Overview

overview

10

Static

static

3

4dd9380abe...b4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-12-2024 10:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4dd9380abe10b62f839b71804ed53b271b5802834d2434f044bfa77be53b31b4.exe

  • Size

    3.5MB

  • MD5

    ed50c9e5b4b9505f347686afeed47a89

  • SHA1

    08f81674a07e2843d5ea0916fde04f151155b6b6

  • SHA256

    4dd9380abe10b62f839b71804ed53b271b5802834d2434f044bfa77be53b31b4

  • SHA512

    3205c186e3c94ef1cc87cdf6f393d24ec2a64f0c4afd5f95cbf41d813a935da64d5c4f6f38f40fe470d0653aa60cb36ff7cd341084db2a0dcad305001bdff53e

  • SSDEEP

    98304:yXoVwIbRSYr0/lUkrRVDO7JqSqqJhUN1asQr:yXo29YQ/lVllOF/yysk

Score
10/10
amadeygcleanerlummaphemedronestealc9c9aa5stokcredential_accessdiscoveryevasionloaderpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

https://drive-connect.cyou/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7668600573:AAGyOQm-pttp2w0zypEpPB1GaeAZ5NSmqXk/sendDocument

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://covery-mover.biz/api

https://drive-connect.cyou/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone
  • Phemedrone family
    phemedrone
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\4dd9380abe10b62f839b71804ed53b271b5802834d2434f044bfa77be53b31b4.exe
    "C:\Users\Admin\AppData\Local\Temp\4dd9380abe10b62f839b71804ed53b271b5802834d2434f044bfa77be53b31b4.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3884
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1J17n1.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1J17n1.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3368
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5072
        • C:\Users\Admin\AppData\Local\Temp\1013960001\bTOqFBd.exe
          "C:\Users\Admin\AppData\Local\Temp\1013960001\bTOqFBd.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3060
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3056
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 2084
              6⤵
              • Program crash
              PID:6684
        • C:\Users\Admin\AppData\Local\Temp\1013967001\jd5fvXs.exe
          "C:\Users\Admin\AppData\Local\Temp\1013967001\jd5fvXs.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1156
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1013967001\jd5fvXs.exe" & rd /s /q "C:\ProgramData\FU3ECBASJEKN" & exit
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3924
            • C:\Windows\SysWOW64\timeout.exe
              timeout /t 10
              6⤵
              • System Location Discovery: System Language Discovery
              • Delays execution with timeout.exe
              PID:4180
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 2244
            5⤵
            • Program crash
            PID:2028
        • C:\Users\Admin\AppData\Local\Temp\1013973001\20e620a772.exe
          "C:\Users\Admin\AppData\Local\Temp\1013973001\20e620a772.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4784
          • C:\Users\Admin\AppData\Local\Temp\1013973001\20e620a772.exe
            "C:\Users\Admin\AppData\Local\Temp\1013973001\20e620a772.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1044
        • C:\Users\Admin\AppData\Local\Temp\1014005001\06a5125061.exe
          "C:\Users\Admin\AppData\Local\Temp\1014005001\06a5125061.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3124
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 764
            5⤵
            • Program crash
            PID:6612
        • C:\Users\Admin\AppData\Local\Temp\1014006001\bbfc262a46.exe
          "C:\Users\Admin\AppData\Local\Temp\1014006001\bbfc262a46.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:532
          • C:\Users\Admin\AppData\Local\Temp\1014006001\bbfc262a46.exe
            "C:\Users\Admin\AppData\Local\Temp\1014006001\bbfc262a46.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4268
        • C:\Users\Admin\AppData\Local\Temp\1014007001\58d375ff1c.exe
          "C:\Users\Admin\AppData\Local\Temp\1014007001\58d375ff1c.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2432
        • C:\Users\Admin\AppData\Local\Temp\1014008001\4009825701.exe
          "C:\Users\Admin\AppData\Local\Temp\1014008001\4009825701.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1284
        • C:\Users\Admin\AppData\Local\Temp\1014009001\a70923219f.exe
          "C:\Users\Admin\AppData\Local\Temp\1014009001\a70923219f.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1156
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM firefox.exe /T
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4436
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM chrome.exe /T
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:5012
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM msedge.exe /T
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4040
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM opera.exe /T
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2160
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM brave.exe /T
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:212
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
            5⤵
              PID:3744
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                6⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:2108
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2076 -parentBuildID 20240401114208 -prefsHandle 1988 -prefMapHandle 1924 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b2f653b-2fa5-458f-939d-3a3e42bacbc3} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" gpu
                  7⤵
                    PID:2152
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2496 -parentBuildID 20240401114208 -prefsHandle 2480 -prefMapHandle 2476 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04bdf2d7-5785-4060-a7db-e699a957c365} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" socket
                    7⤵
                      PID:5024
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1632 -childID 1 -isForBrowser -prefsHandle 1656 -prefMapHandle 3120 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {978f4d95-7b67-4114-b4dd-7f651729bc06} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" tab
                      7⤵
                        PID:3612
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4196 -childID 2 -isForBrowser -prefsHandle 4188 -prefMapHandle 4184 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae268a7b-eea6-4f25-9ab2-145b05f176f0} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" tab
                        7⤵
                          PID:2276
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4884 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4868 -prefMapHandle 4880 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b83f8462-4e51-4ccd-b3a0-1fab982f148a} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" utility
                          7⤵
                          • Checks processor information in registry
                          PID:6932
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5432 -childID 3 -isForBrowser -prefsHandle 5412 -prefMapHandle 4956 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b9ecb9b-8058-45be-a61b-62af3bdbdafc} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" tab
                          7⤵
                            PID:5756
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5668 -childID 4 -isForBrowser -prefsHandle 5660 -prefMapHandle 5656 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00a929e1-9779-4c80-9091-3edb76d32a00} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" tab
                            7⤵
                              PID:5768
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5776 -childID 5 -isForBrowser -prefsHandle 5856 -prefMapHandle 5852 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9a87904-f8ed-499e-8fb7-c5e3f0e81e6c} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" tab
                              7⤵
                                PID:5384
                        • C:\Users\Admin\AppData\Local\Temp\1014010001\840d3d3ede.exe
                          "C:\Users\Admin\AppData\Local\Temp\1014010001\840d3d3ede.exe"
                          4⤵
                          • Modifies Windows Defender Real-time Protection settings
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Windows security modification
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1748
                        • C:\Users\Admin\AppData\Local\Temp\1014011001\49c62784b9.exe
                          "C:\Users\Admin\AppData\Local\Temp\1014011001\49c62784b9.exe"
                          4⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:6012
                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2J5755.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2J5755.exe
                      2⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1348
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1156 -ip 1156
                    1⤵
                      PID:3824
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3124 -ip 3124
                      1⤵
                        PID:6628
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 3056 -ip 3056
                        1⤵
                          PID:6716
                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:6864
                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:4224

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Defense Evasion

                        Impair Defenses

                        2
                        T1562

                        Disable or Modify Tools

                        2
                        T1562.001

                        Modify Registry

                        3
                        T1112

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Credential Access

                        Unsecured Credentials

                        2
                        T1552

                        Credentials In Files

                        2
                        T1552.001

                        Discovery

                        Query Registry

                        7
                        T1012

                        System Information Discovery

                        4
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Lateral Movement

                        Collection

                        Data from Local System

                        1
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9PMCFZKU\download[1].htm
                          Filesize

                          1B

                          MD5

                          cfcd208495d565ef66e7dff9f98764da

                          SHA1

                          b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                          SHA256

                          5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                          SHA512

                          31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\activity-stream.discovery_stream.json
                          Filesize

                          19KB

                          MD5

                          9d1049a87a2107a8ccd7f75aae74ee43

                          SHA1

                          2d5d8f1ab3a1bcbc1ffdbe719e780993feba8e46

                          SHA256

                          eaded50e941117f5bfddfe37c863eb22cddb77eec3e6eac9c0d25cb5069a19d6

                          SHA512

                          1045eb2a1382bac1a76693830e28c64ef6810a9b3787db32bc0d14d1e71e37bfbb1efe525670f1b1187911371d856a24a6c34b66e2aec3a0e7aecb7ee50ff5f5

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                          Filesize

                          13KB

                          MD5

                          be5cc195c6964071180bb070024f9a28

                          SHA1

                          0b2f9925e0202026010d3c1542b00d0ddccccbae

                          SHA256

                          1ede1671c3c188a8268d80697309581750663d2e3cc345e616af1d7a57c7a2bf

                          SHA512

                          df4ab1ed0b2240d9a3c2ba3273963bf2a8c5c560067cf8f08293b5516d9969c0b3253240113b8896c0d821eddc4e115f1d6c9080400189e8877166d255cfd569

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                          Filesize

                          15KB

                          MD5

                          96c542dec016d9ec1ecc4dddfcbaac66

                          SHA1

                          6199f7648bb744efa58acf7b96fee85d938389e4

                          SHA256

                          7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                          SHA512

                          cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1013960001\bTOqFBd.exe
                          Filesize

                          585KB

                          MD5

                          ef922b44d15cbb8210500e1bbe373607

                          SHA1

                          3b21a66b8fd1eb63eaf2d28e73e43c00ab3e816e

                          SHA256

                          1ea81f5c52b1210aa21940963258e3022b8a928078b889bac9b424887fade23b

                          SHA512

                          d15fb18984382fb3c1f9e4b60fb6007043033a73f0029cbcdf11f3e53075622c545ecb5dacec1e94c9c7a3c61ab85dd675cae0d650c92a71359f5f5c0f576653

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1013967001\jd5fvXs.exe
                          Filesize

                          382KB

                          MD5

                          83b8507f0961cc5fd4a39d1def4dad1c

                          SHA1

                          7f97044ffbc10454d94fc6db868ae4071f7a5d46

                          SHA256

                          d8405be5cc0b5273433b62e2af31c18fa688fd5f0d2e11f8ff41a064fa917a09

                          SHA512

                          f5c65cd2590f971e2076b7687e60253ae333b85a882ad089fa3a097fdf9bbab9e359b4f2b6e0f18f36fd64dc905a89aca41a15b82752c8a4357f121f331e99f9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1013973001\20e620a772.exe
                          Filesize

                          710KB

                          MD5

                          28e568616a7b792cac1726deb77d9039

                          SHA1

                          39890a418fb391b823ed5084533e2e24dff021e1

                          SHA256

                          9597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2

                          SHA512

                          85048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1014005001\06a5125061.exe
                          Filesize

                          1.9MB

                          MD5

                          3a5875aacb1d5ca2be4e7f78b48a6808

                          SHA1

                          8a465fbb514e017a822ae3a126c66ebbf08c9a25

                          SHA256

                          b0e7751ee75ab89ddab728c53ba3811b98932ad02a946f65eb8017079bb82901

                          SHA512

                          592965342f3bac51a400aba4060ff9a2b29a247689853e54d5df9e8b4755a487bb99a0c1938b5390d9130a0140311018fdacaea7991046376c05d1d0e1a839a1

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1014007001\58d375ff1c.exe
                          Filesize

                          1.8MB

                          MD5

                          4208cb745b3416b4cabe99cf5bfd5471

                          SHA1

                          e42b11e63bbde6a1a11cb3ce82787f0ff33b679e

                          SHA256

                          14048c09f2c87e6af49e49f4e6770fd0a1641088f619fb8abcc0d94bf9150670

                          SHA512

                          2282f89b333be041c5e106dffa49f7afd911dae3b44cd8746ece2bfcb7cb8f6bce57f7c8ae1b1d5ce8c90f7c96730847c851a2cd68114c87fcf904348714b88d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1014008001\4009825701.exe
                          Filesize

                          1.7MB

                          MD5

                          005cead84d34b1b48a78dd2abbb19550

                          SHA1

                          6ddf8d4031dac55a742ef768cdd1dc5f8ab3b55e

                          SHA256

                          1666382723f07e8d7aaaab8340bef960686c5561ae731a8e3c70c53ce0540275

                          SHA512

                          7446bc48643564289a94619d00f113510671bea41d754feaae020e37143d091da614f40afbbdd3d545c7e40de61d254584690a537b5eb896644bae67ddd4df49

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1014009001\a70923219f.exe
                          Filesize

                          947KB

                          MD5

                          f991d2dfaccb4a325c3e56386e945d1d

                          SHA1

                          2ca999681cc81c19e16ec418a6c27d3b8019a836

                          SHA256

                          d4e406463baec97b2f29322c37c7f2127cc46ad958652cd015f0aac516feca2c

                          SHA512

                          81f81a0854df73b015434a7a2ca88de93e970fd86ec17b46cc9f61d572ca6b93a8ab8249a4cf88118d1fe1cd2b5cf77e69400b87d59ab7c0418cde125e5dde08

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1014010001\840d3d3ede.exe
                          Filesize

                          2.7MB

                          MD5

                          5fd000eb60d3b5d283f071bde8877c78

                          SHA1

                          69f20a4a53208a92f4add436dffe8750b783e744

                          SHA256

                          85872bd7c5acaa4857aa4c40c80fee0fb6b299d84491b0c1591e97748c17b3de

                          SHA512

                          d6a9c91e311340df60921cdeca7d144e8b056e4b00a00ab7840d8d2b5c15ac128ca7fc24210cfee93edc35541bc3f5b05defb3b4f6627918066b36a6c4dd814b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1014011001\49c62784b9.exe
                          Filesize

                          2.5MB

                          MD5

                          2a78ce9f3872f5e591d643459cabe476

                          SHA1

                          9ac947dfc71a868bc9c2eb2bd78dfb433067682e

                          SHA256

                          21a2ac44acd7a640735870eebfd04b8dc57bc66877cb5be3b929299e86a43dae

                          SHA512

                          03e2cd8161a1394ee535a2ea7d197791ab715d69a02ffab98121ec5ac8150d2b17a9a32a59307042c4bbeffad7425b55efa047651de6ed39277dba80711454f9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1J17n1.exe
                          Filesize

                          3.1MB

                          MD5

                          c37baefcd1ef31242aebb5d1b2feed76

                          SHA1

                          946f334aed0c42294973d5b7757ded8944282caa

                          SHA256

                          94a9afe9bee5179221ed1538742f850ac95cec5072738dc4b91a8cd74477ad0b

                          SHA512

                          89f3797a9be7cce6570dedbdab253e954e376c92b6de2c2688d883687bab4da89339da8d5837ee1b976a12c9fd5d840e10a7c4f0cd4f2c2246ead1abc3fe8535

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2J5755.exe
                          Filesize

                          1.7MB

                          MD5

                          8eb01ab47a3558db23ebcb5c3fd0cba6

                          SHA1

                          2a88a18bbc5e783f253bb7a45e38c35ccdd93653

                          SHA256

                          068497e046e9612da53294fb1d535e294edae402cfaf5da194223c46eceaba3e

                          SHA512

                          3ea19e788d0baefd09ad64ff899060210b8f52e3ffc90c8e4bc62d5f28341b1222fcc71bc3306d176c4abc3564ac0f4d33e4c094c50e72c31f5ea9c75e8395d0

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                          Filesize

                          479KB

                          MD5

                          09372174e83dbbf696ee732fd2e875bb

                          SHA1

                          ba360186ba650a769f9303f48b7200fb5eaccee1

                          SHA256

                          c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                          SHA512

                          b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                          Filesize

                          13.8MB

                          MD5

                          0a8747a2ac9ac08ae9508f36c6d75692

                          SHA1

                          b287a96fd6cc12433adb42193dfe06111c38eaf0

                          SHA256

                          32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                          SHA512

                          59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin
                          Filesize

                          6KB

                          MD5

                          2e701b865e7681df85ef7aa27027aeb6

                          SHA1

                          8cf6dc0b7f476c46577a878076212de31ee825c4

                          SHA256

                          f8ed34e6b588e012c846e37eecda19c69383fbe6b15326141a705401be3309d5

                          SHA512

                          cdee476ccb4d7811010f02595fa6853dce25447a43957b6ff9de3bf70d9004f4f162b1f50466d56fc0a0a5a4e717e465c0514b6ba74d7e8fb1329bca44b6f0b2

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin
                          Filesize

                          18KB

                          MD5

                          4512177b0a16cf7340f96bb4611b1ffb

                          SHA1

                          f045a47eeed3b59017996e9634b4a5fadc7030c5

                          SHA256

                          807c702f04a6da8809a84e28b69affc6d153727ab0c9e68618532cdc5584c9f0

                          SHA512

                          613dad280dc80534185a6b5f7be1c6332e5d472fc4490e828ed5604a94ee2dc5be71b16f3ef31fc30662883d6a20ff7cafad225f4e371a3ac65d4d8caa8fdfe0

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin
                          Filesize

                          8KB

                          MD5

                          c49e849222e831bb6b6c9fab202f4fe9

                          SHA1

                          fc4f65acc86c843f0b39b0a2feaff49a1b0eae17

                          SHA256

                          57f48b7feecd0428f5225144f7e65c73754dd84805e73f63566b977edb519c40

                          SHA512

                          b0a541b4373c7ee84ca13870e1c204d40f76eb0129b2ce5f18dd5170f1608cd2539ab12f15ce4d63b08d516dc86446a00003390483ea4c378526e6afd4b966c6

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          5KB

                          MD5

                          f05c3fef9505c406dbd8908b4b67abf6

                          SHA1

                          b38d2019589cc86fa298e6702096394a2888d2ad

                          SHA256

                          a31217d7552bf38cb76b65a2d971d82328a1f32985f54c0d0b93eccbdfad34ae

                          SHA512

                          7e7b2990ef7f1e3aff4257df32d712ccfd6a886602b0db62dae61918aaee5822b4043dce22ca7f3c86e1a15880c1de4688fab393440417e8baea69ec8fe75fb4

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          23KB

                          MD5

                          ae22ef30b5251b9db830dc3cfa8c05d3

                          SHA1

                          f709dda92d246d731da46b83ba93fb762b1c5741

                          SHA256

                          b58bd9e0e7cbbc5314c04a5a4a13213b70919250db77d1fd584e4b5807bc03f1

                          SHA512

                          d9d029674e9420eb8a1c7c1994805d4a302786b7008af0f7cdb89480b1852336d9ef87b9ddf7ca45d6850edf563748e332bab82ad30f9494ab2447a025050210

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          15KB

                          MD5

                          724c7610fa64d094355e5b83614d2102

                          SHA1

                          cb3fb323fb2554020a03ccd497022568c8fe18d7

                          SHA256

                          294635f19909dba50d123da1c27341b9198beb14d8b99821dffbfc5205370e3c

                          SHA512

                          b29982cf6002b0b731c9725fb8ad8ceca48d5b7afc0d220a96f7f18dc2000fbab1f5e7f12c7fe0fccb3bbd3c1cebe9bdaf78d2be07e4c3c68167a5c02b553000

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          14KB

                          MD5

                          a3256ec68041a3cea9286f07016482e5

                          SHA1

                          5e25ca7cac81b89afe9f61090a513abf0f16dd09

                          SHA256

                          742e5c0e98cc2724116287226db1e94732b5effc8ffde1dc4d57a6ea11b6ad8b

                          SHA512

                          8e432e04d2a64533b5161de8d0185f30fffe95d89912c7428f814e8a175a40970285d445c51e6661e02e08330cfea1b844a79161a03811b8a7e43d493ae7b57b

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          5KB

                          MD5

                          de979ee17630f1ecf18b8969ab899344

                          SHA1

                          34f209da343a0c8d3595a757f88f3e4cd514275d

                          SHA256

                          9f7f96bf6110a1f68752844f8feb05dc02750ba2d5f4620a53cbc5e3d88aad82

                          SHA512

                          ce29f5f414315323c5e8263d787e7a7ce84f933a1e23bc50aa35852aedc2a1a2d0a25faa9e417fb3798391f062eb8c2df8fb27e1bad5fbddff1339d674639ac7

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          5KB

                          MD5

                          d24a82da0a50df6d2d2d9e3728123100

                          SHA1

                          d32e62b0d9401d9159189ef0d64ac5d954d52c57

                          SHA256

                          1a2f38b12cc6e82c4cb2316ffdee12491c3bb7f4341bbf19b3983a5fce38aaf0

                          SHA512

                          33ddf56e9caddb89e9be05bd5da52bc82419938224dfa414505ffaf7f25afc9503152c5c7e133366feb2bea885b467f68e0506d75e7dbfce0576f1d3461836b2

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          6KB

                          MD5

                          de1902667a57a01b4dfb0f6f46ae3f3b

                          SHA1

                          adbeea01e8f6819ffb8431cc20e48d9cc2d6567d

                          SHA256

                          2401222427f02af0e63d27c741a004e7fcff05ef24ba07d59df9eac7c8a84a31

                          SHA512

                          b8994a3915d1e2471a198f6bfa2169ff084e8096983bc13dbab9ca54bc306e4ca4fd6bceef3da5ad04f898c3debc44f2ae3289d74a832aa49099a92a75ae34ae

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          6KB

                          MD5

                          b3dac2e0a37845b26904eb7f0d4d6bec

                          SHA1

                          6e83c2c3e3437afd0686f4062c51a79fe94bb5a1

                          SHA256

                          0a73669e4481b147bc7a88c30001cc7fe112e961181d3842e0363a4c12875afa

                          SHA512

                          10fcebbb2a27e58af0f8c2bd2b6938be7034a8200ead61dfe6d4691c9a0644fb5318ab9470869c5cefccd52e7b669a888f6c1324749ffe42fa77e02ef8d7215d

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          15KB

                          MD5

                          10dbfffbce11d6f60071eaea554a2346

                          SHA1

                          64c77b8ba4752226dca35eb68874b5bc9e504f20

                          SHA256

                          975cc368446b1ebe14cdc5b3b26742ebe7c5a7dcd13dddb9647e88f331e6c016

                          SHA512

                          b5a25301609b312abd095fd6e02c7f45d12945b250151f66c8b3cd5bfd6698108f033cd1bb185874c56fc89af6d25a708b8cf8443e7ddc10f669239a03594081

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          15KB

                          MD5

                          54ea5f284b1de183d640bdd603074bca

                          SHA1

                          e3a8ddca4ee7b95c242a8dce65e141842e29df8f

                          SHA256

                          cab4f6d5155d75b843768705644981f657d2ae0fd6766ffd88f232896ba766e4

                          SHA512

                          244c19e71bfe8c9c9b2a451f3c40c0f8b8295c063429dd4398d77573c548a59ba3d7cd6433e7c00cc69e3019b7f9edb5465f89a69f33cfe02049e7010acf4921

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\077da5f0-1dd6-4998-80ec-ada2705f8c53
                          Filesize

                          671B

                          MD5

                          f39e70a2b688cd531d2dec99bf01f8de

                          SHA1

                          3b6b0a57bb2c8284ca8f8e84e70d662c59dff2c3

                          SHA256

                          0dd8a1bfa82a06684053e8c405764b15b1b2d28b3d6d9fe902cd8f6315c2fb83

                          SHA512

                          d548149eef84785578a10f126e0824d80f369b49c4213e6a18b2262340d24e8a1af77c0276ea10da4da255a59a1f039480ac3f131c29a41ed05bd2830e72cbf4

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\349cae92-50de-486a-ae0f-8b04028c8743
                          Filesize

                          982B

                          MD5

                          853b58b39d1ae92f9c618b2a1435d22d

                          SHA1

                          54bba8cff52fa52a6bf33f8e984dedf9a2bd64f3

                          SHA256

                          d5fbf6d567fe41ba7de504f89b4c43289395e8fb6264d3d9f5ca1020274706fd

                          SHA512

                          2e8921ba6cfd19dbe341db0013bb5aab52d419dc6a3718c4ed32e17e021a0f57129fb5295e967f9471afab84cd69c9cbe69ba15a7d64fd7e8ec4b6a661c2b956

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\dda635cd-0065-4508-9213-1ed4f25479c2
                          Filesize

                          27KB

                          MD5

                          9ae57f826d263c217679507cddce09d1

                          SHA1

                          c61e428ceb230f2db9d3220cc4a76f36fe4eaf0c

                          SHA256

                          885f90b340ba8ab2b097536e56e4f1646d02fc80d30e41d0a1a898d48904d5db

                          SHA512

                          95c800f82f1a97d5f260cb859014641def8b54179db4b6f6a0b89298fc28c6459d6de68aec9af46c4c6f22614f788619871010a31a89b33fdaaebbf4c449ed7c

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\favicons.sqlite-wal
                          Filesize

                          160KB

                          MD5

                          5e9310c16547427786dbecec67536a88

                          SHA1

                          1623a2a1f3167e5615dcc02dba7a7335b2b188a4

                          SHA256

                          abde2df56d41d979571f5e7c1cb742b7aad82d216545fc50bb5efb26453b00ce

                          SHA512

                          8aaf120838baa94383cdb6feea584623c9e21f46b4e103e41761300f1567f55d39e7b8f4ae0b7653418f90296a563eceac01a5bd35d7b75167b1154d75e061e8

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                          Filesize

                          1.1MB

                          MD5

                          842039753bf41fa5e11b3a1383061a87

                          SHA1

                          3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                          SHA256

                          d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                          SHA512

                          d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                          Filesize

                          116B

                          MD5

                          2a461e9eb87fd1955cea740a3444ee7a

                          SHA1

                          b10755914c713f5a4677494dbe8a686ed458c3c5

                          SHA256

                          4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                          SHA512

                          34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                          Filesize

                          372B

                          MD5

                          bf957ad58b55f64219ab3f793e374316

                          SHA1

                          a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                          SHA256

                          bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                          SHA512

                          79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                          Filesize

                          17.8MB

                          MD5

                          daf7ef3acccab478aaa7d6dc1c60f865

                          SHA1

                          f8246162b97ce4a945feced27b6ea114366ff2ad

                          SHA256

                          bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                          SHA512

                          5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\places.sqlite-wal
                          Filesize

                          1.4MB

                          MD5

                          6e16c1067bb7c03cf0f2a600256d7a21

                          SHA1

                          7543d767aad6f2cde536c22d672f9474dec34054

                          SHA256

                          ecf03f6e92bec692931676ab7a1b79c41d735e89ac84e3a77af0aed4ddef6c82

                          SHA512

                          284dc22f54e006a8577505aac447177a36e04b1cfa7690ac8b3279eb62042859ae9af82a18767d39af77fe9d6f300581d9f71be5ef5fc83fcc98d2690a436c15

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js
                          Filesize

                          10KB

                          MD5

                          471d0d47a04aa8eedf33d1604b25d4df

                          SHA1

                          78a00673be4b63f2d46fc3bfe866dd1c30f2911a

                          SHA256

                          cad263571f8e553df146a0f47dbb0c4c3939262e1851e5a764f7da628cf22a5f

                          SHA512

                          34886f96cec85221cf86aa48759b7683d64cac7dd53415277ad7f07f3378cfe9e4228ebc051f89f5285a796845e25b4c9fa0d9e1dde6c9ff47853d3832eeac35

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js
                          Filesize

                          12KB

                          MD5

                          f5094d58877a334b85b815e27fd28b2a

                          SHA1

                          960472914077a25cd608d732a4cc24c6b5678830

                          SHA256

                          725ffc26f7b89087afe2094b9f9b2a0a922ffec90441d2c9cb2872f0018801ee

                          SHA512

                          b4259fd0db2f35f6c437a8f6d9b06da91df4c542cb7ed9396c423c720ab672b0d313c47709bc3cb731b869092755885aa19fbecf5896666f916bf089d4ff0190

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js
                          Filesize

                          15KB

                          MD5

                          7b4d703cfaca618e6dadbbc4ed192574

                          SHA1

                          08f9b96dabacfe383cc968c4bdb521379d15cbcc

                          SHA256

                          5a1622a1afac47fe9a1f25b4fded464126aa400c0ca7da2371e493574325cee7

                          SHA512

                          57a476fc6399ab5fb0e91c1cf73d08988764dd21d2117812326735c4c70e1ad5b1cadc2afc611a96076ede51d7ac8641fc7598f94ddb456bb9fc70be579e0d51

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs.js
                          Filesize

                          10KB

                          MD5

                          2e6c12ad9767996e56c96ca27ec860ea

                          SHA1

                          40fd22f3a82d77a7bf95eb24c4c98706a3a86e43

                          SHA256

                          f3604570851112e20713d726e1f90c6b8f1bd0d63ad9cea153147699023d580c

                          SHA512

                          8bf8f8c7865d52561ec7286355626aeec949323221b4a09e2f2c5e48c62612e69e2645ecede9a617fe57367a2c59d3fa89e692ded657929b20d286d4bc7de591

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                          Filesize

                          3.1MB

                          MD5

                          ae0fbcaddd0c33b2a5631d0b6174a8c5

                          SHA1

                          95bf33c55f52e243aed9c918509fe90b4c7ec048

                          SHA256

                          d93fa39c7d1db5010fa49c24d9e476f6f35b67d06faa1795141ec8eef97fe53b

                          SHA512

                          48503d304ae1a7088989b25c862486fd89971594374c12b45efabc3dd92a3329138bfeeecdafdaa57ea970dbf6cbdc8a025ac900b5d6ea04ec4761332c668a4d

                          Download Submit

                        • memory/1044-95-0x0000000000400000-0x0000000000457000-memory.dmp

                          Filesize

                          348KB

                          Download

                        • memory/1044-99-0x0000000000400000-0x0000000000457000-memory.dmp

                          Filesize

                          348KB

                          Download

                        • memory/1044-97-0x0000000000400000-0x0000000000457000-memory.dmp

                          Filesize

                          348KB

                          Download

                        • memory/1156-100-0x0000000000400000-0x000000000064B000-memory.dmp

                          Filesize

                          2.3MB

                          Download

                        • memory/1284-188-0x0000000000D70000-0x0000000001415000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/1284-184-0x0000000000D70000-0x0000000001415000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/1348-29-0x0000000000560000-0x00000000009D9000-memory.dmp

                          Filesize

                          4.5MB

                          Download

                        • memory/1348-30-0x0000000000560000-0x00000000009D9000-memory.dmp

                          Filesize

                          4.5MB

                          Download

                        • memory/1748-227-0x0000000000660000-0x0000000000922000-memory.dmp

                          Filesize

                          2.8MB

                          Download

                        • memory/1748-1070-0x0000000000660000-0x0000000000922000-memory.dmp

                          Filesize

                          2.8MB

                          Download

                        • memory/1748-1073-0x0000000000660000-0x0000000000922000-memory.dmp

                          Filesize

                          2.8MB

                          Download

                        • memory/1748-237-0x0000000000660000-0x0000000000922000-memory.dmp

                          Filesize

                          2.8MB

                          Download

                        • memory/1748-239-0x0000000000660000-0x0000000000922000-memory.dmp

                          Filesize

                          2.8MB

                          Download

                        • memory/2432-166-0x00000000007F0000-0x0000000000CA9000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2432-164-0x00000000007F0000-0x0000000000CA9000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3056-1005-0x00000000054D0000-0x0000000005536000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/3056-1003-0x0000000000400000-0x0000000000424000-memory.dmp

                          Filesize

                          144KB

                          Download

                        • memory/3060-53-0x0000000005E40000-0x0000000005ED2000-memory.dmp

                          Filesize

                          584KB

                          Download

                        • memory/3060-70-0x0000000006220000-0x000000000623A000-memory.dmp

                          Filesize

                          104KB

                          Download

                        • memory/3060-49-0x0000000000290000-0x0000000000328000-memory.dmp

                          Filesize

                          608KB

                          Download

                        • memory/3060-71-0x000000000A1D0000-0x000000000A1D6000-memory.dmp

                          Filesize

                          24KB

                          Download

                        • memory/3060-50-0x0000000005870000-0x000000000590C000-memory.dmp

                          Filesize

                          624KB

                          Download

                        • memory/3060-52-0x0000000006250000-0x00000000067F4000-memory.dmp

                          Filesize

                          5.6MB

                          Download

                        • memory/3060-51-0x0000000005800000-0x0000000005842000-memory.dmp

                          Filesize

                          264KB

                          Download

                        • memory/3060-54-0x0000000005DB0000-0x0000000005DBA000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/3124-901-0x0000000000400000-0x0000000000C6F000-memory.dmp

                          Filesize

                          8.4MB

                          Download

                        • memory/3124-182-0x0000000000400000-0x0000000000C6F000-memory.dmp

                          Filesize

                          8.4MB

                          Download

                        • memory/3124-185-0x0000000000400000-0x0000000000C6F000-memory.dmp

                          Filesize

                          8.4MB

                          Download

                        • memory/3124-1087-0x0000000000400000-0x0000000000C6F000-memory.dmp

                          Filesize

                          8.4MB

                          Download

                        • memory/3124-144-0x0000000010000000-0x000000001001C000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/3124-119-0x0000000000400000-0x0000000000C6F000-memory.dmp

                          Filesize

                          8.4MB

                          Download

                        • memory/3368-10-0x0000000000E20000-0x0000000001133000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3368-25-0x0000000000E21000-0x0000000000E89000-memory.dmp

                          Filesize

                          416KB

                          Download

                        • memory/3368-7-0x0000000000E20000-0x0000000001133000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3368-8-0x0000000077894000-0x0000000077896000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/3368-9-0x0000000000E21000-0x0000000000E89000-memory.dmp

                          Filesize

                          416KB

                          Download

                        • memory/3368-11-0x0000000000E20000-0x0000000001133000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3368-22-0x0000000000E20000-0x0000000001133000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/4224-4180-0x00000000008F0000-0x0000000000C03000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/5072-162-0x00000000008F0000-0x0000000000C03000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/5072-4107-0x00000000008F0000-0x0000000000C03000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/5072-24-0x00000000008F0000-0x0000000000C03000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/5072-79-0x00000000008F0000-0x0000000000C03000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/5072-209-0x00000000008F0000-0x0000000000C03000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/5072-72-0x00000000008F0000-0x0000000000C03000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/5072-4183-0x00000000008F0000-0x0000000000C03000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/5072-1740-0x00000000008F0000-0x0000000000C03000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/5072-1002-0x00000000008F0000-0x0000000000C03000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/5072-4182-0x00000000008F0000-0x0000000000C03000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/5072-4166-0x00000000008F0000-0x0000000000C03000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/5072-4169-0x00000000008F0000-0x0000000000C03000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/5072-1090-0x00000000008F0000-0x0000000000C03000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/5072-4176-0x00000000008F0000-0x0000000000C03000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/5072-4177-0x00000000008F0000-0x0000000000C03000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/5072-4181-0x00000000008F0000-0x0000000000C03000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/6012-1442-0x0000000000400000-0x0000000000457000-memory.dmp

                          Filesize

                          348KB

                          Download

                        • memory/6864-1091-0x00000000008F0000-0x0000000000C03000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/6864-1093-0x00000000008F0000-0x0000000000C03000-memory.dmp

                          Filesize

                          3.1MB

                          Download