Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12-12-2024 22:49

General

  • Target

    file.exe

  • Size

    3.1MB

  • MD5

    3197aa29fd7d023f4483200e06a95d7a

  • SHA1

    62cd61a0004ef666d0d6427c42c8a6ec7b30617c

  • SHA256

    ac7eab26629e889c428293f303b428424ffccae5658636cca54512753fa2792a

  • SHA512

    7379939f14ce763a9726638f6b694e0a84dbc80a2128db6e58224e2db432ad242cfc04e2576ffd462e1c75836141310cfd0ac751245061170d041b211e528637

  • SSDEEP

    49152:of5+2z7fYXSXFA0R8kTiglrFF852feG2ezYVW5es:o5fYXSXm0RbTiglv852XZzeW5e

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://drive-connect.cyou/api

https://covery-mover.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

  • Gcleaner family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 27 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 48 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 44 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3000
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2724
      • C:\Users\Admin\AppData\Local\Temp\1014365001\W4KLQf7.exe
        "C:\Users\Admin\AppData\Local\Temp\1014365001\W4KLQf7.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1704
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\hyper-v.exe"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2328
        • C:\Windows\SysWOW64\systeminfo.exe
          systeminfo
          4⤵
          • System Location Discovery: System Language Discovery
          • Gathers system information
          PID:2896
      • C:\Users\Admin\AppData\Local\Temp\1014430001\dwVrTdy.exe
        "C:\Users\Admin\AppData\Local\Temp\1014430001\dwVrTdy.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Program Files directory
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2776
        • C:\Program Files\Windows Media Player\graph\graph.exe
          "C:\Program Files\Windows Media Player\graph\graph.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2028
      • C:\Users\Admin\AppData\Local\Temp\1014431001\AzVRM7c.exe
        "C:\Users\Admin\AppData\Local\Temp\1014431001\AzVRM7c.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Program Files\Windows Media Player\graph\graph.exe
          "C:\Program Files\Windows Media Player\graph\graph.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1492
      • C:\Users\Admin\AppData\Local\Temp\1014432001\t5abhIx.exe
        "C:\Users\Admin\AppData\Local\Temp\1014432001\t5abhIx.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        PID:2452
      • C:\Users\Admin\AppData\Local\Temp\1014535001\CuKxXX0.exe
        "C:\Users\Admin\AppData\Local\Temp\1014535001\CuKxXX0.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1712
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ipconfig /release
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2456
          • C:\Windows\system32\ipconfig.exe
            ipconfig /release
            5⤵
            • Gathers network information
            PID:2716
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADEANAA1ADMANQAwADAAMQBcAEMAdQBLAHgAWABYADAALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADEANAA1ADMANQAwADAAMQBcAEMAdQBLAHgAWABYADAALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAFcAaQBuAGQAbwBzAEMAUABVAHMAeQBzAHQAZQBtAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAFcAaQBuAGQAbwBzAEMAUABVAHMAeQBzAHQAZQBtAC4AZQB4AGUA
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2476
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process "https://google.com"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2544
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" https://google.com/
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            PID:2316
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:1980
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 1712 -s 736
          4⤵
          • Loads dropped DLL
          PID:2256
      • C:\Users\Admin\AppData\Local\Temp\1014550001\9ef3181754.exe
        "C:\Users\Admin\AppData\Local\Temp\1014550001\9ef3181754.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2580
      • C:\Users\Admin\AppData\Local\Temp\1014551001\6d5d5922b5.exe
        "C:\Users\Admin\AppData\Local\Temp\1014551001\6d5d5922b5.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1560
        • C:\Windows\system32\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2532
          • C:\Windows\system32\mode.com
            mode 65,10
            5⤵
              PID:1660
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e file.zip -p24291711423417250691697322505 -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:1008
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_7.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:2248
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_6.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:2852
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_5.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:1144
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_4.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:1256
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_3.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:380
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_2.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:2552
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_1.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:1768
            • C:\Windows\system32\attrib.exe
              attrib +H "in.exe"
              5⤵
              • Views/modifies file attributes
              PID:1732
            • C:\Users\Admin\AppData\Local\Temp\main\in.exe
              "in.exe"
              5⤵
              • Executes dropped EXE
              PID:2776
              • C:\Windows\system32\attrib.exe
                attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                6⤵
                • Views/modifies file attributes
                PID:2808
              • C:\Windows\system32\attrib.exe
                attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                6⤵
                • Views/modifies file attributes
                PID:2696
              • C:\Windows\system32\schtasks.exe
                schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                6⤵
                • Scheduled Task/Job: Scheduled Task
                PID:2716
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell ping 127.0.0.1; del in.exe
                6⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2364
                • C:\Windows\system32\PING.EXE
                  "C:\Windows\system32\PING.EXE" 127.0.0.1
                  7⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:2104
        • C:\Users\Admin\AppData\Local\Temp\1014552001\1bccb831cb.exe
          "C:\Users\Admin\AppData\Local\Temp\1014552001\1bccb831cb.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          PID:760
          • C:\Users\Admin\AppData\Local\Temp\1014552001\1bccb831cb.exe
            "C:\Users\Admin\AppData\Local\Temp\1014552001\1bccb831cb.exe"
            4⤵
            • Executes dropped EXE
            PID:2944
          • C:\Users\Admin\AppData\Local\Temp\1014552001\1bccb831cb.exe
            "C:\Users\Admin\AppData\Local\Temp\1014552001\1bccb831cb.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2032
        • C:\Users\Admin\AppData\Local\Temp\1014553001\c2474be541.exe
          "C:\Users\Admin\AppData\Local\Temp\1014553001\c2474be541.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1640
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM firefox.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2928
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM chrome.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2944
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM msedge.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2496
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM opera.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1016
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM brave.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2692
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
            4⤵
              PID:2060
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                5⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:2932
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2932.0.478027866\1744303064" -parentBuildID 20221007134813 -prefsHandle 1260 -prefMapHandle 1252 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e76650ba-bde7-47e3-a38d-e70a368ddebc} 2932 "\\.\pipe\gecko-crash-server-pipe.2932" 1348 14e28158 gpu
                  6⤵
                    PID:2780
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2932.1.464637995\571109681" -parentBuildID 20221007134813 -prefsHandle 1524 -prefMapHandle 1520 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1a2d648-7c61-4b61-817a-b683dd7deda1} 2932 "\\.\pipe\gecko-crash-server-pipe.2932" 1536 f244658 socket
                    6⤵
                      PID:2476
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2932.2.2105397240\673677396" -childID 1 -isForBrowser -prefsHandle 2220 -prefMapHandle 2216 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3f3a9a9-14b4-4477-9aeb-246e00f70299} 2932 "\\.\pipe\gecko-crash-server-pipe.2932" 2244 1a1edf58 tab
                      6⤵
                        PID:1608
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2932.3.345051427\1143188293" -childID 2 -isForBrowser -prefsHandle 2800 -prefMapHandle 2796 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d503240-2feb-45d3-9a9e-a1c347c95f54} 2932 "\\.\pipe\gecko-crash-server-pipe.2932" 2812 d60858 tab
                        6⤵
                          PID:3496
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2932.4.2013158345\992161320" -childID 3 -isForBrowser -prefsHandle 3748 -prefMapHandle 3744 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f20c86ec-7482-4918-a1eb-62f95142ef6f} 2932 "\\.\pipe\gecko-crash-server-pipe.2932" 3760 1e56ae58 tab
                          6⤵
                            PID:3252
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2932.5.39202817\905754491" -childID 4 -isForBrowser -prefsHandle 3868 -prefMapHandle 3872 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6edfa011-6d35-4548-8e41-f35c2dbed9f9} 2932 "\\.\pipe\gecko-crash-server-pipe.2932" 3860 1e56bd58 tab
                            6⤵
                              PID:1768
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2932.6.2060464210\526856893" -childID 5 -isForBrowser -prefsHandle 4032 -prefMapHandle 4036 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebb74f67-824f-4cfb-8930-69f1a14dc8ae} 2932 "\\.\pipe\gecko-crash-server-pipe.2932" 4020 1e56a858 tab
                              6⤵
                                PID:2904
                        • C:\Users\Admin\AppData\Local\Temp\1014554001\bb87577ae6.exe
                          "C:\Users\Admin\AppData\Local\Temp\1014554001\bb87577ae6.exe"
                          3⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1976
                        • C:\Users\Admin\AppData\Local\Temp\1014555001\25f634d9be.exe
                          "C:\Users\Admin\AppData\Local\Temp\1014555001\25f634d9be.exe"
                          3⤵
                          • Modifies Windows Defender Real-time Protection settings
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Windows security modification
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4088
                        • C:\Users\Admin\AppData\Local\Temp\1014556001\3fd0c2c94d.exe
                          "C:\Users\Admin\AppData\Local\Temp\1014556001\3fd0c2c94d.exe"
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Checks processor information in registry
                          • Modifies system certificate store
                          PID:3764
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1014556001\3fd0c2c94d.exe" & rd /s /q "C:\ProgramData\NGDT2NG4E3WB" & exit
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:2372
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout /t 10
                              5⤵
                              • System Location Discovery: System Language Discovery
                              • Delays execution with timeout.exe
                              PID:4092
                    • C:\Windows\system32\taskeng.exe
                      taskeng.exe {91226FAC-A0E3-42B3-A738-6203B52C459C} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]
                      1⤵
                      • Loads dropped DLL
                      PID:2360
                      • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                        C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:3716
                        • C:\Windows\explorer.exe
                          explorer.exe
                          3⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3796
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                          3⤵
                          • Drops file in System32 directory
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4008
                          • C:\Windows\system32\PING.EXE
                            "C:\Windows\system32\PING.EXE" 127.1.10.1
                            4⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:2408

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f

                      Filesize

                      153KB

                      MD5

                      f89267b24ecf471c16add613cec34473

                      SHA1

                      c3aad9d69a3848cedb8912e237b06d21e1e9974f

                      SHA256

                      21f12abb6de14e72d085bc0bd90d630956c399433e85275c4c144cd9818cbf92

                      SHA512

                      c29176c7e1d58dd4e1deafcbd72956b8c27e923fb79d511ee244c91777d3b3e41d0c3977a8a9fbe094bac371253481dde5b58abf4f2df989f303e5d262e1ce4d

                    • C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5fzip

                      Filesize

                      120KB

                      MD5

                      53e54ac43786c11e0dde9db8f4eb27ab

                      SHA1

                      9c5768d5ee037e90da77f174ef9401970060520e

                      SHA256

                      2f606d24809902af1bb9cb59c16a2c82960d95bff923ea26f6a42076772f1db8

                      SHA512

                      cd1f6d5f4d8cd19226151b6674124ab1e10950af5a049e8c082531867d71bfae9d7bc65641171fd55d203e4fba9756c80d11906d85a30b35ee4e8991adb21950

                    • C:\Program Files\Windows Media Player\graph\graph.exe

                      Filesize

                      245KB

                      MD5

                      7d254439af7b1caaa765420bea7fbd3f

                      SHA1

                      7bd1d979de4a86cb0d8c2ad9e1945bd351339ad0

                      SHA256

                      d6e7ceb5b05634efbd06c3e28233e92f1bd362a36473688fbaf952504b76d394

                      SHA512

                      c3164b2f09dc914066201562be6483f61d3c368675ac5d3466c2d5b754813b8b23fd09af86b1f15ab8cc91be8a52b3488323e7a65198e5b104f9c635ec5ed5cc

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

                      Filesize

                      854B

                      MD5

                      e935bc5762068caf3e24a2683b1b8a88

                      SHA1

                      82b70eb774c0756837fe8d7acbfeec05ecbf5463

                      SHA256

                      a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

                      SHA512

                      bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

                      Filesize

                      717B

                      MD5

                      822467b728b7a66b081c91795373789a

                      SHA1

                      d8f2f02e1eef62485a9feffd59ce837511749865

                      SHA256

                      af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

                      SHA512

                      bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                      Filesize

                      1KB

                      MD5

                      84525ac2c52cedf67aa38131b3f41efb

                      SHA1

                      080afd23b33aabd0285594d580d21acde7229173

                      SHA256

                      ae524d9d757bed48d552b059f951ffd25a7d963ae44a554cb1f3a9641e524080

                      SHA512

                      d898b0913b4005bbbf22a5457ad1e86345860868bc2e53187ad8267c07824d592160a27d850978ebfe78392db784fffb80b73e27418d3a71708383d738ea1d57

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

                      Filesize

                      914B

                      MD5

                      e4a68ac854ac5242460afd72481b2a44

                      SHA1

                      df3c24f9bfd666761b268073fe06d1cc8d4f82a4

                      SHA256

                      cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

                      SHA512

                      5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6DA548C7E5915679F87E910D6581DEF1_19CA6F55DA8A3B0AB12F649B745C90D5

                      Filesize

                      471B

                      MD5

                      f82d5aca5ed5100b9c82259f5c97bd5f

                      SHA1

                      c5fe6c4d597a84244e0330d53887d7865bc8d430

                      SHA256

                      8484447947db2ae840af4235ae99c704d8048091b0a71f098d18d755759d7178

                      SHA512

                      5a9f1b0cba4a1c6974a1d3929c4cf4d6c2b11041bc61cdeac68f8f5915bc19bf56e589b1a8739c8ff3cd4a6e7912405b35bd7f6dbd5ce66dfd465163d638ef47

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_6F7C58D8F5DC37AD0C4A3BEB81BE1660

                      Filesize

                      472B

                      MD5

                      6e21d4c7d76f1411934abcec47aa4f6f

                      SHA1

                      6b1ca4ee9524085a35c2f4f99d1603b4a31829e9

                      SHA256

                      a77a50019d85cd5c6ce6592dfa4b8dcc63399f279e15c06288d13e2dde338e13

                      SHA512

                      ad2bdb52d35f926ae93710e5a3c7775787fb1b2c1a2802f502b70954b1b41c5aafb24ef6d98bebce19bad0fe6a8f29b1f169b55fa49bc5592fa196a42d8c2868

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D73CE810F817D372CC78C5824C36E338

                      Filesize

                      504B

                      MD5

                      7534282617c6278db5ebc9da5b2c673b

                      SHA1

                      4d804a0a0e7c4f0ab1791e9c68c58833d7fc7811

                      SHA256

                      2904a768575e22df734148cd01c687a5dd23a6d2b378ad3a972f6e7f38fa77cc

                      SHA512

                      c45746c38c1e8f0d694a05ef0785070b4f7e3df34a264a3693983d555232bc7b61e78e24187fce8e093448d1724f1226afc3baf262860ad75f076bf57f5929a0

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

                      Filesize

                      170B

                      MD5

                      a52d131c393f94f9bece4c5e28d9bd82

                      SHA1

                      72318a074abc4467155ba3ee46800d854eaa7900

                      SHA256

                      9aef0fe811f8822bcf3cc7d4f350c0fd723d5f83841aab57bb8b8305ac7e02c6

                      SHA512

                      ac650078037311718e5cc40ff07535677d70e570eb0b6aab7fd404ff41019e38ffc8198dc1ff20ff8f008a5ef1b9b897a7c2cdc80eaab63bdc0bb1e8e4d22ed5

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

                      Filesize

                      192B

                      MD5

                      ad9a0460658a8c3f6c3e04dd4ccbb9c0

                      SHA1

                      f2288172b607f62e60c18b0ef733acd9d0459186

                      SHA256

                      a6e4ed4760782150ac23b2e6bd87f88376f39e257fc6d170ec6a01455a3a97a8

                      SHA512

                      b923e10949b25dba4c42cfc526431a2b0e47c2ad9399bda82e26fb45633565200ed9676f8bfadd8acfa4759ab0dd5c5bbce95c7ede52aa9a5ba3165258f8545c

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                      Filesize

                      410B

                      MD5

                      d0005460424140bfe3397e910663733c

                      SHA1

                      72ce03bcb38313d7d52b0c35496d61e9fadf98de

                      SHA256

                      a28a9056c43c9c6b4fa5d1d5e91ca3e50f2ea5eaa17a6ce79f6938059733ab18

                      SHA512

                      21dac5aa8f53a5b75b33328e83d1b031805e0a4774137d2114f1fd36823e560615fbaa567c279eea1d96157b69bf53ed7957942e6b2f4d62fe258dfe821e1a05

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

                      Filesize

                      252B

                      MD5

                      26fcdc4ead3e4dff1ce842acaacee55a

                      SHA1

                      31dcc92cfad9940283a4b43a182868d69ad0ff5b

                      SHA256

                      38f9d1c41260573c601bf1f2f3d583083401088bea5fefd1b19f5d34e2f6ecfc

                      SHA512

                      4d9f8fee3a21557b8fee4b01b1832e4e64378d8872e5a49eed8ee408540a8d6ec2f0cb3559533f97ae4a77faa66ebcd65025e806c5f8b9fda06a12f123e9206b

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DA548C7E5915679F87E910D6581DEF1_19CA6F55DA8A3B0AB12F649B745C90D5

                      Filesize

                      402B

                      MD5

                      f62301c83d119d77f0f6480862aa73a5

                      SHA1

                      49585a061e6af13aa2f082b93463934376beb081

                      SHA256

                      d7aeb5bdde6976ed44c1470ef544470c31ed86b033df9bca72c766d1ba1d6091

                      SHA512

                      462d78fd18ba462d614b504b6feccee348432ccf93b1f52dab7f37e51da7e5162ce3b83cd7649510969b44f3a339866b4d52cf5c54b971e6ef1d65999b1d3251

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      342B

                      MD5

                      d52e2727a41534a2d39f3a8b365fb1a9

                      SHA1

                      cde5e3502def95131b33225c86687436a76a6a04

                      SHA256

                      8aa41c823bda5a2c3242f4e8c654eb4685a690e3f57a9acf181e773b6998d187

                      SHA512

                      9450561eb460184b1ac8ddc0333f1bffa4deba4930d228d333512aaeb0f7fd574fb95dff923d4b76ac4989059520cc71161ff703477dcde86fdbbf7444630a5f

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      342B

                      MD5

                      ad323c6e55a5c97e980cbe703a2109e5

                      SHA1

                      4cabee0e991883cc2d70ab79b174b731250f5c0f

                      SHA256

                      cf561e9b2616f4045776341964eac7a006137fc5ff160b7eeb60ca589bb4f840

                      SHA512

                      8eb9bd90d903b9cf08f39004302ea234fcfb80299c1fbc98973ad0e5df9e206149f7cf3b991235dcc727d85c266fb28785b6ffc7f603e1fc6fa9552eed348e07

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      342B

                      MD5

                      87f9d0ad692fc13d0184b2abbdd4776e

                      SHA1

                      1b10b915838d5df24835b0ecb6f558f448032a4e

                      SHA256

                      f10fc3bbac5d0e2e705dcf65e13f3961cace36f78785d610488b924e34b1fba5

                      SHA512

                      ffbbf1c1766dbffe8fc944a67e8b0018cec2ee76bbc186c77a62c5f3ec4a591481b92e7e943e00999ff832f87ad7f3ea9c4ed0e80daed75cb62f57bec56b534d

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      342B

                      MD5

                      9b1cd00be7bfc9122828365313ddd5f5

                      SHA1

                      682cbe9fc0adff631f6df9158c05d1c91a0ec4c8

                      SHA256

                      b153d17f1b42df8ad2f34335372438268ee7bf629629476ffb05356996d1446c

                      SHA512

                      328854282e87b33feda7cb9794942e565944cf3bd9f80f8c2328dc3aa16a2733204de033ede84c9a99cdbd558352f86ccdcaaa09c78fadff8aa6d0509a8affd0

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      342B

                      MD5

                      7daa7e3c593580846fa3a2583f16346e

                      SHA1

                      a4b5cb4e185c8cfa6b0f3c65ca4b75485fcb760b

                      SHA256

                      c9d7d643023f0a831f37507e791e64ff4d583c4f005d575cde5ae9dc075f32d4

                      SHA512

                      407429293095499006e87f8f1438de46caafeab20715d105463043f3a26210f739c543764d6856015fe7354aa8b3e3273076acd8f2befa2ef3bb522958a937fa

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      342B

                      MD5

                      a99f6146167038ba25000fc38ac47c66

                      SHA1

                      c8e9f74be19dc625a429ae45a0a681a87dca41c4

                      SHA256

                      d276861520b056c4a9078f1a320a5ac4dd7f0edc235b8bf2f6f5af3fc65cc2d3

                      SHA512

                      d76d6d88e2b6f6b7101cf19648e61b073da297b9760a156e7a0e002cf635d6718180bd596a4421779e158dc7fe43b24eb92a1bece2ef56d3fd6b3fad1f081918

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      342B

                      MD5

                      a1de2f9433e39e5efeed99e72cbbd4ef

                      SHA1

                      6e2d42deaad55b5ad3ab8aba0e8c53da3a0e0012

                      SHA256

                      c2c5c318ae1b134ebaa3bc23bd779ac970ac140a202c5d7b56c554d572a39a2b

                      SHA512

                      4972910c864dd04e228d653221bb89c79f18bb05220f39e7824009abfc9a1d56af294efe5988190c0e1b5216dc7d4f9b0380dd437efadf91f15e92f842767687

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      342B

                      MD5

                      17d4dbf4832d19d73b99915ac9a528bc

                      SHA1

                      a984396117328c7c7ef29fb14bd02f2c3a73c0d5

                      SHA256

                      67428526515b42a9e5b8d51d8fae2f82687052d98f54a59b4b6f68e97e1bbeea

                      SHA512

                      548ef24b7a03211cf2f9ee4a0ae326218b36b0e5650179a1fcc7449e1bcdbdfd4505a56e3a7fcfdf05984e090be5269ad2817224a5b2c2a132721fb7eaaaf0ec

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      342B

                      MD5

                      93cc144611f0f512c19bdace80668469

                      SHA1

                      c2573f53a4e0059e8428abc33fdfadfc5bf3e1a8

                      SHA256

                      70ac74be8a8bcbd6e66e9c6e4b300eb1a061021df1d48779b77bec23bed98a4b

                      SHA512

                      7418a520f628ec1f73a23713a257b738c2ec3cea696fbb0c314de1ffa3da28c27639a071cc52e2cb799f4361a4e58ccd4edbd35e074fe8051b755563cd32a918

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      342B

                      MD5

                      ecd660d842d56b05efce304a92f1a244

                      SHA1

                      2b36f893076b9f1b49d4e4a4eef73b8d8f4f6968

                      SHA256

                      eb88c7576ecf3eaa8003786c2aaa49828fac821b02578311ce94fd73ca8f456a

                      SHA512

                      f893447971a09a480a0904ee674400945ad2743794719d4f8188f7db3201a7092390cb13032eea33e8433e64bbef0eaab108b946de4b59f9898b8f9917ba1721

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      342B

                      MD5

                      57e8aeb763cf879f411d7f3e78cb8031

                      SHA1

                      8f29cce3879f4c76f050d8c4284c7d85bddcbfcc

                      SHA256

                      0e7183ffcd3d0d791825f6d6571df65aa1203e08a116cc6a8828ee8551fdb4ea

                      SHA512

                      4c4ab437b6b3c08fb686b12d45d0d62594364c0bd2292c9d94926ece569ce20f7e0a0f10b6d0884a985a5e14d7182f049920476e708a403540d95dc149fbb14b

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      342B

                      MD5

                      a10e8c97061c15dfc76aa9d4db7fce32

                      SHA1

                      ecf63ca5fc6ce5626a4b04ddf64f703b805747c5

                      SHA256

                      1cc3258dadf588bdf5a15965630edcc1e16f99801d4323f115b79238ec5c03f0

                      SHA512

                      bb7df39eec205c016ea3fc1538dc7d38512696a919eff2faa0c533108936639d853ca2c8ec1aff6d7deb15b3b24a827e804678359c9ed224e82dfd7db32c3478

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      342B

                      MD5

                      0a3de59467e5920797e44ce3c6abf035

                      SHA1

                      6b316b541c4ee812a3ba75363f1b5ef2beea295b

                      SHA256

                      7586f6702bf925845692fea4050ff43b1f9de4460c59a24d24f181fa616ab3de

                      SHA512

                      8905891094ed08dbac1073ac32508543fe22a6fd560c4b8f876f49c923975d0c2ae7307b0c5c05148a1b7a71d54f6c8f6d5b0e58fe2ba8368c518864541778ac

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      342B

                      MD5

                      85985350b50a5dc38661cc34a9c5b71e

                      SHA1

                      702449f814d4c80456711e32abd6acb64fb5a052

                      SHA256

                      ce8e45052e5a8f082db2c058d0524564f2306373cc59cecf8265f7e2cd45cc75

                      SHA512

                      03f630ac6ec448f05cdce936716781127aa74002bbfa4b1f57ad2688ab01cc25ea0f06a9cee76a570769926e740a997756b0ab6630a5345bab291ef72b9f4804

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      342B

                      MD5

                      7622663b92e8b34dbfff0173681b61fa

                      SHA1

                      21e9f86d7fb63ad25427a5bb10d8ea1b6bfca15b

                      SHA256

                      ddf26a8324efacf61cfee4bb260e9e9a795dadcde15405bc0e79750e844bee18

                      SHA512

                      1c0d4e3b0403d7a32a8adb0d3c46af365b5014aca15d89e65208b6a1d1aed6b1d3d6a6364c61ea398df9a626739cd08d440ad90415241d6ca4e81cce64e4d062

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      342B

                      MD5

                      10294af100ea2742d77c6cfb1cfd4961

                      SHA1

                      6f8d6de466d10b7054440fac53c80a47edd7ebbe

                      SHA256

                      d6181b151e7ecb89138b849a169c5bdb7c434f230be3b2e091e886a39e8417d8

                      SHA512

                      295b94c89a9e84d25e07a79fdf849777a2693b5df86f7eefd86b862bc4a8ba3ded72ff3163ad957e847f35d81221cd01aab693541d674a864abaa66165ff4919

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C02877841121CC45139CB51404116B25_6F7C58D8F5DC37AD0C4A3BEB81BE1660

                      Filesize

                      398B

                      MD5

                      b20ee70545419d67a7f8df7bf3359d9b

                      SHA1

                      7af84c33b83c6162530f2fe396579a12bac8a629

                      SHA256

                      7a0d9fd86be88c218fbb40c31a73598b9cdafdcbff1b66f3984b7da944e74173

                      SHA512

                      3b460f0c469461e009ff22db1d00736ab7ec84c054ce4adcebf27c44952cdcff1f597de616deef162ed5377ab7581d8bf3e34f89217dbe992094b91c86e3e1c3

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D73CE810F817D372CC78C5824C36E338

                      Filesize

                      550B

                      MD5

                      2f80cb161dc6d3d9a69ca9b0c7fd009e

                      SHA1

                      a84b9b8f50b60683588d885ba61e1d9c6e3b5ebf

                      SHA256

                      792d5febc1397dd3af740685084dfa3c50133a56b31cc053ad09fb9e4ef79926

                      SHA512

                      e71390b80da69d4f5d2e78878f1a3e6d4cd661a2131dd6b31fc19a54bf20150eafe6949c09d9e97f37588a91f81ccee80c2a9c96cde89f3d4b8ba783e1dc470d

                    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\ZZYTB2SD\www.google[1].xml

                      Filesize

                      98B

                      MD5

                      c3ee3a81ed00fa6d0a681d8417f03a42

                      SHA1

                      db8d1819e08a78abc0b95eb01b5fe674bae195ac

                      SHA256

                      4bdfd470e9984add8128c7ebeaab3c03a6d7665100a05dd8f1023a2a771f9362

                      SHA512

                      3eaa11b911a66422a9e50e500d2f34f05d59e46967c4f6a4eba7fac9394cd675c5bd281152b82e069e5228578aaa4b0b4d6cfd1eac71ec00af57ec2a4a2b9b2f

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7CNUR30T\favicon[1].ico

                      Filesize

                      5KB

                      MD5

                      f3418a443e7d841097c714d69ec4bcb8

                      SHA1

                      49263695f6b0cdd72f45cf1b775e660fdc36c606

                      SHA256

                      6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

                      SHA512

                      82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D6V88JEY\download[1].htm

                      Filesize

                      1B

                      MD5

                      cfcd208495d565ef66e7dff9f98764da

                      SHA1

                      b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                      SHA256

                      5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                      SHA512

                      31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D6V88JEY\random[1].exe

                      Filesize

                      1.9MB

                      MD5

                      dd44780d69d56d86bd3be9d6ca0f69a9

                      SHA1

                      c9afab3e117153f469723102214a907685a509d6

                      SHA256

                      5cf283b12d73892ee010289b4d554e5b1c7d1aede0a8e6cd0a33415513526b5b

                      SHA512

                      2941a447f343d039f356cd63a009b33f5eb042553143c009a23a4e68e76c59101052fc9a8092f56b81bf61b3c068b3c685c558933a672ec03c0e94fb4b873eff

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EOYL2MRI\styles__ltr[1].css

                      Filesize

                      76KB

                      MD5

                      c8bc74b65a8a31d4c7af2526b0c75a62

                      SHA1

                      dd1524ca86eb241b31724a9614285a2845880604

                      SHA256

                      3b457e0acfb1d231461936c78086c9ea63de3397cbb019c4fe0182a645d67717

                      SHA512

                      4d7214ac44475cb4d9d848d71caee30a3872cab3957fbb26a0aca13db1933cda1e9799938ba1460581483123dd6f81c3193bbc80989cba7e555f308c212841ae

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M4TQDAHL\recaptcha__en[1].js

                      Filesize

                      546KB

                      MD5

                      81697e6cdd98e37117d7bddcecf07576

                      SHA1

                      0ea9efeb29efc158cd175bb05b72c8516dbaa965

                      SHA256

                      73dd640564004ec8730e7f3433b9dfaa6876ac3a27e6964a17834f07f6d56116

                      SHA512

                      fc29d4a1fd39a7c78b7f57b221596acee9b805a133ce2d6ff4bc497a7b3584ab10e3d4ffde30c86884f1abeac7d521598ebda6e0b01fc92525986c98250fa3f8

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\activity-stream.discovery_stream.json.tmp

                      Filesize

                      23KB

                      MD5

                      9e3910386b462ea482ab7834fc9c2490

                      SHA1

                      b220fed36fb7f40507ab10d9c2b38f94aee9f03c

                      SHA256

                      6884561ec511e54f227273feee4890b74e3c381f9333dc39e1c98a76b7d57e0f

                      SHA512

                      6207c8b019ea295354e1f8e7a817257428203dec0660df883ace1e4560c67d3d42a8d0ce48eb7e8e29968f3cff6e290eb28561d5bd8da1697ea7b04b6dc61473

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                      Filesize

                      15KB

                      MD5

                      96c542dec016d9ec1ecc4dddfcbaac66

                      SHA1

                      6199f7648bb744efa58acf7b96fee85d938389e4

                      SHA256

                      7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                      SHA512

                      cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                    • C:\Users\Admin\AppData\Local\Temp\1014365001\W4KLQf7.exe

                      Filesize

                      3.7MB

                      MD5

                      12c766cab30c7a0ef110f0199beda18b

                      SHA1

                      efdc8eb63df5aae563c7153c3bd607812debeba4

                      SHA256

                      7b2070ca45ec370acba43623fb52931ee52bee6f0ce74e6230179b058fa2c316

                      SHA512

                      32cad9086d9c7a8d88c3bfcb0806f350f0df9624637439f1e34ab2efffa0c273faef0c226c388ed28f07381aef0655af9e3eb3e9557cbfd2d8c915b556b1cf10

                    • C:\Users\Admin\AppData\Local\Temp\1014430001\dwVrTdy.exe

                      Filesize

                      591KB

                      MD5

                      3567cb15156760b2f111512ffdbc1451

                      SHA1

                      2fdb1f235fc5a9a32477dab4220ece5fda1539d4

                      SHA256

                      0285d3a6c1ca2e3a993491c44e9cf2d33dbec0fb85fdbf48989a4e3b14b37630

                      SHA512

                      e7a31b016417218387a4702e525d33dd4fe496557539b2ab173cec0cb92052c750cfc4b3e7f02f3c66ac23f19a0c8a4eb6c9d2b590a5e9faeb525e517bc877ba

                    • C:\Users\Admin\AppData\Local\Temp\1014535001\CuKxXX0.exe

                      Filesize

                      5.6MB

                      MD5

                      c72b7c1a451219825e066832e38f92f8

                      SHA1

                      70227f19e7092c41d6699efa2a709fa489bb7847

                      SHA256

                      4e7a2984e68806ab0d4489587aaa2a731171fc968aa7d40532020bf9c26539b3

                      SHA512

                      cbe4a782cb8500fd7d1c3ba641b58964722d978176d3f8d782693d16b7638a24dc472954200dd085484d132c840f3c420cc7393326cef96fd5ae6342403228bb

                    • C:\Users\Admin\AppData\Local\Temp\1014551001\6d5d5922b5.exe

                      Filesize

                      4.2MB

                      MD5

                      3a425626cbd40345f5b8dddd6b2b9efa

                      SHA1

                      7b50e108e293e54c15dce816552356f424eea97a

                      SHA256

                      ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                      SHA512

                      a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                    • C:\Users\Admin\AppData\Local\Temp\1014552001\1bccb831cb.exe

                      Filesize

                      710KB

                      MD5

                      28e568616a7b792cac1726deb77d9039

                      SHA1

                      39890a418fb391b823ed5084533e2e24dff021e1

                      SHA256

                      9597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2

                      SHA512

                      85048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5

                    • C:\Users\Admin\AppData\Local\Temp\1014553001\c2474be541.exe

                      Filesize

                      949KB

                      MD5

                      e1eb6e279e48e48e1c0021e3dbe01e9b

                      SHA1

                      56fce13b8967a0cd68e48b425f38a50f4a957e18

                      SHA256

                      1935497fd015edb463f3a1a229be949c565a7346521719595a6e46c8552145dd

                      SHA512

                      ca71848d6a95c9ba45b7cf73f11a2b301bf4b24cfa2549ee38ec53307e7c99fa7cdc3884103a7ad281a36b9ebc8567d8fa84ed56f9caeeacefd1a3120d9124be

                    • C:\Users\Admin\AppData\Local\Temp\1014554001\bb87577ae6.exe

                      Filesize

                      1.8MB

                      MD5

                      bb02eb5eef47a773ae26d60ae263d9fa

                      SHA1

                      283211e861760787a349aefc7b393f41bd00dda6

                      SHA256

                      eb9e0ab7722a28e6c8e797d66593cb11b544ec242c245f9d8d924b255ed539ba

                      SHA512

                      5868e829d7bbb1e3f208631c9b31c93faabc9cb9e197b814364c91459a4d6fd2b84de19552bd36950878c5b54224c1e2cb35c181d9b4115a848386836e140818

                    • C:\Users\Admin\AppData\Local\Temp\1014555001\25f634d9be.exe

                      Filesize

                      2.7MB

                      MD5

                      c657bf839fb979c5ce29cec72eebf10b

                      SHA1

                      87e7d374570f137582ffcc4d62d71e44380839df

                      SHA256

                      9239680c12bab0e396798fd89cbbab0b8ebbd8b65cf03c73ff246236390d85fe

                      SHA512

                      70098c26906d60437d77fae7bbb6e48f0435e094323d050b23188766bb248d6b77079a44770105b198ddaf439f584f86105c01f32e5f4ad555060870f517295e

                    • C:\Users\Admin\AppData\Local\Temp\1014556001\3fd0c2c94d.exe

                      Filesize

                      384KB

                      MD5

                      dfd5f78a711fa92337010ecc028470b4

                      SHA1

                      1a389091178f2be8ce486cd860de16263f8e902e

                      SHA256

                      da96f2eb74e60de791961ef3800c36a5e12202fe97ae5d2fcfc1fe404bc13c0d

                      SHA512

                      a3673074919039a2dc854b0f91d1e1a69724056594e33559741f53594e0f6e61e3d99ec664d541b17f09ffdebc2de1b042eec19ca8477fac86359c703f8c9656

                    • C:\Users\Admin\AppData\Local\Temp\Cab252.tmp

                      Filesize

                      70KB

                      MD5

                      49aebf8cbd62d92ac215b2923fb1b9f5

                      SHA1

                      1723be06719828dda65ad804298d0431f6aff976

                      SHA256

                      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                      SHA512

                      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                    • C:\Users\Admin\AppData\Local\Temp\Tar10F3.tmp

                      Filesize

                      181KB

                      MD5

                      4ea6026cf93ec6338144661bf1202cd1

                      SHA1

                      a1dec9044f750ad887935a01430bf49322fbdcb7

                      SHA256

                      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                      SHA512

                      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                      Filesize

                      3.1MB

                      MD5

                      3197aa29fd7d023f4483200e06a95d7a

                      SHA1

                      62cd61a0004ef666d0d6427c42c8a6ec7b30617c

                      SHA256

                      ac7eab26629e889c428293f303b428424ffccae5658636cca54512753fa2792a

                      SHA512

                      7379939f14ce763a9726638f6b694e0a84dbc80a2128db6e58224e2db432ad242cfc04e2576ffd462e1c75836141310cfd0ac751245061170d041b211e528637

                    • C:\Users\Admin\AppData\Local\Temp\main\7z.dll

                      Filesize

                      1.6MB

                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe

                      Filesize

                      458KB

                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip

                      Filesize

                      1.7MB

                      MD5

                      7187cc2643affab4ca29d92251c96dee

                      SHA1

                      ab0a4de90a14551834e12bb2c8c6b9ee517acaf4

                      SHA256

                      c7e92a1af295307fb92ad534e05fba879a7cf6716f93aefca0ebfcb8cee7a830

                      SHA512

                      27985d317a5c844871ffb2527d04aa50ef7442b2f00d69d5ab6bbb85cd7be1d7057ffd3151d0896f05603677c2f7361ed021eac921e012d74da049ef6949e3a3

                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip

                      Filesize

                      1.7MB

                      MD5

                      b7d1e04629bec112923446fda5391731

                      SHA1

                      814055286f963ddaa5bf3019821cb8a565b56cb8

                      SHA256

                      4da77d4ee30ad0cd56cd620f4e9dc4016244ace015c5b4b43f8f37dd8e3a8789

                      SHA512

                      79fc3606b0fe6a1e31a2ecacc96623caf236bf2be692dadab6ea8ffa4af4231d782094a63b76631068364ac9b6a872b02f1e080636eba40ed019c2949a8e28db

                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip

                      Filesize

                      1.7MB

                      MD5

                      0dc4014facf82aa027904c1be1d403c1

                      SHA1

                      5e6d6c020bfc2e6f24f3d237946b0103fe9b1831

                      SHA256

                      a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7

                      SHA512

                      cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028

                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_7.zip

                      Filesize

                      3.3MB

                      MD5

                      cea368fc334a9aec1ecff4b15612e5b0

                      SHA1

                      493d23f72731bb570d904014ffdacbba2334ce26

                      SHA256

                      07e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541

                      SHA512

                      bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748

                    • C:\Users\Admin\AppData\Local\Temp\main\file.bin

                      Filesize

                      3.3MB

                      MD5

                      045b0a3d5be6f10ddf19ae6d92dfdd70

                      SHA1

                      0387715b6681d7097d372cd0005b664f76c933c7

                      SHA256

                      94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

                      SHA512

                      58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

                    • C:\Users\Admin\AppData\Local\Temp\main\main.bat

                      Filesize

                      440B

                      MD5

                      3626532127e3066df98e34c3d56a1869

                      SHA1

                      5fa7102f02615afde4efd4ed091744e842c63f78

                      SHA256

                      2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

                      SHA512

                      dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      442KB

                      MD5

                      85430baed3398695717b0263807cf97c

                      SHA1

                      fffbee923cea216f50fce5d54219a188a5100f41

                      SHA256

                      a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                      SHA512

                      06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      8.0MB

                      MD5

                      a01c5ecd6108350ae23d2cddf0e77c17

                      SHA1

                      c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                      SHA256

                      345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                      SHA512

                      b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CGK0EHBGBC33GCXZN0PC.temp

                      Filesize

                      7KB

                      MD5

                      66c2901fc0c04cd9c9a2c9a7aeb516d6

                      SHA1

                      56a4e6c6bb285fdeb8286e77f95ffb023033b1b5

                      SHA256

                      2054b358b2d0b8dad22d306339a6283f2a0c8f580e8263f1d76e59911b5315b3

                      SHA512

                      6d2f18fbca2906df358e1a0816a2db1222a900cefc8050d6797b0a343f16f361630985a0c84921e65127270ad063979ad4ab3c4b3845992a34fecd57f0368b36

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\db\data.safe.bin

                      Filesize

                      2KB

                      MD5

                      e39b5eb06344fb455c969a0653dbfc16

                      SHA1

                      b0081f18ea54b0c43a98b5d9bc2a667625383d86

                      SHA256

                      0c5615ded4e80e1d25388946bfe5f176c71cf4421b9abaafdbba56bea1814b47

                      SHA512

                      fac558a82cc5e873657ba5ab279f14e2f0c9fcb5efe5a80edd5f278cefcd363c693ed4e6c1b120a897e9e7de76a748b0eda901a10bac6b592590af51e3db43f8

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\pending_pings\0ca9b4e4-e1a0-43d8-a2ba-dadb2e6c652d

                      Filesize

                      745B

                      MD5

                      9c1ac48bc4c556509a5e1d778600a8e6

                      SHA1

                      04efa12804cf5aaf1697887ca578ddb62c8035ea

                      SHA256

                      ca167875651a82335014c2c676e5c44e072d6f8b63cd9a4dfa518205b245e18f

                      SHA512

                      c5f86d9d5e0a1f593441432761c0be41ec6d7d72cb428743ee8be6eb59eafbdada29e5b88d6f7966ae53dc5dc36bf886675bc7eed4bc6edf26bdf93733c1601d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\pending_pings\194aa613-51b5-4200-b696-62630f7f227e

                      Filesize

                      13KB

                      MD5

                      6b958f6fe88732e775a475a046be6639

                      SHA1

                      78b569a1636cd365cfb982c05a03d54afe883a12

                      SHA256

                      a69ea97971a066810bfb36884c23c4c8d4aa4f674390199c784fb62e77a4b519

                      SHA512

                      3b7791036fd60d562f0ad602410ba4fe2b932d71c1213ad9f7c8b1b22580e990a650c89ebb12898ca6381dfc2397aa03357f1e0c76e2bd194532f88b08fa0d24

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                      Filesize

                      997KB

                      MD5

                      fe3355639648c417e8307c6d051e3e37

                      SHA1

                      f54602d4b4778da21bc97c7238fc66aa68c8ee34

                      SHA256

                      1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                      SHA512

                      8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      3d33cdc0b3d281e67dd52e14435dd04f

                      SHA1

                      4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                      SHA256

                      f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                      SHA512

                      a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                      Filesize

                      479B

                      MD5

                      49ddb419d96dceb9069018535fb2e2fc

                      SHA1

                      62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                      SHA256

                      2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                      SHA512

                      48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                      Filesize

                      372B

                      MD5

                      8be33af717bb1b67fbd61c3f4b807e9e

                      SHA1

                      7cf17656d174d951957ff36810e874a134dd49e0

                      SHA256

                      e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                      SHA512

                      6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                      Filesize

                      11.8MB

                      MD5

                      33bf7b0439480effb9fb212efce87b13

                      SHA1

                      cee50f2745edc6dc291887b6075ca64d716f495a

                      SHA256

                      8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                      SHA512

                      d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                      Filesize

                      1KB

                      MD5

                      688bed3676d2104e7f17ae1cd2c59404

                      SHA1

                      952b2cdf783ac72fcb98338723e9afd38d47ad8e

                      SHA256

                      33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                      SHA512

                      7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                      Filesize

                      1KB

                      MD5

                      937326fead5fd401f6cca9118bd9ade9

                      SHA1

                      4526a57d4ae14ed29b37632c72aef3c408189d91

                      SHA256

                      68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                      SHA512

                      b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs-1.js

                      Filesize

                      6KB

                      MD5

                      c709ac526aeb3efd28dad6aef5d113f5

                      SHA1

                      cf98b6149740ed87664a68bdedcfaac5c1d91138

                      SHA256

                      ebd8070a52aa5713268c83b840d62116d733d6b7bb8301514a3166ac21cd2132

                      SHA512

                      729b927d5719e7ebe46e9cc95e172d0e6b49e4a48f27ae19052ae7681c7c3dd410933c70cab318730f64148ae8ab4cdeebdf18fe759de38a8bbef077dba7da92

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs-1.js

                      Filesize

                      7KB

                      MD5

                      fa6283846f114b8a1eb1228ae055e682

                      SHA1

                      2e04efd367bcd9a9dd987642962d13c2402c35cb

                      SHA256

                      ced7244825ce99154d0c2e748bd5e3dabfbae0a4ac72c0acaf3518c060e8f183

                      SHA512

                      28f7bbf5d65e029fd60bd5a24f7c84b30dc0cd21f06ce6a1eaa035cd14b60b4e30aafbacef41affe8e9fd396627f42c805ef30739f6acadbd94583eed3e02759

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs-1.js

                      Filesize

                      7KB

                      MD5

                      520ee876b598a1ed547a0e7808638e1f

                      SHA1

                      d72ea829eec164ab641acbcbff74e6efb5d0af66

                      SHA256

                      9f7f0295bff844fbfe17931204350089193c3da24be06c1dc8fe6e1ed4fc797e

                      SHA512

                      0a8df63a9e0f178fbafd1f921888a530ffe3d32aa204ddf1950c4b93d99a61e18708c46d2ad1b1e72e7a0e94091bc3374fe011acc68365cf9590e46a7e4165fd

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs.js

                      Filesize

                      6KB

                      MD5

                      c1b7dd62c6e7c9500969cc9c12e5291a

                      SHA1

                      b2ef7f6ea6bb3558e6a70d6fc98f0005d3078c5d

                      SHA256

                      6f640267fa948ce487791affbf5945a12309b2cfe3687dd0c462f629ec49eb4b

                      SHA512

                      0f8fde673b54b0001419cdc44d4c0e6ca1eac3be98295e63012953d70c3333588c52fc72414ed270c999af5219ce76204ee41c9725ee1b042a63553ecd5abd7a

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

                      Filesize

                      4KB

                      MD5

                      daeb525f4def50b11f2f8848e58efec4

                      SHA1

                      0a5d4edf372993529494a412ff0637656e8b76c1

                      SHA256

                      80dcaada39e1e2cab41a2e193cb04fea0b872a213d4c54707c8db352755331b7

                      SHA512

                      cfa9ca3c1cdeae7b565ae588c6fe3c95728d3a204a72a9b94bf0b94f94227f610a1d6524fcb157d40f88a0f1e7f3ac3eaca32311cd65678c09f895c009158e9b

                    • memory/1704-114-0x0000000000400000-0x00000000007BD000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/1712-226-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-218-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-1526-0x0000000002810000-0x0000000002864000-memory.dmp

                      Filesize

                      336KB

                    • memory/1712-188-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-220-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-222-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-228-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-230-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-232-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-224-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-202-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-204-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-206-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-208-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-210-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-1374-0x00000000008A0000-0x00000000008EC000-memory.dmp

                      Filesize

                      304KB

                    • memory/1712-200-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-175-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-216-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-176-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-212-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-214-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-198-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-172-0x0000000000290000-0x0000000000830000-memory.dmp

                      Filesize

                      5.6MB

                    • memory/1712-173-0x000000001C910000-0x000000001CE7C000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-178-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-174-0x000000001CE80000-0x000000001D3EE000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-180-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-182-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-1373-0x000000001D3F0000-0x000000001D8CE000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/1712-190-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-192-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-184-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-194-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-186-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1712-196-0x000000001CE80000-0x000000001D3E8000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1976-1639-0x00000000002F0000-0x00000000009A4000-memory.dmp

                      Filesize

                      6.7MB

                    • memory/1976-1599-0x00000000002F0000-0x00000000009A4000-memory.dmp

                      Filesize

                      6.7MB

                    • memory/2360-2600-0x000000013FC50000-0x00000001400E0000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2360-3059-0x000000013FC50000-0x00000001400E0000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2360-2628-0x000000013FC50000-0x00000001400E0000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2360-2597-0x000000013FC50000-0x00000001400E0000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2364-1501-0x0000000001E00000-0x0000000001E08000-memory.dmp

                      Filesize

                      32KB

                    • memory/2364-1500-0x000000001B660000-0x000000001B942000-memory.dmp

                      Filesize

                      2.9MB

                    • memory/2476-1406-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

                      Filesize

                      2.9MB

                    • memory/2476-1407-0x0000000002960000-0x0000000002968000-memory.dmp

                      Filesize

                      32KB

                    • memory/2532-1495-0x000000013FE60000-0x00000001402F0000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2532-1618-0x000000013FE60000-0x00000001402F0000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2532-1619-0x000000013FE60000-0x00000001402F0000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2580-1372-0x0000000000400000-0x0000000000C65000-memory.dmp

                      Filesize

                      8.4MB

                    • memory/2580-2466-0x0000000000400000-0x0000000000C65000-memory.dmp

                      Filesize

                      8.4MB

                    • memory/2580-1494-0x0000000000400000-0x0000000000C65000-memory.dmp

                      Filesize

                      8.4MB

                    • memory/2724-1597-0x0000000006830000-0x0000000006EE4000-memory.dmp

                      Filesize

                      6.7MB

                    • memory/2724-1371-0x0000000006830000-0x0000000007095000-memory.dmp

                      Filesize

                      8.4MB

                    • memory/2724-2422-0x0000000006000000-0x00000000062BA000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/2724-2461-0x0000000006000000-0x00000000062BA000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/2724-16-0x0000000001220000-0x0000000001544000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2724-1370-0x0000000006830000-0x0000000007095000-memory.dmp

                      Filesize

                      8.4MB

                    • memory/2724-18-0x0000000001221000-0x0000000001289000-memory.dmp

                      Filesize

                      416KB

                    • memory/2724-19-0x0000000001220000-0x0000000001544000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2724-1598-0x0000000006830000-0x0000000006EE4000-memory.dmp

                      Filesize

                      6.7MB

                    • memory/2724-2317-0x0000000006000000-0x00000000062BA000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/2724-2318-0x0000000006000000-0x00000000062BA000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/2724-22-0x0000000001220000-0x0000000001544000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2724-2302-0x0000000006830000-0x0000000006EE4000-memory.dmp

                      Filesize

                      6.7MB

                    • memory/2724-23-0x0000000001220000-0x0000000001544000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2724-24-0x0000000001221000-0x0000000001289000-memory.dmp

                      Filesize

                      416KB

                    • memory/2724-25-0x0000000001220000-0x0000000001544000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2724-52-0x0000000001220000-0x0000000001544000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2724-21-0x0000000001220000-0x0000000001544000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2724-157-0x0000000001220000-0x0000000001544000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2776-1493-0x000000013FE60000-0x00000001402F0000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/3000-17-0x0000000000D61000-0x0000000000DC9000-memory.dmp

                      Filesize

                      416KB

                    • memory/3000-15-0x0000000000D60000-0x0000000001084000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/3000-4-0x0000000000D60000-0x0000000001084000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/3000-3-0x0000000000D60000-0x0000000001084000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/3000-2-0x0000000000D61000-0x0000000000DC9000-memory.dmp

                      Filesize

                      416KB

                    • memory/3000-1-0x0000000076F50000-0x0000000076F52000-memory.dmp

                      Filesize

                      8KB

                    • memory/3000-0-0x0000000000D60000-0x0000000001084000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/3716-2610-0x000000013FC50000-0x00000001400E0000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/3716-2599-0x000000013FC50000-0x00000001400E0000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4088-2320-0x0000000001310000-0x00000000015CA000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/4088-2511-0x0000000001310000-0x00000000015CA000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/4088-2319-0x0000000001310000-0x00000000015CA000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/4088-2321-0x0000000001310000-0x00000000015CA000-memory.dmp

                      Filesize

                      2.7MB