a07a11f45e1c41fc434781c75d63a46ef671ddf17433998d49e707f1bf1844ee

Analysis

max time kernel
310s
max time network
329s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2023, 03:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

CvSOTN.rar
Size

390.3MB
MD5

cdd2a4d54a82cbe9673b3590a4470d67
SHA1

73ef74ece4fcac0077fbd6ec784b5db5c43971cd
SHA256

a07a11f45e1c41fc434781c75d63a46ef671ddf17433998d49e707f1bf1844ee
SHA512

4757abf1da4ebb75d31581f20c971f217cbc8bbfa81bfdfb2070c4a1c29b0fa82710f8528531e993ec8acd48268cde3dce6768d39f7436d51170f1065f0f4f23
SSDEEP

12582912:TX1IMf+8QMXTb7fdZeCkBaSvVvY9mtBLa:Zg2vLdZuakxBO

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4224	7z2201-x64.exe
1352	7zFM.exe

Loads dropped DLL 1 IoCs

pid	Process
768	Process not Found

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2201-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2201-x64.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2201-x64.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2201-x64.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2201-x64.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2201-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2201-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2201-x64.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\7z2201-x64.exe:Zone.Identifier	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1352	7zFM.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4536	firefox.exe
Token: SeDebugPrivilege	4536	firefox.exe
Token: SeDebugPrivilege	4224	7z2201-x64.exe
Token: SeDebugPrivilege	4224	7z2201-x64.exe
Token: SeDebugPrivilege	4224	7z2201-x64.exe
Token: SeDebugPrivilege	4224	7z2201-x64.exe
Token: SeDebugPrivilege	4224	7z2201-x64.exe
Token: SeRestorePrivilege	1352	7zFM.exe
Token: 35	1352	7zFM.exe
Token: 33	4400	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4400	AUDIODG.EXE
Token: SeDebugPrivilege	4536	firefox.exe
Token: SeDebugPrivilege	4536	firefox.exe
Token: SeDebugPrivilege	4536	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4536	firefox.exe
4536	firefox.exe
4536	firefox.exe
4536	firefox.exe
4536	firefox.exe
4536	firefox.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4536	firefox.exe
4536	firefox.exe
4536	firefox.exe
4536	firefox.exe
4536	firefox.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3736	OpenWith.exe
4536	firefox.exe
4536	firefox.exe
4536	firefox.exe
4536	firefox.exe
4224	7z2201-x64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 4536	4116	firefox.exe	96
PID 4116 wrote to memory of 4536	4116	firefox.exe	96
PID 4116 wrote to memory of 4536	4116	firefox.exe	96
PID 4116 wrote to memory of 4536	4116	firefox.exe	96
PID 4116 wrote to memory of 4536	4116	firefox.exe	96
PID 4116 wrote to memory of 4536	4116	firefox.exe	96
PID 4116 wrote to memory of 4536	4116	firefox.exe	96
PID 4116 wrote to memory of 4536	4116	firefox.exe	96
PID 4116 wrote to memory of 4536	4116	firefox.exe	96
PID 4116 wrote to memory of 4536	4116	firefox.exe	96
PID 4116 wrote to memory of 4536	4116	firefox.exe	96
PID 4536 wrote to memory of 2988	4536	firefox.exe	97
PID 4536 wrote to memory of 2988	4536	firefox.exe	97
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 3884	4536	firefox.exe	98
PID 4536 wrote to memory of 1084	4536	firefox.exe	99
PID 4536 wrote to memory of 1084	4536	firefox.exe	99
PID 4536 wrote to memory of 1084	4536	firefox.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\CvSOTN.rar
1⤵
- Modifies registry class
PID:4228

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3736

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.0.1269329237\604427499" -parentBuildID 20221007134813 -prefsHandle 1864 -prefMapHandle 1856 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {724bf67f-10b4-4273-9b03-9f4634829337} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 1940 2b4a3419858 gpu
    3⤵
    PID:2988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.1.2025356492\1163376062" -parentBuildID 20221007134813 -prefsHandle 2320 -prefMapHandle 2316 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0519a90-2145-4d03-8e03-2b743ea3ca80} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 2332 2b495471f58 socket
    3⤵
    - Checks processor information in registry
    PID:3884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.2.2135965226\1774851351" -childID 1 -isForBrowser -prefsHandle 3096 -prefMapHandle 2840 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1eddf49c-f7aa-46e6-88a9-78c3fea6f061} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 3104 2b4a611e658 tab
    3⤵
    PID:1084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.3.801684138\127900723" -childID 2 -isForBrowser -prefsHandle 3456 -prefMapHandle 3452 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a054f1a7-a0a8-4103-ae18-1dd8bceaeb99} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 2484 2b495472b58 tab
    3⤵
    PID:3800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.4.1380643466\630988367" -childID 3 -isForBrowser -prefsHandle 3964 -prefMapHandle 3960 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59b7740b-22d3-49d7-98ff-cae71b61ff0e} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 3972 2b4a4fb8358 tab
    3⤵
    PID:1936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.5.1813498151\1240677472" -childID 4 -isForBrowser -prefsHandle 4732 -prefMapHandle 4904 -prefsLen 26659 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b5cfe2d-a6dd-4339-9330-8e7a975f4853} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 4652 2b4a87d5f58 tab
    3⤵
    PID:2452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.6.842262477\181874238" -childID 5 -isForBrowser -prefsHandle 5040 -prefMapHandle 5044 -prefsLen 26659 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd1ef316-cac0-4067-b7e5-f481da7218e6} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 5028 2b4a88e4d58 tab
    3⤵
    PID:4152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.7.1720523439\620276570" -childID 6 -isForBrowser -prefsHandle 5232 -prefMapHandle 5236 -prefsLen 26659 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {674b8df5-4645-4c3b-a794-88f6da8c2e8a} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 5224 2b4a88e5658 tab
    3⤵
    PID:2216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.8.896780706\1921059242" -childID 7 -isForBrowser -prefsHandle 5788 -prefMapHandle 5784 -prefsLen 26913 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b395250f-b4b7-43e4-8cb3-3ffd1d6c3486} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 5796 2b4a9c2e558 tab
    3⤵
    PID:3852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.9.1958559111\817956722" -childID 8 -isForBrowser -prefsHandle 5216 -prefMapHandle 5308 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {51640e29-6578-4f3a-a5ef-6fad7cf6b6cf} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 5312 2b49542ed58 tab
    3⤵
    PID:2596
- - C:\Users\Admin\Downloads\7z2201-x64.exe
    "C:\Users\Admin\Downloads\7z2201-x64.exe"
    3⤵
    - Executes dropped EXE
    - Registers COM server for autorun
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.10.1570363024\903110391" -childID 9 -isForBrowser -prefsHandle 6056 -prefMapHandle 5576 -prefsLen 27371 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2519cfed-c76f-4ac4-9bf5-8ed9fcf17e43} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 4408 2b4a87d3e58 tab
    3⤵
    PID:392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.11.866862879\865271332" -parentBuildID 20221007134813 -prefsHandle 6180 -prefMapHandle 6132 -prefsLen 27371 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d58fa7d5-9819-489f-9e54-4464dc9e0899} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 6056 2b4a3b78558 rdd
    3⤵
    PID:1152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.12.1785387704\1167449710" -childID 10 -isForBrowser -prefsHandle 6604 -prefMapHandle 6600 -prefsLen 27371 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c06cfda2-9398-4f79-9d45-debe03f350cb} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 6612 2b4a3cb6e58 tab
    3⤵
    PID:4816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.13.1740029581\460929418" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6704 -prefMapHandle 6796 -prefsLen 27371 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {585e0788-f39e-4785-a006-1bf1f7c29bfb} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 6808 2b4a4c61558 utility
    3⤵
    PID:3828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.14.909976047\374225836" -childID 11 -isForBrowser -prefsHandle 5820 -prefMapHandle 6956 -prefsLen 27371 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a9ac855-ace2-4650-9e54-4e87002d36df} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 5868 2b4ab630958 tab
    3⤵
    PID:2040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.15.1384828932\350632721" -childID 12 -isForBrowser -prefsHandle 6996 -prefMapHandle 7004 -prefsLen 27371 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7377adcd-d57b-44ac-bcfb-a4f5aa08c2ff} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 5248 2b4a88e5358 tab
    3⤵
    PID:4676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.16.339531334\285092905" -childID 13 -isForBrowser -prefsHandle 4124 -prefMapHandle 4504 -prefsLen 27371 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d3bffaf-3bf6-4575-a882-529a54e3f661} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 3688 2b49542ed58 tab
    3⤵
    PID:428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.17.1398401813\1789004824" -childID 14 -isForBrowser -prefsHandle 5392 -prefMapHandle 10828 -prefsLen 27371 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf240ad9-d59b-4517-8b81-2cc25b4b97e8} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 5228 2b4ac715b58 tab
    3⤵
    PID:3112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.18.884322168\1521842480" -childID 15 -isForBrowser -prefsHandle 7024 -prefMapHandle 6044 -prefsLen 27371 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0b05ca5-f202-4469-a9f0-e25b46b4bcc4} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 1424 2b4a88e3e58 tab
    3⤵
    PID:1868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3112

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1352

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2c8 0x338
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
92KB

MD5
c3af132ea025d289ab4841fc00bb74af

SHA1
0a9973d5234cc55b8b97bbb82c722b910c71cbaf

SHA256
56b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52

SHA512
707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
935KB

MD5
d36deceeb4c9645aab2ded86608d090b

SHA1
912f4658c4b046fbadd084912f9126cb1ae3737b

SHA256
018d74ff917692124dee0a8a7e6302aecd219d79b049ad95f2f4eedea41b4a45

SHA512
9752a9e57dd2e6cd454ba6c2d041d884369734c2b62c53d3ec4854731c398cd6e25ac75f7a55cda9d4b4c2efb074cb2e6efcbf3080cd8cc7d9bc8c9a25f62ff2

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
935KB

MD5
d36deceeb4c9645aab2ded86608d090b

SHA1
912f4658c4b046fbadd084912f9126cb1ae3737b

SHA256
018d74ff917692124dee0a8a7e6302aecd219d79b049ad95f2f4eedea41b4a45

SHA512
9752a9e57dd2e6cd454ba6c2d041d884369734c2b62c53d3ec4854731c398cd6e25ac75f7a55cda9d4b4c2efb074cb2e6efcbf3080cd8cc7d9bc8c9a25f62ff2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\activity-stream.discovery_stream.json.tmp

Filesize
142KB

MD5
2c75cf36842b0f891b01cedd50d681be

SHA1
0a416c6cb0437c611d85d9b5baeb50b439a4e23c

SHA256
52b09651650380e388fa864bb6b2693a6ce58d2376c6304d56a1f5c210f369d6

SHA512
2821783007e95dead951e85746ee25182e7374fb19f6f2f0134292993ae5b9e625ffc562500f56c83ec5cc669de2769c11fb6c5afe6738445550609d3cde2cc6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\18301

Filesize
14KB

MD5
d47f7da16837bb2a4dffc57af5723cf3

SHA1
72e0c4af0d62dd425a8884a58005e511e4894e70

SHA256
82007db25278e316954951a58502963c55d3b887843b35c9b7cb33066b76a033

SHA512
afeb6c098be587cbdd86ff9d39e7559d627fb96651151f1099ad9f00653ad98d5554c15dbba5690c5647d434d3a1f7a0f8316531e81413d0c1c196bec19484ce

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\23274

Filesize
16KB

MD5
00b71560c72493b57cd07dc5b6f32bbb

SHA1
1a7425e78f3a3dea23bdcdd0e9c01775a04f082a

SHA256
1aa28c0614167011811066a21f2a7c1375924a3826472f0665cbde896d566391

SHA512
b85dcb283ed6be1c9852c88b0ba931d38fcf12bfb94ef76a6684248c5cd4349a51d49fabf152327c13617f7d46749c1ea9ce7fb14e421fa6242c2588068aa6d0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\6250

Filesize
14KB

MD5
5d88b96cd6c93f2711cee512483afcc1

SHA1
09ec67e3867a1c242e4d5279f074a20a7b96dbf2

SHA256
848f84a8d2bfd8a214dec8bd7e9adaa154a27c9346dcd43af3e13624b7259e41

SHA512
8a4d1625f9467740063fe7372315d250a8fa01704517df848904bb4bcfada90d830dc1099caee642d4196158f923ac58752368753ad281212b7ffee7671775a3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\entries\A3D6A16A26B1D7399736688127F90A7DF9933EEE

Filesize
532KB

MD5
53fce73a22a664c3c57b501404fcc061

SHA1
9cdbfe0939726e003f030a57390ed053b756a53f

SHA256
f193feb220ccc650af5bfa44cb07afcee4d44f0ec0ba70969c1ceb2d07d4be83

SHA512
05c4437931695938d0217e5c6d25e39470f41982379cae80ce2803a5c64fa9406bd0e4f97707f863ddcd61cf132ecce9c6cfca347b03cb719c51f9ff4cf6169b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
7KB

MD5
ff941970646019aa2ba1d43699fe1737

SHA1
aa115501369b2e3d1e8684b6edfafb91f6604e86

SHA256
97bbf7d3ac2666202a3caad8cba15402572011caf8d69a04b12c09c1ae89afac

SHA512
137b4ae59e0ce094e920727dfcb315114e955d0ff6ca432700ae14f61ace5efe3161c7fe87f7247e1b48ed9ac1942120f51bfa8f9f284625aa107ec7eb0a8174

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
6KB

MD5
ea679074de31f22fb5eed9edb9f58d5a

SHA1
8bd1596cc03e36f790c7142b2e61547fed581ec2

SHA256
6b4f24c9269a072f9e0f1c366797b3d1bd34ca864f9e0588736e839b64494e46

SHA512
72bd3747622372b9b88e1edb79851fa88c08c5673c856d96075eecc7d22fb045adf268288c94e8252decea4b904b09c0a27991d7ccc8db4131eec342f8090942

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
6KB

MD5
f3a63c351ba6fb85d77c5f92ff79d084

SHA1
4b9c3b0ef93d39570c9dc39a79678fbb960287ac

SHA256
4cba19e001a5617d479def2d3f0ae478d4228114d931316aa80afd00e531be6d

SHA512
a52e04b1841355ed3b66a2c4d22313de28136735e18d412d01ace83dca98260b6482b9d30ea95151d3daabb3f13234f096d797586b15fffa4997d996c277b714

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
7KB

MD5
1d4a9306c0434de5fb3b76a6fe61ddf7

SHA1
906a256858b98a3f982935154afa3d46d064b6e5

SHA256
7cdeb892b0438a7e8e8d89be77384bceb23c5d0e20a00dc5cc3ea7341e3c38ca

SHA512
d929371798d249331535212c289942c70b68dc154091176139257671fe9eadef4c1b12eb42ae529136b665f52ccfd13ec14bbac117d053b3eedf41bf38df4a06

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
6KB

MD5
1cdd6e18c29f393ac1a2b728e32a7029

SHA1
5392d3e4e405976b0c802906fc0e1d297c775e61

SHA256
b09afe8dcf29a0ad9374eefe21228e5271edb0621b7e328b02183569622eda11

SHA512
c9e1af7f2b6c32f18242d030a8b759e1b866f0baef492697f8e9f00d529bcf81eedcf3d461607b704cc3459b36161484b486f6c809cca9f83af84d4a43044387

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs.js

Filesize
6KB

MD5
108b97b1ff7efbdb1aecce96d55ff2e5

SHA1
bb72b2e0c3d859fe5e821632307a32df331b55e1

SHA256
c5e19d4313b524fffc4859f4fac05ea3dcf408714a736dbd0bb7fcdf5131f80e

SHA512
e0f7678424e68957a1cb521786e9e4e54c179f9a263b04d0c6a96147cb1e242b58bda3e74e6f142dcd9b6dd313a0061c3050af334b149eab9a8040f923da84dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
e6c20f53d6714067f2b49d0e9ba8030e

SHA1
f516dc1084cdd8302b3e7f7167b905e603b6f04f

SHA256
50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092

SHA512
462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
c50c74d8a1be337fc606622c2e99138a

SHA1
228581879a5700605ceafee8066f1093ecaaf08c

SHA256
0ff0f19f8c9db7b5d54883eedff403710b727231f380c3ff7e90ae100458c1a9

SHA512
4e51e1e00b7544799f5f1247389eafb29e7998d5f8a255dd7bd5db2f05639e693311ed79fcb9c13e15aafaa80bb2138097ba44cfd29f7f176e3d68b8db179c65

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
d7d1dec16e9b9c58a0e66d8cbf5b3bc2

SHA1
ff8908b478d74e483279a4ba7787b999a3c878ce

SHA256
48f4b01ae3393d5cce75ef023b135a48feb8fcf1dea87400c351b84b89a816a0

SHA512
f1baff6fc816d222af1e1d101fc482569e746cae770739d787f45cdf1152775b8c6c3680b022b717aabfb5cb6524f40ae53bc99db83c51cd1152225c0914df40

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore.jsonlz4

Filesize
11KB

MD5
31f439f740748c456847a9021598c297

SHA1
2b2e8f1db2cc588265334143bf98cd2ac4ce8f62

SHA256
f02316cb87ff737008b9da36308b9715ca2dc4c8c4c61b601211c09bb84ef02e

SHA512
725b324018902520a596d6dbcf5f5e6f446dfbadf79cfc86e58db2508e6ff7b24a2ca5477137ea25cf7d34478343b3488ccc6b5243648cb08365702a8eb9f393

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\storage\default\https+++www.youtube.com\cache\morgue\144\{950ef1be-2c48-44be-94a0-a519b0a5f190}.final

Filesize
65KB

MD5
55c91664f806270eab9980a973013c2c

SHA1
4471e9e05274bd5cdfddb1f43e57a084cc1f6505

SHA256
5a9ddab12c7edf77e075da0e61a1323ae1ce1a99c1bb4bd3ac71b5324ba7609a

SHA512
55cfe6be19cab7ed4e210f7c7015a8f91d183e859cfd18466454532004e612c88576d9af5c51b33f5dacec2d42d1a3c704936b2b85f2d5522a9ef7f9e3e715a1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\storage\default\https+++www.youtube.com\cache\morgue\37\{a485ef00-35f0-461a-a170-f1e958950f25}.final

Filesize
3KB

MD5
0c06abb8f36150daba8581549f8278a9

SHA1
2dcb5a2937ed6fbe75a6ed1f17c319f122ed73e0

SHA256
55af5eee76f919e072e0372cd8e1d056a6097f4de38a1f589fa4432bf00e5d72

SHA512
cf68b127f40622fd28e4cdfb89c979ddc19ef97546f9cd248af4e6508165d5330095935dadb7de50e85ad34a297692197202e909af9e7d7272472ab553e6cba3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\storage\default\https+++www.youtube.com\idb\2171031483YattIedMb.sqlite

Filesize
48KB

MD5
45f90eaeec5956943f486b798a96ba9f

SHA1
b0dce4516252dff39ae7e59c5da890db306ce648

SHA256
289623c665bb05eafa256065ca912e4cdfddbd0a1f8611e7eeccc2cb0bc257d2

SHA512
87080bfdea19b17ef73f5ece07de985634f0182e36a1bf4f0b0b72f14262deb71c95a960e6e2663592ae13b95b36f43e81bf3e9030ad00a68876e021fc13657b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\storage\default\https+++www.youtube.com\idb\3211250388sbwdpsunsohintoatciif.sqlite-wal

Filesize
40KB

MD5
9c8f311bb4acedc1740f31dd9381f006

SHA1
ce8277ce3e7918fac89529c27edb59431a716d5e

SHA256
86b8f9a6af940a09d683fb581b755d90a04601cd74e366e296b926ea2071aa10

SHA512
078e34200ce8b2188b1bf55f9c7b7e7fd5eae92c327a46934601f7521ad67831d1216e7cf089002553223505cc0e17f0950d98a3fb7facb915c7b21360b560e3

Download Submit
C:\Users\Admin\Downloads\7z2201-x64.exe

Filesize
1.5MB

MD5
a6a0f7c173094f8dafef996157751ecf

SHA1
c0dcae7c4c80be25661d22400466b4ea074fc580

SHA256
b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

SHA512
965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

Download Submit
C:\Users\Admin\Downloads\7z2201-x64.exe

Filesize
1.5MB

MD5
a6a0f7c173094f8dafef996157751ecf

SHA1
c0dcae7c4c80be25661d22400466b4ea074fc580

SHA256
b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

SHA512
965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

Download Submit
C:\Users\Admin\Downloads\7z2201-x64.zILbk_Bw.exe.part

Filesize
132KB

MD5
f7ccfcd4fe18ddc0c4c3e7cb45a21e3a

SHA1
62c93753a652ed37f985ccf7f2cca23bb046143a

SHA256
798a751e68b58e4444ef86aff241ae7f2417b46c7161d65a5255f8524bebd7d9

SHA512
0fcf9581508754451409332cc6ec15446e64578121e47442af169be3479b8fa971b92b1f77c0290970b5d15918c2319ff53d9feedca4a79e851abd1477c373b2

Download Submit