Overview

overview

10

Static

static

3

4119e8730f...dc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-12-2024 14:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4119e8730fb745bf623cd5aa2b1370177e81bef5a41beefc5fcf2e3c1bc144dc.exe

  • Size

    7.0MB

  • MD5

    d01f704a885c72070c28c7bd0299ace6

  • SHA1

    dcbb42da49513f1c7fe852fbc57b2f62723ecec1

  • SHA256

    4119e8730fb745bf623cd5aa2b1370177e81bef5a41beefc5fcf2e3c1bc144dc

  • SHA512

    58637fc7850480c32f39d986bde3ff3839f6db5674d226b0908550acde2bc87bf78895d8622b4cb5c53a01710858ab6ad21bd4cf0205ec934909ffb718c40824

  • SSDEEP

    196608:7Sz3OgQIV802q1mN1H4RNDrSdktRmz5FNY:W6gQIVJmNd2PSWtM5M

Score
10/10
amadeygcleanerlummastealc9c9aa5stokdiscoveryevasionloaderpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://covery-mover.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 12 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 24 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 18 IoCs
  • Identifies Wine through registry keys 2 TTPs 12 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 3 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\4119e8730fb745bf623cd5aa2b1370177e81bef5a41beefc5fcf2e3c1bc144dc.exe
    "C:\Users\Admin\AppData\Local\Temp\4119e8730fb745bf623cd5aa2b1370177e81bef5a41beefc5fcf2e3c1bc144dc.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5072
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Q0B50.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Q0B50.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4940
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\R9u17.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\R9u17.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3596
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1S32P8.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1S32P8.exe
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3432
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2692
            • C:\Users\Admin\AppData\Local\Temp\1013725001\UkYEOVR.exe
              "C:\Users\Admin\AppData\Local\Temp\1013725001\UkYEOVR.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:3084
              • C:\Windows\SysWOW64\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\dllnet\yLU75wsHgukerTkv.vbe"
                7⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4756
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\dllnet\J0k4As.bat" "
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4496
                  • C:\Windows\SysWOW64\reg.exe
                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Modifies registry key
                    PID:2580
                  • C:\dllnet\HyperServerFontdll.exe
                    "C:\dllnet/HyperServerFontdll.exe"
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Drops file in Windows directory
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:884
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dbrHtHKuPe.bat"
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4848
                      • C:\Windows\system32\chcp.com
                        chcp 65001
                        11⤵
                          PID:5012
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          11⤵
                            PID:3800
                          • C:\Windows\GameBarPresenceWriter\SppExtComObj.exe
                            "C:\Windows\GameBarPresenceWriter\SppExtComObj.exe"
                            11⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1616
                • C:\Users\Admin\AppData\Local\Temp\1013730001\1e15477756.exe
                  "C:\Users\Admin\AppData\Local\Temp\1013730001\1e15477756.exe"
                  6⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3936
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 772
                    7⤵
                    • Program crash
                    PID:5540
                • C:\Users\Admin\AppData\Local\Temp\1013731001\e50042237e.exe
                  "C:\Users\Admin\AppData\Local\Temp\1013731001\e50042237e.exe"
                  6⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4636
                • C:\Users\Admin\AppData\Local\Temp\1013732001\1f7b2135d0.exe
                  "C:\Users\Admin\AppData\Local\Temp\1013732001\1f7b2135d0.exe"
                  6⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:4084
                • C:\Users\Admin\AppData\Local\Temp\1013733001\d2e15a48ed.exe
                  "C:\Users\Admin\AppData\Local\Temp\1013733001\d2e15a48ed.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:320
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM firefox.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:464
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM chrome.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2724
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM msedge.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3964
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM opera.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1124
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM brave.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4828
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                    7⤵
                      PID:1376
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                        8⤵
                        • Checks processor information in registry
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        PID:4952
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2024 -parentBuildID 20240401114208 -prefsHandle 1952 -prefMapHandle 1944 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e4becdf-e324-43c0-bb21-fcd321ff5556} 4952 "\\.\pipe\gecko-crash-server-pipe.4952" gpu
                          9⤵
                            PID:2404
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2460 -parentBuildID 20240401114208 -prefsHandle 2452 -prefMapHandle 2448 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {665dd45a-1afa-47cf-a26e-2cc6d84a7b57} 4952 "\\.\pipe\gecko-crash-server-pipe.4952" socket
                            9⤵
                              PID:1512
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2832 -childID 1 -isForBrowser -prefsHandle 3216 -prefMapHandle 3240 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9e5e051-c246-4ab7-af1f-df8c93cef30c} 4952 "\\.\pipe\gecko-crash-server-pipe.4952" tab
                              9⤵
                                PID:1832
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3744 -childID 2 -isForBrowser -prefsHandle 3672 -prefMapHandle 3692 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3259571-8a55-4c2f-acc5-05b3da5c0db4} 4952 "\\.\pipe\gecko-crash-server-pipe.4952" tab
                                9⤵
                                  PID:4528
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4356 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4328 -prefMapHandle 4320 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {820e2856-d24d-42f5-8597-8339106445e0} 4952 "\\.\pipe\gecko-crash-server-pipe.4952" utility
                                  9⤵
                                  • Checks processor information in registry
                                  PID:5480
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5660 -childID 3 -isForBrowser -prefsHandle 5560 -prefMapHandle 5584 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e55553c8-5229-4bec-9e44-ff76d0688300} 4952 "\\.\pipe\gecko-crash-server-pipe.4952" tab
                                  9⤵
                                    PID:1396
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5784 -childID 4 -isForBrowser -prefsHandle 5792 -prefMapHandle 5796 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42d1f47d-64c1-4b09-afd5-8d3d9417abe6} 4952 "\\.\pipe\gecko-crash-server-pipe.4952" tab
                                    9⤵
                                      PID:1176
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6072 -childID 5 -isForBrowser -prefsHandle 5992 -prefMapHandle 6000 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9827479-e4bf-48e9-901b-161a265949c9} 4952 "\\.\pipe\gecko-crash-server-pipe.4952" tab
                                      9⤵
                                        PID:4260
                                • C:\Users\Admin\AppData\Local\Temp\1013734001\509b89bcc8.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1013734001\509b89bcc8.exe"
                                  6⤵
                                  • Modifies Windows Defender Real-time Protection settings
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Windows security modification
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1944
                            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2r5749.exe
                              C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2r5749.exe
                              4⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:448
                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3b39l.exe
                            C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3b39l.exe
                            3⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4716
                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4V308v.exe
                          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4V308v.exe
                          2⤵
                          • Modifies Windows Defender Real-time Protection settings
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Windows security modification
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4088
                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4540
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3936 -ip 3936
                        1⤵
                          PID:5500
                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:7136
                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:832

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Defense Evasion

                        Impair Defenses

                        2
                        T1562

                        Disable or Modify Tools

                        2
                        T1562.001

                        Modify Registry

                        4
                        T1112

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Unsecured Credentials

                        1
                        T1552

                        Credentials In Files

                        1
                        T1552.001

                        Discovery

                        Query Registry

                        6
                        T1012

                        System Information Discovery

                        4
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Lateral Movement

                        Collection

                        Data from Local System

                        1
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8R55UT9S\download[1].htm
                          Filesize

                          1B

                          MD5

                          cfcd208495d565ef66e7dff9f98764da

                          SHA1

                          b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                          SHA256

                          5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                          SHA512

                          31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\activity-stream.discovery_stream.json
                          Filesize

                          19KB

                          MD5

                          7d6161f21b3221208262829278b0a139

                          SHA1

                          c2e2df64838f0e740e922a9651c7e1fca2bb36b4

                          SHA256

                          0617ceb3099435f9ff95f2b4b66cbd47e838f7430bd486b0261dcb107c423012

                          SHA512

                          f9a2f41e0d0aa63086dae28a36e3739c54e41eece449ed894fb215f9c86c431d4274620c8cd558ddcf082c42254d931a78ae24b55b8c0b25aee0ba044078f525

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                          Filesize

                          13KB

                          MD5

                          13d5884d3e5c58ce9fe9e51850f863b3

                          SHA1

                          7bd130025b8a33871d8843e859f053b6358634ce

                          SHA256

                          9c6456c06c041a14ae07d1ccebc3aac3e186283371d29a2024638812157d7143

                          SHA512

                          2fddc57ebf2458f8bbecc46a88f46e77aa7e8e862a18391af885aadb8bd3c172de6fa00af3c19012bb85cc92f46a9a2655e8c95fd7716e6885fedb02c58fd0bc

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                          Filesize

                          15KB

                          MD5

                          96c542dec016d9ec1ecc4dddfcbaac66

                          SHA1

                          6199f7648bb744efa58acf7b96fee85d938389e4

                          SHA256

                          7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                          SHA512

                          cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1013725001\UkYEOVR.exe
                          Filesize

                          3.6MB

                          MD5

                          5400651ebb0ecd81c935230ef3da29fb

                          SHA1

                          051db5331dc3061a478d16188a71d07a331a0b47

                          SHA256

                          6a9b3fe4414a52544b0f34d301b969d090ea26fa0e50a804a9c6294a5ccc7438

                          SHA512

                          e50505e2b346eac15a7320719239f1e9004d8cbff072df7d76a84fd795ef3bc5c0a17c429d36bb9e81329f80f20546806f3582f29562884ebbab2be95e3ed96f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1013730001\1e15477756.exe
                          Filesize

                          1.9MB

                          MD5

                          89984b4d62b3092f0527fe87c1e5c6ca

                          SHA1

                          9bdcf0585839783b2086027c4102400f948c0d9b

                          SHA256

                          cab9ba56e264feaf0e2812b368b02800d0f6bfa7b205d040765c8d4a0e2b4407

                          SHA512

                          7a627fd2bdbc128b3675d04447bc1c32fb017fa106aafa90c8223840abdd2934d4db849a42acaa9c7b3c1ce2847d3914d42a05b89c069b435b5486c1011e7c84

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1013733001\d2e15a48ed.exe
                          Filesize

                          944KB

                          MD5

                          eb9df6ff210cf59f8a339562c9631e87

                          SHA1

                          28f91de3a4369e55d7403493b93a94f5f2b7b446

                          SHA256

                          e4805ce3e6fdcfbbc54733f42014f1566d4d51f18dba887f3e7cbb704dfd1929

                          SHA512

                          228d8e928cf64eb07d1bb87101bc4b080d62cbd4f53f739aef3284b5dd2981cd00aa31ddd157678668ec1b67c0d17a89643b3b04708265ade3ea5d6bc499ef1e

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4V308v.exe
                          Filesize

                          2.7MB

                          MD5

                          a53cb17121014c76f2aedbe320390342

                          SHA1

                          fa2a662deb2584787de6f315e1826f91c9f35e33

                          SHA256

                          5ef00189606675f868c482c3a876f9ce0192da23f3a5a1062a3230091d2fa44d

                          SHA512

                          9fca09d8303757885b844f6d69ea70fcd90ac8918fa8beb439c1183cebbe6ed6c52d3a7a15d691822679697a7fed3b1aa223c15c98d70fbd8f9e5ade002174be

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Q0B50.exe
                          Filesize

                          5.4MB

                          MD5

                          8ac721fe97bc448853d52fbb22d91b93

                          SHA1

                          9cd78d108492711a68984e7a2c8296f06d630d0d

                          SHA256

                          33b47b4e77d2b2398d9bd4978396da5e2b102ffb7556e3707faf8f549ca7770e

                          SHA512

                          4f8097802798659be58958e1e738d21728db0fb4d602ce8d49298a6131bc7385149225c7db1be7c8f8343bbdb22fbfb55139e1d65d78a1cc6d3cee52b93f3b5d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3b39l.exe
                          Filesize

                          1.7MB

                          MD5

                          95f63fa3b720dbdd825b33874765bb00

                          SHA1

                          b39bcf6209f6184962becb07ab717d88f6b0a526

                          SHA256

                          a5ecd7659644043041d439d1ce868cbdf7c56d326cf3df6a869042f5dd47ffd7

                          SHA512

                          f7d80a622ca15b38a234a5873cd3f28ff0a2f6a54a99a64edfa425e7c53c96de55bcb364554ea321719a8ca6905b85e6a7bf0055bb5231e9b85fdd514ae54f75

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\R9u17.exe
                          Filesize

                          3.6MB

                          MD5

                          a52b0bb38238c67efcecdec7d98df28f

                          SHA1

                          d89b0e6df6ad762d7d4870f5dbbc8662b7e20284

                          SHA256

                          4369b8b50e854f904676438aebd937ad268a2c3aa542240a4cebf2a9477e0729

                          SHA512

                          350ef886848c99aac24a552ad442f0cf74d9a1aa6b59d91f4a39085770aadaa0f97ed10ce639097b3dc49abaa384af32f501b303ad9365a29185e622f2b15a3f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1S32P8.exe
                          Filesize

                          3.1MB

                          MD5

                          78611a3fc5e7b0438f2c8f6879cc7b47

                          SHA1

                          31c9baea897285b112638c944e12d0577ddf885f

                          SHA256

                          1c87718ce93440a2ba962853a652e50a83edc6ac7b8210480b78089bcb46029f

                          SHA512

                          6f17b2f0fc739587bbfa268bfa4551640f5ad3a38a79dce9b47ac65da51916ed54b523d5b1832ce314636ad924a5610c3cc272bbcea6bc63d9bcd3ec4a68d53f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2r5749.exe
                          Filesize

                          1.8MB

                          MD5

                          e2c644f77e079e34dcc18c8760a65dd2

                          SHA1

                          fa1e85594550e49ed06bd24fb17e049a8c06ba01

                          SHA256

                          ae5c7d34410a6e33a3c14fd2b676d74f7f8327a73741423f786ad04c8b3615c9

                          SHA512

                          6383486a2a6f7619c04ed0de9f16c681586bd3832b7cd4b9e5becbcf02baa8ddcd5edeae4e5a9ecd6e0f905c565c919b5a3594e5e7e7df28c7564b4407c09867

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\dbrHtHKuPe.bat
                          Filesize

                          225B

                          MD5

                          e9fd23a4096c70b656800f799d891dd4

                          SHA1

                          2855164259fa13aed876e9d4e371cddbc451db26

                          SHA256

                          645faa3707d38fef0dea2945f4a13eba3e27ded20cfe1289fc88432858c3343b

                          SHA512

                          243600936e6a0fbfb0621f6154daf2a373ffcb22d4ea92320c118400796ef85996ea466866611aa5c645ca422ff987af3c3e7c51e7d9c6c7a5ddf1ebac5c3f29

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                          Filesize

                          479KB

                          MD5

                          09372174e83dbbf696ee732fd2e875bb

                          SHA1

                          ba360186ba650a769f9303f48b7200fb5eaccee1

                          SHA256

                          c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                          SHA512

                          b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                          Filesize

                          13.8MB

                          MD5

                          0a8747a2ac9ac08ae9508f36c6d75692

                          SHA1

                          b287a96fd6cc12433adb42193dfe06111c38eaf0

                          SHA256

                          32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                          SHA512

                          59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
                          Filesize

                          6KB

                          MD5

                          57d85827375b6fb4621ec8f7e9b76115

                          SHA1

                          6db283a24bed9b7e2eb49ab3ad368bf75d989803

                          SHA256

                          ef0cb85921b80347aa30f9fc1e72589ae4ef615ed225e8a483fdaa58b4be827a

                          SHA512

                          169e468491500a7faf09fbf6097db4dcdbe2cedd71e8c6b378761382e71b433119a2e400255a96b77739961c4358cf2924cf8e0d1e6366e279e6311d26adae44

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
                          Filesize

                          8KB

                          MD5

                          8cf2d0b318e0f22d5e9abfef190c75e7

                          SHA1

                          d400e6489f447ad9a0a9c613f085265ad7f66d93

                          SHA256

                          67d0d30b77ee5cef32feea39107b0b4988b2e59a4ec87eeb9c33b3e809de3caa

                          SHA512

                          39b2ee318568e212eed43322ba2f1e712c61977c45b8b375bce9936d17f0a067bd92a52ef121021d4b1c60fdd50d230da04cbcaeb4a67b3a210d65df7249045a

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
                          Filesize

                          13KB

                          MD5

                          18f159169eda638f2577e937d74e6511

                          SHA1

                          bde49cf63b7951f5d9d1eb9b8ca204f9fc38fe5a

                          SHA256

                          f63620c4ea5d937b4295489e1bb6e3aa6696cdf07b6e778d2777f499493a414e

                          SHA512

                          ceac239635d17cfe0a8b2f81e4a8ec2133369cf091460385179d7876b00e99c033eeeaffb1b05b0b0e377f3af803bf9d87526237e541798a61031ef6f989f7f9

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cookies.sqlite-wal
                          Filesize

                          256KB

                          MD5

                          c47963892b8d0e3e0019c25b8fe028b8

                          SHA1

                          755889e59c9389f0a8d1f8caee7fd71808093c14

                          SHA256

                          38b9918b5c23e0d378801f470ebebe8cea19551b1752782304e91162e52b97b3

                          SHA512

                          1bf638bd0c407cbad0078ffa4985b684f36214798bfcf152b18e194263062427c7ec1ca1e4103fef40af9c786726dd7ae05461eef6da37ba879af8ed0e434ceb

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          15KB

                          MD5

                          64d327074540019842c3754e6bdee1d1

                          SHA1

                          05eaf9454a8efd01bc271c1f2e1135b1fd54f5f1

                          SHA256

                          5ef5ef0c4c8c3b3f8af069e637b6d67526ee35f1e91f0b3c0adea3dd1cbd089f

                          SHA512

                          ae63eedb9b27a593e514bfcd4197f2a5394dc911c06192dfba3052b44937d9dfc564b8f92df1a91ca8b613c66c7a6e4799754e55f738fbf3a3e7852a1b21427d

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          23KB

                          MD5

                          e0a005d0df8bf0cc1454be2cffda068d

                          SHA1

                          be17760638e25e450115fab21ee6ce2ff88f15ce

                          SHA256

                          cad50561d0928ab28f5a771a3198d4f052a8dd8f7f466e6e9b5a156125a8bb33

                          SHA512

                          95e670d57dbc481251db8b40d42770e7ede132f803424602f8ecfeab066b083286426bdfc6afdce9d532b8074e0c5d2e379c20fa539f6d92db8eb118384539af

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          6KB

                          MD5

                          eed3dae8ce426cdf6a1eb7039982a33f

                          SHA1

                          02b01bd28d218a28b93f8f667877b3df027edb2d

                          SHA256

                          258161861724cac08051893edc56f3ed38d4e1216097a02fa63177773ab01f53

                          SHA512

                          e7fd6dc992c246bcd6e1aa31519ad3add6f78d7ba0992559e5ad5f32c772dba833b28dd3e15de293f8784ce23667745624491b0b6adfbc4792de6d9f6472e6a3

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          15KB

                          MD5

                          be52ad9f6e9935ac63cc95937cc5342e

                          SHA1

                          3f5e8c7975297fe8c2b1e34c5582db9592a9eafa

                          SHA256

                          92f3f55ebdb2d87826918a7ee9b8a7b82639f94cbc82bfc9a44348f9905a9740

                          SHA512

                          9c8e1abb06df47a0cd0ab6e08dd9a1cfc8d9cbc70d19384c28f8a26723d3d752da7d4c912698e3544ca80e59d1218ad36b5b295bfff9a48c466403b4cc800e6b

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          14KB

                          MD5

                          671bbec634d3303fd45abe444ce8d2c9

                          SHA1

                          8c7cfc3d414285a8d6fab412b4382beac5799a70

                          SHA256

                          cf0bcd81d2c94b54eacde596ee1f32340ffa4d13500948b6f8a9800fc670f39a

                          SHA512

                          d8b59a7d5e368a2ec1ab9244d910d0150cf44b2bc7927fd151bb502e62c3245453d5a2bd30b0e6651f2e291f6d7353e9ed9ea7131877ab0e24950726d7246c4a

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          5KB

                          MD5

                          eb72989a83298a357a555b79f9eff35f

                          SHA1

                          34d24df91e39e998410b703d977fbc89f800f92b

                          SHA256

                          ec8b75744457a793a2805678be1acaf906f0c8477993d06db07eae305d5353fe

                          SHA512

                          b9ca9714e8db23643ac9bc217d2facbc60283a49f6081d61c89084c19b5f395945084f26d278a64b763d98bd6a76defbef873175503e5c21c3a7ace6215e9559

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          5KB

                          MD5

                          ec16fc1839d63e939784480451612efd

                          SHA1

                          f15b12757c8db46ffa2122572bbbf66cecff4398

                          SHA256

                          8a7af110b05019523a3fb2c03e0cd40a7a5d5331aa4e071c24d64b784a211fe6

                          SHA512

                          da8a20c1b914a10fcf38c07bb2a232590e62e7520e843fe6c5ad04e0ddc50ed47752a7817eb41eec5fd69c1c28e4fe58a64652e6831f6ba8da15addc3f2075dd

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          5KB

                          MD5

                          60a082d9af0d02375085ce414167ce6e

                          SHA1

                          2aadea015fdabd66a96591cb220be9fe59b8dc66

                          SHA256

                          33127cd5ebaed0245c1705e51f7cfd97fa49db7c1d0c83e3ed15ca70795c58a6

                          SHA512

                          6113a7c154b1c6466357c1f4e3e9bc4b71991c8467d67cd04dc75a861b46075f92d4a2683e1ea4593df00fa6964db2de1140f6c6b1371d5cec380ae823c01a8d

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          6KB

                          MD5

                          44c55a9f5c5f74c4217f308ba1f2494a

                          SHA1

                          b43014dbdbc1caf65831af922b99dfea7bc0d170

                          SHA256

                          7a1cea38108f0b6a229a52a960b9591d210cecaa3df59c1e147b0aa9b86c5e9b

                          SHA512

                          54347c1be22a58d0474887ee1cc3a9438537dcdf7ad4b2eab9d822adc6e6cd4ce1d3bfc71cf07f1c6985fd58dfa81bdee313516fd1dc2f8b0590f2242b49ea8b

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          15KB

                          MD5

                          84c1b4c71238746709477ff3a19aa8a6

                          SHA1

                          0943dde62f6461b0422603f7e406c766865bb11d

                          SHA256

                          cfc0e01073577700534c2ea306ea0999b2c6b86b9addbd20b9bdafc117a5bef7

                          SHA512

                          049d3ee9b44587bed5bad7e88e44e2f57bb77e4855e01a5624b032546b729c556d4db53c7f8da446ff2e7705f6701db1562ed7f57faf983378f4f77d94baffcc

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\9345fb3c-da4a-4cce-866c-a56221f9726d
                          Filesize

                          25KB

                          MD5

                          34990a1de2aa2edbea395d5a03b11a81

                          SHA1

                          6b70c95cede11285f7a9b27b2f92ea2c78753f15

                          SHA256

                          7d0452cb865374f5fe2b9a36e4c201541988538af4b9ef7d5c5660c1ea19e2f8

                          SHA512

                          87ae5b296cbfe67aa19a7fbc22db0d558dee321a718f4f5800ce80bd69d61770293e5c05cbdc61a4cd7ba0d0cbe2a746eaf17a992453f9d2d4e4c103f74c6dc0

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\992aebb0-b464-4ec1-8661-82f256538b11
                          Filesize

                          982B

                          MD5

                          ae120633bdd18eead4a22549f52d3beb

                          SHA1

                          20d5699df8c748ca7b1066a83b1e95bfca4acb11

                          SHA256

                          e28bc2de258dd2779ddf21e33181b9008f1bf22226910a4c0cc7ddd9ee28a861

                          SHA512

                          b7e6487704a1c967e7e3792a205173a2ccf1b9e1e59c65a4ac7a23562f5a128a201a59fb7897a0d5ed021d3f09c9456681cf4893259276729775b78f8cf351b3

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\e67abef4-0054-4c9a-9ecb-d4970fd238ab
                          Filesize

                          671B

                          MD5

                          36f0dec7f1c51c66cb89727716d473ca

                          SHA1

                          f0e8df01645d19ea67fab6138eab4b3820eb6926

                          SHA256

                          9a2faa45406149b5f34c2a75f63e83f4f3e6c88043b6c22c6dc260aae96f0679

                          SHA512

                          9e9ddc57db1cd1e6e362be6fcb89e4974f0feb457fa3338dc07242762153445ca9696763d421280d9ee93ac29146f244a373c6a551b91d74b82a097c42a74561

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                          Filesize

                          1.1MB

                          MD5

                          842039753bf41fa5e11b3a1383061a87

                          SHA1

                          3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                          SHA256

                          d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                          SHA512

                          d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                          Filesize

                          116B

                          MD5

                          2a461e9eb87fd1955cea740a3444ee7a

                          SHA1

                          b10755914c713f5a4677494dbe8a686ed458c3c5

                          SHA256

                          4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                          SHA512

                          34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                          Filesize

                          372B

                          MD5

                          bf957ad58b55f64219ab3f793e374316

                          SHA1

                          a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                          SHA256

                          bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                          SHA512

                          79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                          Filesize

                          17.8MB

                          MD5

                          daf7ef3acccab478aaa7d6dc1c60f865

                          SHA1

                          f8246162b97ce4a945feced27b6ea114366ff2ad

                          SHA256

                          bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                          SHA512

                          5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
                          Filesize

                          12KB

                          MD5

                          5c0435c78f73a9ad5757f94039c2fccb

                          SHA1

                          b4a74fcb3729e53d0e506e7766918d7cb5e634e5

                          SHA256

                          7ddd80b37363ec4a9fb8c80ca99de2405e4872ddbb74e7fcdec08331b600087e

                          SHA512

                          d47f242edb5ac46c57ef1d456ba463b7ac2f7d2994dfab31d50316250a6586759358746c9ed111efdf31001ec466fee5f3b203416ffaf6175468a29396c0ba7c

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
                          Filesize

                          15KB

                          MD5

                          f0c81a32530e62295ca28aca694a63f6

                          SHA1

                          c225078ae2fefd60aabbb314ec349643110d7329

                          SHA256

                          98ad23faca3f646b39eab73cb5463e2c0ead3f5aa0bd82e87c2b8c9791b336e4

                          SHA512

                          5d9ecd1e40dc2e4928c6fa02bec747dea75f5fc3b31a6fb906dd87b9c8a153248beed7e40f486d4236ef69ab70ac59050f7f34db816f757434930e9a57852941

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs.js
                          Filesize

                          10KB

                          MD5

                          d8446acf44996d13fafa271247732417

                          SHA1

                          6d55f34ccbbaccea86e78537d62bdce5ee3f30e1

                          SHA256

                          80326da046df5e44a922c24b4a94afc9f9707410c3bde784b76e55cd7e0bdcd8

                          SHA512

                          2973df8026ca77c38926469790d0c72936ddce1488281828946f398b6d0c890591ec76d88b2b3c5da9874d6335b70ce2ae5fae8d55255fd497d75ac8824a6b1f

                          Download Submit

                        • C:\dllnet\HyperServerFontdll.exe
                          Filesize

                          3.3MB

                          MD5

                          1ea029e7274746e01f4c285d638f2a1c

                          SHA1

                          1e582b370a95fe21c9a55d317830cb6f5a2d8e6b

                          SHA256

                          eeddee0a57a540792aac5854451c760ccf3912db09a0dfbebbd5a175413587ed

                          SHA512

                          99d16c1626b7e48a5f7303fa8595dbc9544383b6734904e39c0b8e20fc90c6229d18ee544b95d1a54236f74bb59af25f2f9eb0681a2acf8e392d244cf31e90d4

                          Download Submit

                        • C:\dllnet\J0k4As.bat
                          Filesize

                          203B

                          MD5

                          eecba84beeb16a6f77a1345dc5c50d9a

                          SHA1

                          76c75599399493be5fa20e6065cf72ef05e238a0

                          SHA256

                          31a4b66ee13c7872264957aaa0bc36fcb780473e7d6096853f20ad45b541696e

                          SHA512

                          54e38ff09bf1e3fb8a7582c81acf2a329d039e85c2309624fd4209decded578b5db16e4e0a6325e476ee97228849431f5229bb8d21b0263ab1d955619ba4c75f

                          Download Submit

                        • C:\dllnet\yLU75wsHgukerTkv.vbe
                          Filesize

                          201B

                          MD5

                          cbbe2c3d8f2c923ccac8ef7d747b8a20

                          SHA1

                          b308635869370794019b9337dd326d97f79ee094

                          SHA256

                          c4f65a5c34ae749bd3dbaba98e14a5443e4a84a8aa48800c29c6fc3df8739d7c

                          SHA512

                          6451e45b0bfd329d89ee4f8b696fb20739619038471d9401dde5cd174df24f0b82bd3715e8910bece8542639638d846f9f16317b695f1f00832cf790d106b0eb

                          Download Submit

                        • memory/448-38-0x0000000000810000-0x0000000000CBB000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/448-39-0x0000000000810000-0x0000000000CBB000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/832-3555-0x00000000000E0000-0x0000000000403000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/884-156-0x000000001D250000-0x000000001D2AA000-memory.dmp

                          Filesize

                          360KB

                          Download

                        • memory/884-134-0x00000000033A0000-0x00000000033C6000-memory.dmp

                          Filesize

                          152KB

                          Download

                        • memory/884-164-0x000000001D210000-0x000000001D228000-memory.dmp

                          Filesize

                          96KB

                          Download

                        • memory/884-166-0x000000001D300000-0x000000001D34E000-memory.dmp

                          Filesize

                          312KB

                          Download

                        • memory/884-160-0x000000001BE10000-0x000000001BE20000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/884-158-0x000000001BE00000-0x000000001BE0E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/884-154-0x0000000003410000-0x0000000003420000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/884-152-0x000000001D1D0000-0x000000001D1E6000-memory.dmp

                          Filesize

                          88KB

                          Download

                        • memory/884-150-0x00000000033E0000-0x00000000033F0000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/884-148-0x000000001D1B0000-0x000000001D1C2000-memory.dmp

                          Filesize

                          72KB

                          Download

                        • memory/884-127-0x0000000000E00000-0x000000000114A000-memory.dmp

                          Filesize

                          3.3MB

                          Download

                        • memory/884-146-0x00000000033D0000-0x00000000033DE000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/884-144-0x0000000003390000-0x00000000033A0000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/884-162-0x000000001BE20000-0x000000001BE2E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/884-136-0x0000000003370000-0x000000000338C000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/884-137-0x0000000003200000-0x000000000321C000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/884-142-0x00000000033F0000-0x0000000003408000-memory.dmp

                          Filesize

                          96KB

                          Download

                        • memory/884-140-0x0000000003380000-0x0000000003390000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/884-138-0x000000001D160000-0x000000001D1B0000-memory.dmp

                          Filesize

                          320KB

                          Download

                        • memory/1944-267-0x00000000007F0000-0x0000000000AA6000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/1944-266-0x00000000007F0000-0x0000000000AA6000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/1944-255-0x00000000007F0000-0x0000000000AA6000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/1944-995-0x00000000007F0000-0x0000000000AA6000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/1944-991-0x00000000007F0000-0x0000000000AA6000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/2692-2420-0x00000000000E0000-0x0000000000403000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2692-1246-0x00000000000E0000-0x0000000000403000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2692-88-0x00000000000E0000-0x0000000000403000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2692-3542-0x00000000000E0000-0x0000000000403000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2692-3548-0x00000000000E0000-0x0000000000403000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2692-52-0x00000000000E0000-0x0000000000403000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2692-3550-0x00000000000E0000-0x0000000000403000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2692-974-0x00000000000E0000-0x0000000000403000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2692-3551-0x00000000000E0000-0x0000000000403000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2692-3452-0x00000000000E0000-0x0000000000403000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2692-221-0x00000000000E0000-0x0000000000403000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2692-1005-0x00000000000E0000-0x0000000000403000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2692-3552-0x00000000000E0000-0x0000000000403000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2692-49-0x00000000000E0000-0x0000000000403000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2692-3553-0x00000000000E0000-0x0000000000403000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2692-34-0x00000000000E0000-0x0000000000403000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3432-32-0x00000000001A0000-0x00000000004C3000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3432-20-0x00000000001A0000-0x00000000004C3000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3936-205-0x0000000000400000-0x0000000000C83000-memory.dmp

                          Filesize

                          8.5MB

                          Download

                        • memory/3936-1011-0x0000000000400000-0x0000000000C83000-memory.dmp

                          Filesize

                          8.5MB

                          Download

                        • memory/3936-976-0x0000000000400000-0x0000000000C83000-memory.dmp

                          Filesize

                          8.5MB

                          Download

                        • memory/3936-225-0x0000000000400000-0x0000000000C83000-memory.dmp

                          Filesize

                          8.5MB

                          Download

                        • memory/3936-100-0x0000000000400000-0x0000000000C83000-memory.dmp

                          Filesize

                          8.5MB

                          Download

                        • memory/3936-129-0x0000000010000000-0x000000001001C000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/4084-199-0x0000000000410000-0x0000000000A8C000-memory.dmp

                          Filesize

                          6.5MB

                          Download

                        • memory/4084-201-0x0000000000410000-0x0000000000A8C000-memory.dmp

                          Filesize

                          6.5MB

                          Download

                        • memory/4088-80-0x0000000000B50000-0x0000000000E06000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/4088-48-0x0000000000B50000-0x0000000000E06000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/4088-50-0x0000000000B50000-0x0000000000E06000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/4088-51-0x0000000000B50000-0x0000000000E06000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/4088-77-0x0000000000B50000-0x0000000000E06000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/4540-103-0x00000000000E0000-0x0000000000403000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/4540-104-0x00000000000E0000-0x0000000000403000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/4636-203-0x0000000000220000-0x00000000006CB000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/4636-119-0x0000000000220000-0x00000000006CB000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/4716-44-0x0000000000B10000-0x000000000118C000-memory.dmp

                          Filesize

                          6.5MB

                          Download

                        • memory/4716-43-0x0000000000B10000-0x000000000118C000-memory.dmp

                          Filesize

                          6.5MB

                          Download

                        • memory/7136-3541-0x00000000000E0000-0x0000000000403000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/7136-3540-0x00000000000E0000-0x0000000000403000-memory.dmp

                          Filesize

                          3.1MB

                          Download