473222ac003609cd98a

                                              SHA512

                                              df90b8e9083a0da8e5d035c5440ff8c60fd589d0209e2f33f356b7df9aecef094760f54cf3a3318a7d9cdb70f5faa649b16c5cdd9a49530493366a19e681edcd

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs-1.js
                                              Filesize

                                              11KB

                                              MD5

                                              4181f54348bf7f974043996e62cf22a0

                                              SHA1

                                              6501d8fb2d1f9fee15626a05df8d857cdaf11db0

                                              SHA256

                                              0df8c1a64998702506efa672d1b59592e227a46a867051eb0bdaace65ae09244

                                              SHA512

                                              d01a25b2fea9fbfa0bdbe4461ab98732b719e297dbe48cc716f975fdea4c2a1939fc69caeb6e0de336848af899c500899bbd07ec21a35d2c0115926badb9fefa

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs.js
                                              Filesize

                                              10KB

                                              MD5

                                              938702ae8e34825c4358c1c5a4a25e8d

                                              SHA1

                                              29d7035a74c90d4a165ac8608d06e7a741f84dbd

                                              SHA256

                                              59a6106f22e62603cb5833722384015c23e0c8aaf4a858fca327f189c59dda8c

                                              SHA512

                                              da4c3a6dc379abeca73b46a75d189aca6a46de133ccda9bdd617ef6116589d8200190f51c5ad4b76125c62b68853975a1a5df2ff132ebc08cce4ad3d950f2087

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs.js
                                              Filesize

                                              10KB

                                              MD5

                                              faf8da62453b1a4abc2eaecf2a2aa5a9

                                              SHA1

                                              cb162d67c33361a7b1c23c5e2d5d2c2fdad6df01

                                              SHA256

                                              66d71a512c102fc51671147ea9c717a261d9f16d391b8917fed8bd90bff81fdb

                                              SHA512

                                              43d72b1249739cb4e78cf4fdc29d7ecd60fea01d2f3fda25767fee005954e5dc06236bbc45cae94168c97b6a282e6260794c06b24492b6c650efd140e7eb6967

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                              Filesize

                                              640KB

                                              MD5

                                              825d0de9ae62b9d84781e23f3139adc9

                                              SHA1

                                              205be8e8b573d4176a89c448e12c8d09294ba7de

                                              SHA256

                                              2d4163a55a9141ec343815c99acd8b45b00bf3ef6e17695ef2a647f2bbe1639e

                                              SHA512

                                              72951043d39febe3f30fa2a9ba8c414c74f85a8d4f1fa706f4dff1645c51e1fbe96c24aa2a10308d8561da3b1c15ec45cec8b32faccca6b6e186057a4248015f

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                              Filesize

                                              1.5MB

                                              MD5

                                              e6ec98eb647268bc793b6ab188b3a9ee

                                              SHA1

                                              1fef40b9a57ee5ef8f98f8133d4609a60fcc85dd

                                              SHA256

                                              8896ae7cf85626de5b4c3fd643a8b92a109d1d7214d948267e64607eb39971bc

                                              SHA512

                                              ae9cad525320e3dbf86421bdc3a60df871d8387f0ef5a3c60748d3333494841c445f3aeab68edc6a6d098bcd42b20af16b19dae1c5e6c2e596fc811ce430af6e

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                              Filesize

                                              1.6MB

                                              MD5

                                              e03d6e611173e83621c52c953a66448f

                                              SHA1

                                              9f7d7161b89f1da1d9f45c9ded78170a555b7dbc

                                              SHA256

                                              361ed678b835c2bb6ee8e29aa500bd7731b5ab6c5235188ebe6501d95b17239e

                                              SHA512

                                              4b3be9b7ea83f00795462fd4c591f86b2ac0c3e610df3a91df061806ecd17b951469321ecbeaf54176e27f07378effea12fb1a1f926792b8ed0cbc67195336cc

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
                                              Filesize

                                              124KB

                                              MD5

                                              0d3418372c854ee228b78e16ea7059be

                                              SHA1

                                              c0a29d4e74d39308a50f4fd21d0cca1f98cb02c1

                                              SHA256

                                              885bf0b3b12b77ef3f953fbb48def1b45079faa2a4d574ee16afdbafa1de3ac7

                                              SHA512

                                              e30dced307e04ae664367a998cd1ba36349e99e363f70897b5d90c898de2c69c393182c3afba63a74956b5e6f49f0635468e88ed31dd1e3c86c21e987ddd2c19

                                              Download Submit

                                            • memory/760-68-0x0000000000B00000-0x0000000000FCD000-memory.dmp

                                              Filesize

                                              4.8MB

                                              Download

                                            • memory/760-1203-0x0000000000B00000-0x0000000000FCD000-memory.dmp

                                              Filesize

                                              4.8MB

                                              Download

                                            • memory/760-872-0x0000000000B00000-0x0000000000FCD000-memory.dmp

                                              Filesize

                                              4.8MB

                                              Download

                                            • memory/760-1347-0x0000000000B00000-0x0000000000FCD000-memory.dmp

                                              Filesize

                                              4.8MB

                                              Download

                                            • memory/760-146-0x0000000000B00000-0x0000000000FCD000-memory.dmp

                                              Filesize

                                              4.8MB

                                              Download

                                            • memory/760-147-0x0000000000B00000-0x0000000000FCD000-memory.dmp

                                              Filesize

                                              4.8MB

                                              Download

                                            • memory/1388-313-0x0000000000660000-0x0000000000AEB000-memory.dmp

                                              Filesize

                                              4.5MB

                                              Download

                                            • memory/1388-1163-0x0000000000660000-0x0000000000AEB000-memory.dmp

                                              Filesize

                                              4.5MB

                                              Download

                                            • memory/1388-312-0x0000000000660000-0x0000000000AEB000-memory.dmp

                                              Filesize

                                              4.5MB

                                              Download

                                            • memory/1388-145-0x0000000000660000-0x0000000000AEB000-memory.dmp

                                              Filesize

                                              4.5MB

                                              Download

                                            • memory/1388-1179-0x0000000000660000-0x0000000000AEB000-memory.dmp

                                              Filesize

                                              4.5MB

                                              Download

                                            • memory/1608-260-0x0000000000F40000-0x00000000013D3000-memory.dmp

                                              Filesize

                                              4.6MB

                                              Download

                                            • memory/1608-94-0x0000000000F40000-0x00000000013D3000-memory.dmp

                                              Filesize

                                              4.6MB

                                              Download

                                            • memory/1608-1074-0x0000000000F40000-0x00000000013D3000-memory.dmp

                                              Filesize

                                              4.6MB

                                              Download

                                            • memory/1608-1175-0x0000000000F40000-0x00000000013D3000-memory.dmp

                                              Filesize

                                              4.6MB

                                              Download

                                            • memory/1608-148-0x0000000000F40000-0x00000000013D3000-memory.dmp

                                              Filesize

                                              4.6MB

                                              Download

                                            • memory/2212-1075-0x0000000000400000-0x0000000000414000-memory.dmp

                                              Filesize

                                              80KB

                                              Download

                                            • memory/2212-180-0x0000000000400000-0x0000000000414000-memory.dmp

                                              Filesize

                                              80KB

                                              Download

                                            • memory/2544-308-0x0000000000430000-0x000000000072B000-memory.dmp

                                              Filesize

                                              3.0MB

                                              Download

                                            • memory/2544-243-0x0000000000430000-0x000000000072B000-memory.dmp

                                              Filesize

                                              3.0MB

                                              Download

                                            • memory/2572-874-0x00000000009E0000-0x0000000000C9C000-memory.dmp

                                              Filesize

                                              2.7MB

                                              Download

                                            • memory/2572-347-0x00000000009E0000-0x0000000000C9C000-memory.dmp

                                              Filesize

                                              2.7MB

                                              Download

                                            • memory/2572-873-0x00000000009E0000-0x0000000000C9C000-memory.dmp

                                              Filesize

                                              2.7MB

                                              Download

                                            • memory/2572-1265-0x00000000009E0000-0x0000000000C9C000-memory.dmp

                                              Filesize

                                              2.7MB

                                              Download

                                            • memory/2572-1178-0x00000000009E0000-0x0000000000C9C000-memory.dmp

                                              Filesize

                                              2.7MB

                                              Download

                                            • memory/3464-133-0x0000000000400000-0x0000000000452000-memory.dmp

                                              Filesize

                                              328KB

                                              Download

                                            • memory/3464-136-0x0000000000400000-0x0000000000452000-memory.dmp

                                              Filesize

                                              328KB

                                              Download

                                            • memory/3464-138-0x0000000000400000-0x0000000000452000-memory.dmp

                                              Filesize

                                              328KB

                                              Download

                                            • memory/3568-32-0x0000000000A20000-0x0000000000D3F000-memory.dmp

                                              Filesize

                                              3.1MB

                                              Download

                                            • memory/3568-21-0x0000000000A20000-0x0000000000D3F000-memory.dmp

                                              Filesize

                                              3.1MB

                                              Download

                                            • memory/3700-33-0x0000000000240000-0x000000000055F000-memory.dmp

                                              Filesize

                                              3.1MB

                                              Download

                                            • memory/3700-1318-0x0000000000240000-0x000000000055F000-memory.dmp

                                              Filesize

                                              3.1MB

                                              Download

                                            • memory/3700-274-0x0000000000240000-0x000000000055F000-memory.dmp

                                              Filesize

                                              3.1MB

                                              Download

                                            • memory/3700-103-0x0000000000240000-0x000000000055F000-memory.dmp

                                              Filesize

                                              3.1MB

                                              Download

                                            • memory/3700-1104-0x0000000000240000-0x000000000055F000-memory.dmp

                                              Filesize

                                              3.1MB

                                              Download

                                            • memory/3700-69-0x0000000000240000-0x000000000055F000-memory.dmp

                                              Filesize

                                              3.1MB

                                              Download

                                            • memory/3972-67-0x00000000006B0000-0x0000000000B7D000-memory.dmp

                                              Filesize

                                              4.8MB

                                              Download

                                            • memory/3972-54-0x00000000006B0000-0x0000000000B7D000-memory.dmp

                                              Filesize

                                              4.8MB

                                              Download

                                            • memory/3976-261-0x0000000000400000-0x00000000006DF000-memory.dmp

                                              Filesize

                                              2.9MB

                                              Download

                                            • memory/3976-257-0x0000000000400000-0x00000000006DF000-memory.dmp

                                              Filesize

                                              2.9MB

                                              Download

                                            • memory/3976-1079-0x0000000000400000-0x00000000006DF000-memory.dmp

                                              Filesize

                                              2.9MB

                                              Download

                                            • memory/3976-1078-0x0000000060900000-0x0000000060992000-memory.dmp

                                              Filesize

                                              584KB

                                              Download

                                            • memory/3976-1316-0x0000000000400000-0x00000000006DF000-memory.dmp

                                              Filesize

                                              2.9MB

                                              Download

                                            • memory/4196-1176-0x0000000000F20000-0x0000000001415000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/4196-1249-0x0000000000F20000-0x0000000001415000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/4196-1164-0x0000000000F20000-0x0000000001415000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/4196-321-0x0000000000F20000-0x0000000001415000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/4332-157-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                              Filesize

                                              972KB

                                              Download

                                            • memory/4332-1177-0x0000000000170000-0x00000000003D1000-memory.dmp

                                              Filesize

                                              2.4MB

                                              Download

                                            • memory/4332-102-0x0000000000170000-0x00000000003D1000-memory.dmp

                                              Filesize

                                              2.4MB

                                              Download

                                            • memory/4596-1366-0x0000000000400000-0x0000000000C4D000-memory.dmp

                                              Filesize

                                              8.3MB

                                              Download

                                            • memory/4596-1368-0x0000000000400000-0x0000000000C4D000-memory.dmp

                                              Filesize

                                              8.3MB

                                              Download

                                            • memory/4596-3092-0x0000000000400000-0x0000000000C4D000-memory.dmp

                                              Filesize

                                              8.3MB

                                              Download

                                            • memory/4596-1369-0x0000000000400000-0x0000000000C4D000-memory.dmp

                                              Filesize

                                              8.3MB

                                              Download

                                            • memory/4596-1465-0x0000000000400000-0x0000000000C4D000-memory.dmp

                                              Filesize

                                              8.3MB

                                              Download

                                            • memory/4596-1367-0x0000000000400000-0x0000000000C4D000-memory.dmp

                                              Filesize

                                              8.3MB

                                              Download

                                            • memory/4596-1370-0x0000000000400000-0x0000000000C4D000-memory.dmp

                                              Filesize

                                              8.3MB

                                              Download

                                            • memory/4624-1618-0x00000000009C0000-0x0000000000EB5000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/4624-1508-0x00000000009C0000-0x0000000000EB5000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/5020-38-0x00000000008F0000-0x0000000000D92000-memory.dmp

                                              Filesize

                                              4.6MB

                                              Download

                                            • memory/5020-92-0x00000000008F0000-0x0000000000D92000-memory.dmp

                                              Filesize

                                              4.6MB

                                              Download

                                            • memory/5020-317-0x00000000008F0000-0x0000000000D92000-memory.dmp

                                              Filesize

                                              4.6MB

                                              Download

                                            • memory/5020-275-0x00000000008F0000-0x0000000000D92000-memory.dmp

                                              Filesize

                                              4.6MB

                                              Download

                                            • memory/5020-104-0x00000000008F0000-0x0000000000D92000-memory.dmp

                                              Filesize

                                              4.6MB

                                              Download

                                            • memory/5096-1076-0x0000000000400000-0x00000000004BC000-memory.dmp

                                              Filesize

                                              752KB

                                              Download

                                            • memory/5556-1382-0x0000000000910000-0x0000000000DA3000-memory.dmp

                                              Filesize

                                              4.6MB

                                              Download

                                            • memory/5556-1335-0x0000000000910000-0x0000000000DA3000-memory.dmp

                                              Filesize

                                              4.6MB

                                              Download

                                            • memory/5556-2361-0x0000000000910000-0x0000000000DA3000-memory.dmp

                                              Filesize

                                              4.6MB

                                              Download

                                            • memory/5840-1346-0x0000000000B00000-0x0000000000FCD000-memory.dmp

                                              Filesize

                                              4.8MB

                                              Download

                                            • memory/5840-1342-0x0000000000B00000-0x0000000000FCD000-memory.dmp

                                              Filesize

                                              4.8MB

                                              Download

                                            • memory/5844-1341-0x0000000000240000-0x000000000055F000-memory.dmp

                                              Filesize

                                              3.1MB

                                              Download

                                            • memory/5844-1344-0x0000000000240000-0x000000000055F000-memory.dmp

                                              Filesize

                                              3.1MB

                                              Download

                                            • memory/6024-1299-0x0000000000400000-0x0000000000C78000-memory.dmp

                                              Filesize

                                              8.5MB

                                              Download

                                            • memory/6024-1319-0x0000000000400000-0x0000000000C78000-memory.dmp

                                              Filesize

                                              8.5MB

                                              Download

                                            • memory/6024-1126-0x0000000000400000-0x0000000000C78000-memory.dmp

                                              Filesize

                                              8.5MB

                                              Download

                                            • memory/6156-1864-0x000002A2FC190000-0x000002A2FC1B2000-memory.dmp

                                              Filesize

                                              136KB

                                              Download

                                            • memory/6820-1348-0x0000000000400000-0x0000000000414000-memory.dmp

                                              Filesize

                                              80KB

                                              Download

                                            • memory/6820-1197-0x0000000000400000-0x0000000000414000-memory.dmp

                                              Filesize

                                              80KB

                                              Download

                                            • memory/6864-1349-0x0000000000400000-0x00000000004BC000-memory.dmp

                                              Filesize

                                              752KB

                                              Download

                                            • memory/7024-1234-0x0000000000400000-0x00000000006DF000-memory.dmp

                                              Filesize

                                              2.9MB

                                              Download

                                            • memory/7024-1365-0x0000000060900000-0x0000000060992000-memory.dmp

                                              Filesize

                                              584KB

                                              Download

                                            • memory/7024-1340-0x0000000000400000-0x00000000006DF000-memory.dmp

                                              Filesize

                                              2.9MB

                                              Download

                                            • memory/7024-1364-0x0000000000400000-0x00000000006DF000-memory.dmp

                                              Filesize

                                              2.9MB

                                              Download

                                            • memory/7060-1239-0x0000000000200000-0x000000000085B000-memory.dmp

                                              Filesize

                                              6.4MB

                                              Download

                                            • memory/7156-2025-0x0000011CFDA10000-0x0000011CFDA1A000-memory.dmp

                                              Filesize

                                              40KB

                                              Download

                                            • memory/7156-2078-0x0000011CFDF50000-0x0000011CFDF56000-memory.dmp

                                              Filesize

                                              24KB

                                              Download

                                            • memory/7156-2079-0x0000011CFE3F0000-0x0000011CFE3FA000-memory.dmp

                                              Filesize

                                              40KB

                                              Download

                                            • memory/7156-2077-0x0000011CFDF40000-0x0000011CFDF48000-memory.dmp

                                              Filesize

                                              32KB

                                              Download

                                            • memory/7156-2076-0x0000011CFE3D0000-0x0000011CFE3EA000-memory.dmp

                                              Filesize

                                              104KB

                                              Download

                                            • memory/7156-2067-0x0000011CFDA20000-0x0000011CFDA2A000-memory.dmp

                                              Filesize

                                              40KB

                                              Download

                                            • memory/7156-2034-0x0000011CFE3B0000-0x0000011CFE3CC000-memory.dmp

                                              Filesize

                                              112KB

                                              Download

                                            • memory/7156-2015-0x0000011CFDE80000-0x0000011CFDF35000-memory.dmp

                                              Filesize

                                              724KB

                                              Download

                                            • memory/7156-2014-0x0000011CFD9F0000-0x0000011CFDA0C000-memory.dmp

                                              Filesize

                                              112KB

                                              Download

                                            • memory/7164-1283-0x0000000005F80000-0x0000000005F9E000-memory.dmp

                                              Filesize

                                              120KB

                                              Download

                                            • memory/7164-1287-0x00000000064E0000-0x0000000006502000-memory.dmp

                                              Filesize

                                              136KB

                                              Download

                                            • memory/7164-1264-0x0000000005910000-0x0000000005C64000-memory.dmp

                                              Filesize

                                              3.3MB

                                              Download

                                            • memory/7164-1251-0x0000000005830000-0x0000000005896000-memory.dmp

                                              Filesize

                                              408KB

                                              Download

                                            • memory/7164-1250-0x0000000005790000-0x00000000057B2000-memory.dmp

                                              Filesize

                                              136KB

                                              Download

                                            • memory/7164-1296-0x00000000077C0000-0x0000000007D64000-memory.dmp

                                              Filesize

                                              5.6MB

                                              Download

                                            • memory/7164-1242-0x0000000002950000-0x0000000002986000-memory.dmp

                                              Filesize

                                              216KB

                                              Download

                                            • memory/7164-1252-0x00000000058A0000-0x0000000005906000-memory.dmp

                                              Filesize

                                              408KB

                                              Download

                                            • memory/7164-1247-0x00000000050B0000-0x00000000056D8000-memory.dmp

                                              Filesize

                                              6.2MB

                                              Download

                                            • memory/7164-1286-0x0000000006490000-0x00000000064AA000-memory.dmp

                                              Filesize

                                              104KB

                                              Download

                                            • memory/7164-1285-0x0000000007170000-0x0000000007206000-memory.dmp

                                              Filesize

                                              600KB

                                              Download

                                            • memory/7164-1284-0x0000000005FB0000-0x0000000005FFC000-memory.dmp

                                              Filesize

                                              304KB

                                              Download

                                            • memory/7536-1262-0x0000000000670000-0x000000000092C000-memory.dmp

                                              Filesize

                                              2.7MB

                                              Download

                                            • memory/7536-1375-0x0000000000670000-0x000000000092C000-memory.dmp

                                              Filesize

                                              2.7MB

                                              Download

                                            • memory/7536-1280-0x0000000000670000-0x000000000092C000-memory.dmp

                                              Filesize

                                              2.7MB

                                              Download

                                            • memory/7536-1281-0x0000000000670000-0x000000000092C000-memory.dmp

                                              Filesize

                                              2.7MB

                                              Download

                                            • memory/7536-1343-0x0000000000670000-0x000000000092C000-memory.dmp

                                              Filesize

                                              2.7MB

                                              Download

                                            • memory/7904-1282-0x00000000006C0000-0x000000000138E000-memory.dmp

                                              Filesize

                                              12.8MB

                                              Download

                                            • memory/7904-1350-0x00000000006C0000-0x000000000138E000-memory.dmp

                                              Filesize

                                              12.8MB

                                              Download

                                            • memory/7904-1373-0x00000000006C0000-0x000000000138E000-memory.dmp

                                              Filesize

                                              12.8MB

                                              Download