Overview

overview

10

Static

static

3

211ea35545...d1.exe

windows7-x64

10

211ea35545...d1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-12-2024 00:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    211ea35545389fab23d79e5e83b02a53d000971e6e4fc0a1346fc38bc97d72d1.exe

  • Size

    2.8MB

  • MD5

    eadab56cfbaef413b705dac5db36aa16

  • SHA1

    163fc1a47691e79e6bbffbab8be7f795bd55d99d

  • SHA256

    211ea35545389fab23d79e5e83b02a53d000971e6e4fc0a1346fc38bc97d72d1

  • SHA512

    461087bdc52f78dde32330aa2240216527be6586903071f63cff43b4d0d43089262265816fc6f5ac3072d67624255fae694476754a4cf2a43990155051e0e014

  • SSDEEP

    49152:GLNDk2Pu0hI2hcbYQc4Nv0PYax7Ia1uTZYsR:GFk2PuWIBeOv0P1WayZYsR

Score
10/10
amadeycryptbotlummastealc9c9aa5fed3aastokdiscoveryevasionexecutionpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

Extracted

Family

cryptbot

C2

http://home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ1734

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 23 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 46 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 41 IoCs
  • Identifies Wine through registry keys 2 TTPs 23 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 25 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 30 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2808
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\System32\svchost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4556
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\System32\svchost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4876
    • C:\Users\Admin\AppData\Local\Temp\211ea35545389fab23d79e5e83b02a53d000971e6e4fc0a1346fc38bc97d72d1.exe
      "C:\Users\Admin\AppData\Local\Temp\211ea35545389fab23d79e5e83b02a53d000971e6e4fc0a1346fc38bc97d72d1.exe"
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2260
      • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
        "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2424
        • C:\Users\Admin\AppData\Local\Temp\1007312001\c08c1ea727.exe
          "C:\Users\Admin\AppData\Local\Temp\1007312001\c08c1ea727.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1624
        • C:\Users\Admin\AppData\Local\Temp\1007313001\7ab9332745.exe
          "C:\Users\Admin\AppData\Local\Temp\1007313001\7ab9332745.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4752
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 524
            4⤵
            • Program crash
            PID:840
        • C:\Users\Admin\AppData\Local\Temp\1007314001\cbcbd912af.exe
          "C:\Users\Admin\AppData\Local\Temp\1007314001\cbcbd912af.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3052
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1272
            • C:\Users\Admin\AppData\Local\Temp\1017198001\74a47497a6.exe
              "C:\Users\Admin\AppData\Local\Temp\1017198001\74a47497a6.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2344
              • C:\Users\Admin\AppData\Local\Temp\1017198001\74a47497a6.exe
                "C:\Users\Admin\AppData\Local\Temp\1017198001\74a47497a6.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4648
            • C:\Users\Admin\AppData\Local\Temp\1017199001\babf2a8063.exe
              "C:\Users\Admin\AppData\Local\Temp\1017199001\babf2a8063.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4208
            • C:\Users\Admin\AppData\Local\Temp\1017200001\e279d1843a.exe
              "C:\Users\Admin\AppData\Local\Temp\1017200001\e279d1843a.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:772
            • C:\Users\Admin\AppData\Local\Temp\1017201001\e5dd744854.exe
              "C:\Users\Admin\AppData\Local\Temp\1017201001\e5dd744854.exe"
              5⤵
              • Enumerates VirtualBox registry keys
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1652
            • C:\Users\Admin\AppData\Local\Temp\1017202001\baf606d495.exe
              "C:\Users\Admin\AppData\Local\Temp\1017202001\baf606d495.exe"
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3572
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "powershell.exe" Add-MpPreference -ExclusionPath "C:\dssdh"
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2300
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:1784
              • C:\dssdh\d10ced120088460fbd8414f76f049b7d.exe
                "C:\dssdh\d10ced120088460fbd8414f76f049b7d.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1148
            • C:\Users\Admin\AppData\Local\Temp\1017203001\e63b58765a.exe
              "C:\Users\Admin\AppData\Local\Temp\1017203001\e63b58765a.exe"
              5⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:3720
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 568
                6⤵
                • Program crash
                PID:372
            • C:\Users\Admin\AppData\Local\Temp\1017204001\d94388d31f.exe
              "C:\Users\Admin\AppData\Local\Temp\1017204001\d94388d31f.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:4112
              • C:\Users\Admin\AppData\Local\Temp\1017204001\d94388d31f.exe
                "C:\Users\Admin\AppData\Local\Temp\1017204001\d94388d31f.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2920
            • C:\Users\Admin\AppData\Local\Temp\1017205001\8feef60b96.exe
              "C:\Users\Admin\AppData\Local\Temp\1017205001\8feef60b96.exe"
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4556
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
                6⤵
                  PID:880
                  • C:\Windows\system32\mode.com
                    mode 65,10
                    7⤵
                      PID:1092
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1804
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e extracted/file_7.zip -oextracted
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2108
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e extracted/file_6.zip -oextracted
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:840
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e extracted/file_5.zip -oextracted
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3292
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e extracted/file_4.zip -oextracted
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2192
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e extracted/file_3.zip -oextracted
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4676
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e extracted/file_2.zip -oextracted
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1396
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e extracted/file_1.zip -oextracted
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5004
                    • C:\Windows\system32\attrib.exe
                      attrib +H "in.exe"
                      7⤵
                      • Views/modifies file attributes
                      PID:2440
                    • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                      "in.exe"
                      7⤵
                      • Executes dropped EXE
                      PID:3152
                      • C:\Windows\SYSTEM32\attrib.exe
                        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                        8⤵
                        • Views/modifies file attributes
                        PID:116
                      • C:\Windows\SYSTEM32\attrib.exe
                        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                        8⤵
                        • Views/modifies file attributes
                        PID:4448
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                        8⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:64
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell ping 127.0.0.1; del in.exe
                        8⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5032
                        • C:\Windows\system32\PING.EXE
                          "C:\Windows\system32\PING.EXE" 127.0.0.1
                          9⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:3292
                • C:\Users\Admin\AppData\Local\Temp\1017206001\7d999e88fa.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017206001\7d999e88fa.exe"
                  5⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:2176
                • C:\Users\Admin\AppData\Local\Temp\1017207001\3e585706bd.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017207001\3e585706bd.exe"
                  5⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:3444
                  • C:\Users\Admin\AppData\Local\Temp\F7LAJ79GIJ8ZD9Q7CSBXENHOV9HFH27.exe
                    "C:\Users\Admin\AppData\Local\Temp\F7LAJ79GIJ8ZD9Q7CSBXENHOV9HFH27.exe"
                    6⤵
                    • Modifies Windows Defender Real-time Protection settings
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Windows security modification
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3888
                  • C:\Users\Admin\AppData\Local\Temp\VSHJPRR6D0U7SGPWM3XUJKHWDDO33.exe
                    "C:\Users\Admin\AppData\Local\Temp\VSHJPRR6D0U7SGPWM3XUJKHWDDO33.exe"
                    6⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    PID:5648
                • C:\Users\Admin\AppData\Local\Temp\1017208001\6edcb984d8.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017208001\6edcb984d8.exe"
                  5⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:2420
                • C:\Users\Admin\AppData\Local\Temp\1017209001\f742a334fe.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017209001\f742a334fe.exe"
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:4884
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM firefox.exe /T
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4216
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM chrome.exe /T
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2188
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM msedge.exe /T
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4816
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM opera.exe /T
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4280
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM brave.exe /T
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4060
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                    6⤵
                      PID:1852
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                        7⤵
                        • Checks processor information in registry
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        PID:3292
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb13f4e2-9ea7-4057-ad0c-a58955465e4c} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" gpu
                          8⤵
                            PID:1784
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2400 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6df8cd55-a7cf-40aa-9a8d-f4fcfe81f023} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" socket
                            8⤵
                              PID:4608
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3172 -childID 1 -isForBrowser -prefsHandle 2556 -prefMapHandle 3184 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1168 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {620dc3d1-0b5f-4377-b65e-7f24670e7b49} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" tab
                              8⤵
                                PID:4220
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3848 -childID 2 -isForBrowser -prefsHandle 3840 -prefMapHandle 3836 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1168 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df8a240f-4488-4b13-9fbc-27944bfc1274} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" tab
                                8⤵
                                  PID:4008
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4592 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 3968 -prefMapHandle 3656 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b77afbf5-cab4-4550-bd8b-b36d694a60e5} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" utility
                                  8⤵
                                  • Checks processor information in registry
                                  PID:4828
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5020 -childID 3 -isForBrowser -prefsHandle 5000 -prefMapHandle 5004 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1168 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f91477cf-add6-4a80-b45e-8ba45827618d} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" tab
                                  8⤵
                                    PID:6132
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5124 -childID 4 -isForBrowser -prefsHandle 5132 -prefMapHandle 5136 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1168 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f69a5f1-dfb2-46d8-b630-0d186f7a7dca} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" tab
                                    8⤵
                                      PID:3716
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5408 -childID 5 -isForBrowser -prefsHandle 5324 -prefMapHandle 5328 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1168 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {332938fe-dab5-4f3b-b6e0-935bd0d4132e} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" tab
                                      8⤵
                                        PID:5728
                                • C:\Users\Admin\AppData\Local\Temp\1017210001\6bc20a1b26.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1017210001\6bc20a1b26.exe"
                                  5⤵
                                  • Modifies Windows Defender Real-time Protection settings
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Windows security modification
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5896
                            • C:\Users\Admin\AppData\Local\Temp\1007315001\e8560058a6.exe
                              "C:\Users\Admin\AppData\Local\Temp\1007315001\e8560058a6.exe"
                              3⤵
                              • Enumerates VirtualBox registry keys
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:776
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4752 -ip 4752
                          1⤵
                            PID:4060
                          • C:\Windows\system32\backgroundTaskHost.exe
                            "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                            1⤵
                              PID:1624
                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1696
                            • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                              C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2380
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3720 -ip 3720
                              1⤵
                                PID:2896
                              • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:3192
                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:4568
                              • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:4644
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  2⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5848
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                                  2⤵
                                  • System Network Configuration Discovery: Internet Connection Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5996
                                  • C:\Windows\system32\PING.EXE
                                    "C:\Windows\system32\PING.EXE" 127.1.10.1
                                    3⤵
                                    • System Network Configuration Discovery: Internet Connection Discovery
                                    • Runs ping.exe
                                    PID:3164
                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:264
                              • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:5928
                              • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:1184
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  2⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3600
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                                  2⤵
                                  • System Network Configuration Discovery: Internet Connection Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5772

                              Network

                              MITRE ATT&CK Enterprise v15

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Command and Scripting Interpreter

                              1
                              T1059

                              PowerShell

                              1
                              T1059.001

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Persistence

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Defense Evasion

                              Hide Artifacts

                              1
                              T1564

                              Hidden Files and Directories

                              1
                              T1564.001

                              Impair Defenses

                              2
                              T1562

                              Disable or Modify Tools

                              2
                              T1562.001

                              Modify Registry

                              3
                              T1112

                              Virtualization/Sandbox Evasion

                              3
                              T1497

                              Credential Access

                              Credentials from Password Stores

                              1
                              T1555

                              Credentials from Web Browsers

                              1
                              T1555.003

                              Unsecured Credentials

                              3
                              T1552

                              Credentials In Files

                              3
                              T1552.001

                              Discovery

                              Browser Information Discovery

                              1
                              T1217

                              Query Registry

                              8
                              T1012

                              Remote System Discovery

                              1
                              T1018

                              System Information Discovery

                              4
                              T1082

                              System Location Discovery

                              1
                              T1614

                              System Language Discovery

                              1
                              T1614.001

                              System Network Configuration Discovery

                              1
                              T1016

                              Internet Connection Discovery

                              1
                              T1016.001

                              Virtualization/Sandbox Evasion

                              3
                              T1497

                              Lateral Movement

                              Collection

                              Data from Local System

                              3
                              T1005

                              Command and Control

                              Web Service

                              1
                              T1102

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                Filesize

                                2KB

                                MD5

                                968cb9309758126772781b83adb8a28f

                                SHA1

                                8da30e71accf186b2ba11da1797cf67f8f78b47c

                                SHA256

                                92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                SHA512

                                4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                Filesize

                                18KB

                                MD5

                                d4ddff9c62da93af22ce89456de2b23c

                                SHA1

                                1d3cfb2922010c415b2813c19185e9d724c89070

                                SHA256

                                5f93582e6c324db30c1d51db50a041cb730a54e4e42f290d19797caa6ccb3278

                                SHA512

                                5b3aa167081063f4580c8042d5ade0ef9971ef4f065568ee94a626a52bf3f56b48d624ad64a34eae2928277438520b69bf027d468546aa88a6b59e99aa49afe5

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                                Filesize

                                13KB

                                MD5

                                342c39f0913bc3d1c1badb5b8c4a2471

                                SHA1

                                a5cb034591bafb89e45ee4927dbcf4c63a575540

                                SHA256

                                a493f30af5ea3a2da7b16d849d5a7f6ae909b97d329f3d03b1874a00fd179b26

                                SHA512

                                1acd43e431b73a9ca43f18e1cf30bab387746e3edd7f0341429cfd9aaa6e6c290cddc1239cca0e2c1eb291747586c6d9d192a8b2be82605efb3bfb2390d17d24

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                Filesize

                                15KB

                                MD5

                                96c542dec016d9ec1ecc4dddfcbaac66

                                SHA1

                                6199f7648bb744efa58acf7b96fee85d938389e4

                                SHA256

                                7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                SHA512

                                cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1007312001\c08c1ea727.exe
                                Filesize

                                2.8MB

                                MD5

                                9122e2bcf23186c18f6600aa3548a997

                                SHA1

                                f1fb113d1659300ff0edae392398a51235685665

                                SHA256

                                61b12be55358b1356a682c7e891c42205afcb367ac9025feefec5b08a333bfcc

                                SHA512

                                d7c6a752fe10d846eb15deb16c2d3bbc800460c21af6a75fb21a661d38f2ef023b3028ce535f80448123da7d1191f815c971783132260758496dd6f5fc6950c4

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1007313001\7ab9332745.exe
                                Filesize

                                1.9MB

                                MD5

                                cbcfb4d5443855cec4a4871e69d7e58e

                                SHA1

                                c44cec80d1c60979299f3d52d4d7d0bfb75dee21

                                SHA256

                                120957e5a588345f6c6af3908edde7cd04bf78a3ec7655a81c0098970e97e2ec

                                SHA512

                                c40472c1a225211916bbf96761de1d939ac31ca50755512ed541bd93861c5c6635ae0aa10f73655ca0c45db0ab31c77c2bba765b58fceb4529f06b633742e39a

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1007314001\cbcbd912af.exe
                                Filesize

                                2.8MB

                                MD5

                                8cbe0ced0c0f7bfbdf19128ba80adb99

                                SHA1

                                15e615a0fe64fe5200dd916232d9bc26b1c3d815

                                SHA256

                                055c34101c332838618fdedb730655f61b97553c5e56df94efd373667a3db895

                                SHA512

                                4b258260770b08fdd8f14b7bf0e703b8ca5010e4698e457bc0cfc76c246fb9e7c60ee4d2068b717f8205c2c1954d3b6b8742ed2547b67082f5b89c63d850e938

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1007315001\e8560058a6.exe
                                Filesize

                                4.2MB

                                MD5

                                1bba40cd593bed2b1f35529f02a1bc01

                                SHA1

                                a0d27bf89c1d0ef1da317b101d134dd83a326fd9

                                SHA256

                                0c9d197700bb3c5a707382a110a0466daa05c6d44793a60248c69c1784b02237

                                SHA512

                                f75b3e7ea9751b2e3f02d90de33f46cee91a2c464d2e32072dc3ca5aef85cd3e46be44e87ac1201b3b9fe08ba015522d9094869347afe2809b30a3bc0c57182d

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1017198001\74a47497a6.exe
                                Filesize

                                758KB

                                MD5

                                afd936e441bf5cbdb858e96833cc6ed3

                                SHA1

                                3491edd8c7caf9ae169e21fb58bccd29d95aefef

                                SHA256

                                c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

                                SHA512

                                928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1017199001\babf2a8063.exe
                                Filesize

                                1.8MB

                                MD5

                                25fb9c54265bbacc7a055174479f0b70

                                SHA1

                                4af069a2ec874703a7e29023d23a1ada491b584e

                                SHA256

                                552f8be2c6b2208a89c728f68488930c661b3a06c35a20d133ef7d3c63a86b9c

                                SHA512

                                7dfd9e0f3fa2d68a6ce8c952e3b755559db73bb7a06c95ad6ed8ac16dedb49be8b8337afc07c9c682f0c4be9db291a551286353e2e2b624223487dc1c8b54668

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1017200001\e279d1843a.exe
                                Filesize

                                1.8MB

                                MD5

                                ff279f4e5b1c6fbda804d2437c2dbdc8

                                SHA1

                                2feb3762c877a5ae3ca60eeebc37003ad0844245

                                SHA256

                                e115298ab160da9c7a998e4ae0b72333f64b207da165134ca45eb997a000d378

                                SHA512

                                c7a8bbcb122b2c7b57c8b678c5eed075ee5e7c355afbf86238282d2d3458019da1a8523520e1a1c631cd01b555f7df340545fd1e44ad678dc97c40b23428f967

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1017201001\e5dd744854.exe
                                Filesize

                                4.3MB

                                MD5

                                c85e8fbe79404550962a289efec68827

                                SHA1

                                979e2c636887d7a73b1537cb66da879fc809bb0f

                                SHA256

                                75548f4c67674ae7fca0c89630bdb0c4adb57a476fbfd7b6e793aa9dbbdfdd9c

                                SHA512

                                c097329db9865da9bdb641c38b7e56e4e4d02fc146187d976397a25e0e51e172fd01e77a48c4a5bed1b23c8d3a239d548f69db2a084db8bbfcd006ba68350475

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1017202001\baf606d495.exe
                                Filesize

                                21KB

                                MD5

                                14becdf1e2402e9aa6c2be0e6167041e

                                SHA1

                                72cbbae6878f5e06060a0038b25ede93b445f0df

                                SHA256

                                7a769963165063758f15f6e0cece25c9d13072f67fa0d3c25a03a5104fe0783a

                                SHA512

                                16b837615505f352e134afd9d8655c9cabfa5bfcfbee2c0c34f2d7d9588aa71f875e4e5feb8cdf0f7bacc00f7c1ca8dabd3b3d92afc99abf705c05c78e298b4a

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1017204001\d94388d31f.exe
                                Filesize

                                747KB

                                MD5

                                8a9cb17c0224a01bd34b46495983c50a

                                SHA1

                                00296ea6a56f6e10a0f1450a20c5fb329b8856c1

                                SHA256

                                3d51b9523b387859bc0d94246dfb216cfa82f9d650c8d11be11ed67f70e7440b

                                SHA512

                                1472e4670f469c43227b965984ecc223a526f6284363d8e08a3b5b55e602ccce62df4bc49939ee5bd7df7b0c26e20da896b084eccab767f8728e6bf14d71c840

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1017205001\8feef60b96.exe
                                Filesize

                                4.2MB

                                MD5

                                3a425626cbd40345f5b8dddd6b2b9efa

                                SHA1

                                7b50e108e293e54c15dce816552356f424eea97a

                                SHA256

                                ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                                SHA512

                                a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1017207001\3e585706bd.exe
                                Filesize

                                1.8MB

                                MD5

                                ffd3e08783983aa539d8056c4a45755a

                                SHA1

                                35319d1dfd1accbf215edf312d26c62ffe44193b

                                SHA256

                                f0a572023009f960fc10a93f127dd60641929b63a63f9c51c8a0c2e2aec6f5f0

                                SHA512

                                079743895dbf994875f12309db2493e1a6365a92e76aea3e0494e2a99bedd3e93a14298a6cef1543ab00748d44aad36f41ffac841e0de72f48458a66c701f4af

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1017209001\f742a334fe.exe
                                Filesize

                                945KB

                                MD5

                                dfb8c708ccb6c1db1e96a93c74f43fed

                                SHA1

                                6744eefe63b1576820dbfb280f688e84260cd15d

                                SHA256

                                37cb8b12dc71e54353806cc79a1f274a1b2719407b18988d9bfc1641c539f36b

                                SHA512

                                468c7011b96cdc5680918c0ecc50fa6606c576ae11e2ecd4b2af42571df912818356247ebcf5f18c412ee0f897260f5a0b16dbcfd650732da1e16c786cb50de8

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1017210001\6bc20a1b26.exe
                                Filesize

                                1.7MB

                                MD5

                                f5c9f0438e3c02bc9ef1435d9dd0a821

                                SHA1

                                18af196ad4bccfa8848ad9b7d68580008fcb9ed2

                                SHA256

                                8c2166ee7dccc82b851f1e4e0cfe03da6e1c3dc7a7cc18a541073e6e77efde7a

                                SHA512

                                b5308945d033171646cb7484072476602d1ec3c766a36ffd70a9ef41451dc2ce2c33179b7f726952455231c5ba7b5fbdba03f78e5b294f269b8ce908833083de

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                Filesize

                                2.8MB

                                MD5

                                eadab56cfbaef413b705dac5db36aa16

                                SHA1

                                163fc1a47691e79e6bbffbab8be7f795bd55d99d

                                SHA256

                                211ea35545389fab23d79e5e83b02a53d000971e6e4fc0a1346fc38bc97d72d1

                                SHA512

                                461087bdc52f78dde32330aa2240216527be6586903071f63cff43b4d0d43089262265816fc6f5ac3072d67624255fae694476754a4cf2a43990155051e0e014

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vt4bgqap.ytj.ps1
                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\main\7z.dll
                                Filesize

                                1.6MB

                                MD5

                                72491c7b87a7c2dd350b727444f13bb4

                                SHA1

                                1e9338d56db7ded386878eab7bb44b8934ab1bc7

                                SHA256

                                34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                                SHA512

                                583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                Filesize

                                458KB

                                MD5

                                619f7135621b50fd1900ff24aade1524

                                SHA1

                                6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                                SHA256

                                344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                                SHA512

                                2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip
                                Filesize

                                1.7MB

                                MD5

                                5404286ec7853897b3ba00adf824d6c1

                                SHA1

                                39e543e08b34311b82f6e909e1e67e2f4afec551

                                SHA256

                                ec94a6666a3103ba6be60b92e843075a2d7fe7d30fa41099c3f3b1e2a5eba266

                                SHA512

                                c4b78298c42148d393feea6c3941c48def7c92ef0e6baac99144b083937d0a80d3c15bd9a0bf40daa60919968b120d62999fa61af320e507f7e99fbfe9b9ef30

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip
                                Filesize

                                1.7MB

                                MD5

                                5eb39ba3698c99891a6b6eb036cfb653

                                SHA1

                                d2f1cdd59669f006a2f1aa9214aeed48bc88c06e

                                SHA256

                                e77f5e03ae140dda27d73e1ffe43f7911e006a108cf51cbd0e05d73aa92da7c2

                                SHA512

                                6c4ca20e88d49256ed9cabec0d1f2b00dfcf3d1603b5c95d158d4438c9f1e58495f8dfa200dbe7f49b5b0dd57886517eb3b98c4190484548720dad4b3db6069e

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip
                                Filesize

                                1.7MB

                                MD5

                                7187cc2643affab4ca29d92251c96dee

                                SHA1

                                ab0a4de90a14551834e12bb2c8c6b9ee517acaf4

                                SHA256

                                c7e92a1af295307fb92ad534e05fba879a7cf6716f93aefca0ebfcb8cee7a830

                                SHA512

                                27985d317a5c844871ffb2527d04aa50ef7442b2f00d69d5ab6bbb85cd7be1d7057ffd3151d0896f05603677c2f7361ed021eac921e012d74da049ef6949e3a3

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip
                                Filesize

                                1.7MB

                                MD5

                                b7d1e04629bec112923446fda5391731

                                SHA1

                                814055286f963ddaa5bf3019821cb8a565b56cb8

                                SHA256

                                4da77d4ee30ad0cd56cd620f4e9dc4016244ace015c5b4b43f8f37dd8e3a8789

                                SHA512

                                79fc3606b0fe6a1e31a2ecacc96623caf236bf2be692dadab6ea8ffa4af4231d782094a63b76631068364ac9b6a872b02f1e080636eba40ed019c2949a8e28db

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip
                                Filesize

                                1.7MB

                                MD5

                                0dc4014facf82aa027904c1be1d403c1

                                SHA1

                                5e6d6c020bfc2e6f24f3d237946b0103fe9b1831

                                SHA256

                                a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7

                                SHA512

                                cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_7.zip
                                Filesize

                                3.3MB

                                MD5

                                cea368fc334a9aec1ecff4b15612e5b0

                                SHA1

                                493d23f72731bb570d904014ffdacbba2334ce26

                                SHA256

                                07e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541

                                SHA512

                                bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\main\file.bin
                                Filesize

                                3.3MB

                                MD5

                                045b0a3d5be6f10ddf19ae6d92dfdd70

                                SHA1

                                0387715b6681d7097d372cd0005b664f76c933c7

                                SHA256

                                94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

                                SHA512

                                58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\main\main.bat
                                Filesize

                                440B

                                MD5

                                3626532127e3066df98e34c3d56a1869

                                SHA1

                                5fa7102f02615afde4efd4ed091744e842c63f78

                                SHA256

                                2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

                                SHA512

                                dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                Filesize

                                479KB

                                MD5

                                09372174e83dbbf696ee732fd2e875bb

                                SHA1

                                ba360186ba650a769f9303f48b7200fb5eaccee1

                                SHA256

                                c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                SHA512

                                b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                Filesize

                                13.8MB

                                MD5

                                0a8747a2ac9ac08ae9508f36c6d75692

                                SHA1

                                b287a96fd6cc12433adb42193dfe06111c38eaf0

                                SHA256

                                32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                SHA512

                                59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin
                                Filesize

                                18KB

                                MD5

                                1377c4e1912320fb9e4f789ca34667a7

                                SHA1

                                5199a17af043ad8d2c994b1b8c3586a64c6e3b5e

                                SHA256

                                c49594b5e593b21ffb3c2c42264f9148f81e583bc7c5a95b69e2f0cba1568ec5

                                SHA512

                                736609fd4a7c67262d666a642f6a9230d97cd1bbcfb3dac233ea813e2a43dcc776c2af719524229f9414639c58fd312413b7951bac7be449fdb20d94bee11be5

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin
                                Filesize

                                8KB

                                MD5

                                22e59932f189e08022a9951491850b38

                                SHA1

                                f10abbab3bce04bb5133bc48259e1f2472b839ee

                                SHA256

                                f44fe094546acb7205a0523dbe49253f63d7304553e488d71419d54e01d5763d

                                SHA512

                                c9754ad3b03c9cb5413cc46a65adec1c674170e1da2c2aabbe0ff4479954fc48d6129dbff03344f64d23acaf5dad6ba24dced4413d18fd53b8ed5b47c5eae7ea

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin
                                Filesize

                                13KB

                                MD5

                                ec278706778f6cee57c4f0f2c17e5009

                                SHA1

                                eb892b007c0af1e8ad106e6712ab895cd2fc8cc9

                                SHA256

                                0171ca3717c457af6cb8264ec2eaedd9f56b6edda3b077895a1826e0bd0363e2

                                SHA512

                                6ef69b9233c3853c66a60de349c4da575d10ab56dace6b9749ba634064193b4f72d0211c6668fa49cb7d37c89735547dab0bdabe341673a5cb6251dbd72d4207

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                25KB

                                MD5

                                fc306f91abfa1262539da9a46866078f

                                SHA1

                                2017b67c988435164dc13544c52ae599f388fd4d

                                SHA256

                                42e83d03281040119e2587a6477091b0150b89fa80c702c2ac539eb5d63bcf11

                                SHA512

                                3c9d57134a76825fdfaf654d43fd071c05b1dbfe014b189c6425d116c6fa2b830d35264004881060988090962fae3d69a5567ab59e9e395f0823efea8879827f

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                22KB

                                MD5

                                23d9a7ac1e8a7f1fffbc2bd6d62848be

                                SHA1

                                bab545f52b51753bde286fbe7d5f01ce1b2ff6f5

                                SHA256

                                5e84a4039cd966ab2c84236213be3b3e21ce280030b0fd0f7da9b29e9a69cc14

                                SHA512

                                b2886b38350d706392ffab65d8cb0fc6b3e97c4f5317bf3c0ef2051bc63ad221a33bcbd543da87fd8b9e0a386377c2c3298e147fe248ca36d0136c3ba42db2c7

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                19KB

                                MD5

                                8b67c91987eaa767b2bef1c0a1fe7677

                                SHA1

                                b8ca380c2ea59d1856f61df567bddf1ec9f8695c

                                SHA256

                                12cb4af1eb0408c84ab5cc42993355006a147fee65c450807e875cba0bb28b0c

                                SHA512

                                514bf185e16c896c13a7c680dc49049accddacaed19367d28aef8ca19bc3e5ed849ad71bcac8f8e493d5a8fcebd364bc024482324c839aadfae3a9cece4b191d

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                25KB

                                MD5

                                b18a6d9374bc2001d0eda1105c5b0255

                                SHA1

                                7c80781bc2c68525c02fcfad064faa489ac6df8b

                                SHA256

                                74605bd94de8b2dd12487e9f9b78cf0ac64fdb0b8890a4aec43b40ef78e58411

                                SHA512

                                0944ec118aeb0c297698aa3bbb103bb92ac6aa25c0216b81e424b7079c491c268f254194685267c7fe6fac4dd6911f63d6fa41c0b21b4d0e22af173d82b6838e

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                22KB

                                MD5

                                2d1d8406228da43747d1d44825c60014

                                SHA1

                                14c82209aee4eaadc69f3e7dd37364a42862ca52

                                SHA256

                                fe9995425900b6e50e335d8ea74c61a85c950128d8977c18f14d4a5a72402c51

                                SHA512

                                ad632b1138b565ac2ac9fdbbf8f1bafdfc5cbb007aca2bf4f6fb9e63cca00ec2eb33113b09d2af978a10393f89b837cf12b2bd31c411a4afb9fd338bf66f3bd6

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                23KB

                                MD5

                                fbfd450704914f6b062b31b3a9d8df35

                                SHA1

                                5f0a91fa45f8b6a9ba2d9fc2f690d41ea17ff214

                                SHA256

                                40775cb53071ae8db2327aee9a947ad21d049689643f6b499d03f4fd5a1eb3f2

                                SHA512

                                76a4d7beaf87213a8076b9a2b6e5d2213cc5b16d5b46218fe4edf316bd0493ec2b8c6e834de968b792126145045e275d2cda38f4a3ede829c0cd8dce7958ced4

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\516bde9c-92f7-4b69-910f-6ff240df509a
                                Filesize

                                982B

                                MD5

                                2884c0a2877c1afc789ebe6fb7cc96b9

                                SHA1

                                26a18970c1193938c211d7ed3566ecf7d4ebb672

                                SHA256

                                716cb937820ad0b13651429de2f86e89bf7d56619c997afadf32acedc2a190f0

                                SHA512

                                4ba27bef54e35bf59aff7fc938bc5ab202bbf1e123d4e661716d97041f278fc578bf36a0468e14e2d662a56ed84192de1497b090acfcb5ed72ac98a5077ba59a

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\ee74b515-de10-45fc-a8b8-39442bcb53bc
                                Filesize

                                659B

                                MD5

                                fc9cc0acdf039295844c718dc54050d9

                                SHA1

                                ade4a6326e78651164127fbc7b3e4904830c8839

                                SHA256

                                7e6a9bddd9eb9eb4458eb197ebc2467e7513d464b239804786a83caf5bb4560d

                                SHA512

                                bb15653e191953e1b3e93386ec1c29fd296c1c4934da419018cdcfd43d3d9c91e9a515aeb48994c49a605b3175cb965caa8f7311f50295e5505bbbad65e64cee

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                Filesize

                                1.1MB

                                MD5

                                842039753bf41fa5e11b3a1383061a87

                                SHA1

                                3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                SHA256

                                d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                SHA512

                                d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                Filesize

                                116B

                                MD5

                                2a461e9eb87fd1955cea740a3444ee7a

                                SHA1

                                b10755914c713f5a4677494dbe8a686ed458c3c5

                                SHA256

                                4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                SHA512

                                34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                Filesize

                                372B

                                MD5

                                bf957ad58b55f64219ab3f793e374316

                                SHA1

                                a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                SHA256

                                bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                SHA512

                                79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                Filesize

                                17.8MB

                                MD5

                                daf7ef3acccab478aaa7d6dc1c60f865

                                SHA1

                                f8246162b97ce4a945feced27b6ea114366ff2ad

                                SHA256

                                bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                SHA512

                                5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js
                                Filesize

                                10KB

                                MD5

                                8b6ae8be3ba35b6985295dcb526ed815

                                SHA1

                                2902c1888445ee9561aad6992400910a39da7610

                                SHA256

                                4748ebf7ef428d7ff4a267943f13072128b477d5be01a163236fbc8628ccf347

                                SHA512

                                a588e30e3066080bca521e552b50db6a500c60eaf2b90ce6682a4215542625621b83d124b4e76779a6d6fcb02d3151a882d7a63f7c05bf0d461fe68f58cb036d

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js
                                Filesize

                                11KB

                                MD5

                                8472c507b6c4740df828f537619bb4d5

                                SHA1

                                e48f299310c4d5d4910d8f6c7b8ffa1d423ce19b

                                SHA256

                                ca3cc09ad1824b4c68a8a67f1c510773efc6dfd43bb80e2ae538ccca574aeb2c

                                SHA512

                                ad0e677b53a24f4be18af9d6478a24fc122340b49c1d15e0a6117f311e16a93c66d2fa6462db228985066a7578375bcf30094e152737321f2502b0fe47551c94

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js
                                Filesize

                                15KB

                                MD5

                                1fe317450b33403a7545ca19650baa46

                                SHA1

                                ae6dbd00da42e68b2426f6ebc2aa8144d724320f

                                SHA256

                                7e255b0e08a3a395ecaf0ce62bdac9ed74e96ab3c1a566c6be17db35cbe9c056

                                SHA512

                                b2f2f1b801cf95afbb0efa9a302f5dfced03ebec774b33b4108d0284a2cf5edf116064c3b86aa8ea74fed848adcc18a2d8179dd083f42c1dc7b4d523379dda3b

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs.js
                                Filesize

                                10KB

                                MD5

                                29c2c66067a76b512a04b4469393d1ee

                                SHA1

                                d4d3a7c2db83ba5fc75e1f68ab4dd50f51adcb69

                                SHA256

                                d937e06e62e484c3cd81f81f3027e68f42b262474a95bf6aa4a1e36da7561930

                                SHA512

                                fde646556a42f734a5cb0fbebbe6f1890931abbb819812c8182388d33bfff3df6bd554ea5e6f295119eacefbb32c5c5263ee776dafa3e3bf4bf556456fed38e5

                                Download Submit

                              • C:\dssdh\d10ced120088460fbd8414f76f049b7d.exe
                                Filesize

                                1.2MB

                                MD5

                                577cd52217da6d7163cea46bb01c107f

                                SHA1

                                82b31cc52c538238e63bdfc22d1ea306ea0b852a

                                SHA256

                                139762e396fb930400fab8faab80cb679abbe642144261cba24973fb23bcd728

                                SHA512

                                8abad4eaf2a302dfd9ead058e8c14d996437975730125c46d034a71028921ff36ff5d157ad3671e328ac667ec8095db19fa14a9e8eaaf1a7738aa3d0120b5474

                                Download Submit

                              • memory/772-263-0x0000000000490000-0x0000000000936000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/772-395-0x0000000000490000-0x0000000000936000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/772-220-0x0000000000490000-0x0000000000936000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/772-176-0x0000000000490000-0x0000000000936000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/776-122-0x0000000000410000-0x0000000000F5F000-memory.dmp

                                Filesize

                                11.3MB

                                Download

                              • memory/776-180-0x0000000000410000-0x0000000000F5F000-memory.dmp

                                Filesize

                                11.3MB

                                Download

                              • memory/776-178-0x0000000000410000-0x0000000000F5F000-memory.dmp

                                Filesize

                                11.3MB

                                Download

                              • memory/776-160-0x0000000000410000-0x0000000000F5F000-memory.dmp

                                Filesize

                                11.3MB

                                Download

                              • memory/1148-353-0x0000000000B90000-0x0000000000F4B000-memory.dmp

                                Filesize

                                3.7MB

                                Download

                              • memory/1148-474-0x0000000000B90000-0x0000000000F4B000-memory.dmp

                                Filesize

                                3.7MB

                                Download

                              • memory/1272-905-0x0000000000BE0000-0x0000000000EEB000-memory.dmp

                                Filesize

                                3.0MB

                                Download

                              • memory/1272-933-0x0000000000BE0000-0x0000000000EEB000-memory.dmp

                                Filesize

                                3.0MB

                                Download

                              • memory/1272-236-0x0000000000BE0000-0x0000000000EEB000-memory.dmp

                                Filesize

                                3.0MB

                                Download

                              • memory/1272-506-0x0000000000BE0000-0x0000000000EEB000-memory.dmp

                                Filesize

                                3.0MB

                                Download

                              • memory/1272-1165-0x0000000000BE0000-0x0000000000EEB000-memory.dmp

                                Filesize

                                3.0MB

                                Download

                              • memory/1272-157-0x0000000000BE0000-0x0000000000EEB000-memory.dmp

                                Filesize

                                3.0MB

                                Download

                              • memory/1272-159-0x0000000000BE0000-0x0000000000EEB000-memory.dmp

                                Filesize

                                3.0MB

                                Download

                              • memory/1272-374-0x0000000000BE0000-0x0000000000EEB000-memory.dmp

                                Filesize

                                3.0MB

                                Download

                              • memory/1272-2321-0x0000000000BE0000-0x0000000000EEB000-memory.dmp

                                Filesize

                                3.0MB

                                Download

                              • memory/1272-104-0x0000000000BE0000-0x0000000000EEB000-memory.dmp

                                Filesize

                                3.0MB

                                Download

                              • memory/1624-40-0x0000000001000000-0x00000000014FD000-memory.dmp

                                Filesize

                                5.0MB

                                Download

                              • memory/1624-39-0x0000000001001000-0x0000000001018000-memory.dmp

                                Filesize

                                92KB

                                Download

                              • memory/1624-38-0x0000000001000000-0x00000000014FD000-memory.dmp

                                Filesize

                                5.0MB

                                Download

                              • memory/1624-42-0x0000000001000000-0x00000000014FD000-memory.dmp

                                Filesize

                                5.0MB

                                Download

                              • memory/1652-344-0x00000000006F0000-0x00000000012D5000-memory.dmp

                                Filesize

                                11.9MB

                                Download

                              • memory/1652-315-0x00000000006F0000-0x00000000012D5000-memory.dmp

                                Filesize

                                11.9MB

                                Download

                              • memory/1652-473-0x00000000006F0000-0x00000000012D5000-memory.dmp

                                Filesize

                                11.9MB

                                Download

                              • memory/1652-196-0x00000000006F0000-0x00000000012D5000-memory.dmp

                                Filesize

                                11.9MB

                                Download

                              • memory/1696-223-0x0000000000BE0000-0x0000000000EEB000-memory.dmp

                                Filesize

                                3.0MB

                                Download

                              • memory/1784-333-0x000000006F570000-0x000000006F5BC000-memory.dmp

                                Filesize

                                304KB

                                Download

                              • memory/1784-328-0x0000000005CD0000-0x0000000006024000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/2176-434-0x0000000000340000-0x0000000000E8F000-memory.dmp

                                Filesize

                                11.3MB

                                Download

                              • memory/2176-461-0x0000000000340000-0x0000000000E8F000-memory.dmp

                                Filesize

                                11.3MB

                                Download

                              • memory/2260-0-0x0000000000410000-0x000000000071D000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2260-3-0x0000000000410000-0x000000000071D000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2260-4-0x0000000000410000-0x000000000071D000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2260-2-0x0000000000411000-0x000000000043F000-memory.dmp

                                Filesize

                                184KB

                                Download

                              • memory/2260-18-0x0000000000410000-0x000000000071D000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2260-1-0x00000000778C4000-0x00000000778C6000-memory.dmp

                                Filesize

                                8KB

                                Download

                              • memory/2300-296-0x0000000007830000-0x000000000783E000-memory.dmp

                                Filesize

                                56KB

                                Download

                              • memory/2300-260-0x0000000005CF0000-0x0000000006044000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/2300-307-0x0000000007920000-0x0000000007928000-memory.dmp

                                Filesize

                                32KB

                                Download

                              • memory/2300-306-0x0000000007940000-0x000000000795A000-memory.dmp

                                Filesize

                                104KB

                                Download

                              • memory/2300-297-0x0000000007840000-0x0000000007854000-memory.dmp

                                Filesize

                                80KB

                                Download

                              • memory/2300-295-0x0000000007800000-0x0000000007811000-memory.dmp

                                Filesize

                                68KB

                                Download

                              • memory/2300-294-0x0000000007880000-0x0000000007916000-memory.dmp

                                Filesize

                                600KB

                                Download

                              • memory/2300-246-0x0000000004D10000-0x0000000004D46000-memory.dmp

                                Filesize

                                216KB

                                Download

                              • memory/2300-275-0x00000000072A0000-0x00000000072D2000-memory.dmp

                                Filesize

                                200KB

                                Download

                              • memory/2300-247-0x0000000005470000-0x0000000005A98000-memory.dmp

                                Filesize

                                6.2MB

                                Download

                              • memory/2300-249-0x0000000005C10000-0x0000000005C76000-memory.dmp

                                Filesize

                                408KB

                                Download

                              • memory/2300-276-0x000000006F570000-0x000000006F5BC000-memory.dmp

                                Filesize

                                304KB

                                Download

                              • memory/2300-293-0x0000000007670000-0x000000000767A000-memory.dmp

                                Filesize

                                40KB

                                Download

                              • memory/2300-250-0x0000000005C80000-0x0000000005CE6000-memory.dmp

                                Filesize

                                408KB

                                Download

                              • memory/2300-291-0x0000000007600000-0x000000000761A000-memory.dmp

                                Filesize

                                104KB

                                Download

                              • memory/2300-248-0x0000000005310000-0x0000000005332000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/2300-290-0x0000000007C40000-0x00000000082BA000-memory.dmp

                                Filesize

                                6.5MB

                                Download

                              • memory/2300-289-0x00000000072E0000-0x0000000007383000-memory.dmp

                                Filesize

                                652KB

                                Download

                              • memory/2300-261-0x00000000062E0000-0x00000000062FE000-memory.dmp

                                Filesize

                                120KB

                                Download

                              • memory/2300-262-0x0000000006300000-0x000000000634C000-memory.dmp

                                Filesize

                                304KB

                                Download

                              • memory/2300-286-0x00000000068A0000-0x00000000068BE000-memory.dmp

                                Filesize

                                120KB

                                Download

                              • memory/2380-221-0x0000000000CC0000-0x0000000000FCD000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2380-225-0x0000000000CC0000-0x0000000000FCD000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2420-503-0x0000000000570000-0x0000000000A6D000-memory.dmp

                                Filesize

                                5.0MB

                                Download

                              • memory/2420-505-0x0000000000570000-0x0000000000A6D000-memory.dmp

                                Filesize

                                5.0MB

                                Download

                              • memory/2424-177-0x0000000000CC0000-0x0000000000FCD000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2424-1244-0x0000000000CC0000-0x0000000000FCD000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2424-21-0x0000000000CC0000-0x0000000000FCD000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2424-123-0x0000000000CC0000-0x0000000000FCD000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2424-74-0x0000000000CC0000-0x0000000000FCD000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2424-918-0x0000000000CC0000-0x0000000000FCD000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2424-20-0x0000000000CC0000-0x0000000000FCD000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2424-292-0x0000000000CC0000-0x0000000000FCD000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2424-934-0x0000000000CC0000-0x0000000000FCD000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2424-394-0x0000000000CC0000-0x0000000000FCD000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2424-19-0x0000000000CC1000-0x0000000000CEF000-memory.dmp

                                Filesize

                                184KB

                                Download

                              • memory/2424-61-0x0000000000CC0000-0x0000000000FCD000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2424-16-0x0000000000CC0000-0x0000000000FCD000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2424-41-0x0000000000CC0000-0x0000000000FCD000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2424-523-0x0000000000CC0000-0x0000000000FCD000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2424-22-0x0000000000CC0000-0x0000000000FCD000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2920-332-0x0000000000400000-0x0000000000455000-memory.dmp

                                Filesize

                                340KB

                                Download

                              • memory/2920-330-0x0000000000400000-0x0000000000455000-memory.dmp

                                Filesize

                                340KB

                                Download

                              • memory/3052-106-0x0000000000530000-0x000000000083B000-memory.dmp

                                Filesize

                                3.0MB

                                Download

                              • memory/3052-92-0x0000000000530000-0x000000000083B000-memory.dmp

                                Filesize

                                3.0MB

                                Download

                              • memory/3152-524-0x00007FF7A78F0000-0x00007FF7A7D80000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/3152-459-0x00007FF7A78F0000-0x00007FF7A7D80000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/3192-2311-0x0000000000CC0000-0x0000000000FCD000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/3444-488-0x00000000001E0000-0x0000000000672000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/3444-539-0x00000000001E0000-0x0000000000672000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/3444-794-0x00000000001E0000-0x0000000000672000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/3444-843-0x00000000001E0000-0x0000000000672000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/3572-216-0x00000000002C0000-0x00000000002CC000-memory.dmp

                                Filesize

                                48KB

                                Download

                              • memory/3720-245-0x00000000001C0000-0x0000000000684000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/3720-266-0x00007FFC2D890000-0x00007FFC2DA85000-memory.dmp

                                Filesize

                                2.0MB

                                Download

                              • memory/3720-268-0x00000000757C0000-0x00000000759D5000-memory.dmp

                                Filesize

                                2.1MB

                                Download

                              • memory/3720-265-0x0000000004BB0000-0x0000000004FB0000-memory.dmp

                                Filesize

                                4.0MB

                                Download

                              • memory/3720-288-0x00000000001C0000-0x0000000000684000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/3888-920-0x0000000000010000-0x000000000046E000-memory.dmp

                                Filesize

                                4.4MB

                                Download

                              • memory/3888-747-0x0000000000010000-0x000000000046E000-memory.dmp

                                Filesize

                                4.4MB

                                Download

                              • memory/3888-540-0x0000000000010000-0x000000000046E000-memory.dmp

                                Filesize

                                4.4MB

                                Download

                              • memory/3888-929-0x0000000000010000-0x000000000046E000-memory.dmp

                                Filesize

                                4.4MB

                                Download

                              • memory/3888-748-0x0000000000010000-0x000000000046E000-memory.dmp

                                Filesize

                                4.4MB

                                Download

                              • memory/4208-355-0x0000000000B50000-0x0000000000FFB000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/4208-376-0x0000000000B50000-0x0000000000FFB000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/4208-217-0x0000000000B50000-0x0000000000FFB000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/4208-197-0x0000000000B50000-0x0000000000FFB000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/4208-158-0x0000000000B50000-0x0000000000FFB000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/4556-71-0x00007FFC2D890000-0x00007FFC2DA85000-memory.dmp

                                Filesize

                                2.0MB

                                Download

                              • memory/4556-73-0x00000000757C0000-0x00000000759D5000-memory.dmp

                                Filesize

                                2.1MB

                                Download

                              • memory/4556-70-0x0000000000E00000-0x0000000001200000-memory.dmp

                                Filesize

                                4.0MB

                                Download

                              • memory/4556-68-0x00000000003F0000-0x00000000003FA000-memory.dmp

                                Filesize

                                40KB

                                Download

                              • memory/4568-2314-0x0000000000BE0000-0x0000000000EEB000-memory.dmp

                                Filesize

                                3.0MB

                                Download

                              • memory/4648-139-0x0000000000400000-0x0000000000456000-memory.dmp

                                Filesize

                                344KB

                                Download

                              • memory/4648-141-0x0000000000400000-0x0000000000456000-memory.dmp

                                Filesize

                                344KB

                                Download

                              • memory/4752-67-0x00000000757C0000-0x00000000759D5000-memory.dmp

                                Filesize

                                2.1MB

                                Download

                              • memory/4752-64-0x0000000004C00000-0x0000000005000000-memory.dmp

                                Filesize

                                4.0MB

                                Download

                              • memory/4752-63-0x0000000004C00000-0x0000000005000000-memory.dmp

                                Filesize

                                4.0MB

                                Download

                              • memory/4752-62-0x0000000000E70000-0x0000000001334000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/4752-65-0x00007FFC2D890000-0x00007FFC2DA85000-memory.dmp

                                Filesize

                                2.0MB

                                Download

                              • memory/4752-84-0x0000000000E70000-0x0000000001334000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/4876-269-0x0000000000AC0000-0x0000000000ACA000-memory.dmp

                                Filesize

                                40KB

                                Download

                              • memory/4876-272-0x00007FFC2D890000-0x00007FFC2DA85000-memory.dmp

                                Filesize

                                2.0MB

                                Download

                              • memory/4876-274-0x00000000757C0000-0x00000000759D5000-memory.dmp

                                Filesize

                                2.1MB

                                Download

                              • memory/4876-271-0x0000000001280000-0x0000000001680000-memory.dmp

                                Filesize

                                4.0MB

                                Download

                              • memory/5032-471-0x000001D0D1670000-0x000001D0D1692000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/5648-894-0x0000000000E40000-0x000000000133D000-memory.dmp

                                Filesize

                                5.0MB

                                Download

                              • memory/5896-824-0x0000000000AA0000-0x0000000000EFE000-memory.dmp

                                Filesize

                                4.4MB

                                Download

                              • memory/5896-823-0x0000000000AA0000-0x0000000000EFE000-memory.dmp

                                Filesize

                                4.4MB

                                Download