bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa

Resubmissions

07-04-2024 04:02

240407-el8z7sdb34 8

07-04-2024 03:42

240407-d9lzxaca9z 8

Analysis

max time kernel
947s
max time network
948s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
07-04-2024 03:42

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

42.zip
Size

41KB
MD5

1df9a18b18332f153918030b7b516615
SHA1

6c42c62696616b72bbfc88a4be4ead57aa7bc503
SHA256

bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa
SHA512

6382ca9c307d66ab7566acf78b1afd44b18b24d766253e1dc1cb3a3c0be96ecf1f2042d6bd3332d49078ffee571cf98869c1284c1d3e5c1c7dc3e4c64f71af80
SSDEEP

768:hzyVr8GSKL6O3QOXk/0u3wqOghrFCezL1VFJdbq2QTJTw02Q:hGx8DKXE//ZhhCirFi2cwK

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 17 IoCs

pid	Process
2816	AnyDesk.exe
780	AnyDesk.exe
4868	AnyDesk.exe
3352	AnyDesk.exe
2356	7z2404-x64.exe
5204	7zG.exe
5472	7zG.exe
5836	7zG.exe
6888	dismhost.exe
6888	AnyDesk.exe
7144	AnyDesk.exe
7136	AnyDesk.exe
5816	AnyDesk.exe
6368	AnyDesk.exe
2332	7zG.exe
4264	winrar-x64-700.exe
6736	winrar-x64-700.exe

Loads dropped DLL 12 IoCs

pid	Process
4868	AnyDesk.exe
780	AnyDesk.exe
5204	7zG.exe
5472	7zG.exe
5836	7zG.exe
6888	dismhost.exe
6888	dismhost.exe
6888	dismhost.exe
6888	dismhost.exe
7136	AnyDesk.exe
7144	AnyDesk.exe
2332	7zG.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2404-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	AnyDesk.exe
File opened for modification	C:\Windows\system32\LogFiles\setupcln\setuperr.log	cleanmgr.exe
File opened for modification	C:\Windows\system32\LogFiles\setupcln\diagerr.xml	cleanmgr.exe
File opened for modification	C:\Windows\system32\LogFiles\setupcln\diagwrn.xml	cleanmgr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	AnyDesk.exe
File opened for modification	C:\Windows\system32\LogFiles\setupcln\setupact.log	cleanmgr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	AnyDesk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll.tmp	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2404-x64.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	cleanmgr.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0015	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0015	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0015	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0004	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0004	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0004	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0015	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0004	cleanmgr.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "102"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2404-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2404-x64.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\AnyDesk.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\42.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\7z2404-x64.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\ZOD-master.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\winrar-x64-700.exe:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
4868	AnyDesk.exe
7136	AnyDesk.exe
7136	AnyDesk.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
780	AnyDesk.exe
780	AnyDesk.exe
2816	AnyDesk.exe
2816	AnyDesk.exe
7144	AnyDesk.exe
7144	AnyDesk.exe
7144	AnyDesk.exe
7144	AnyDesk.exe
7144	AnyDesk.exe
7144	AnyDesk.exe
7144	AnyDesk.exe
7144	AnyDesk.exe
7144	AnyDesk.exe
7144	AnyDesk.exe
6888	AnyDesk.exe
6888	AnyDesk.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3352	AnyDesk.exe
1420	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	3484	firefox.exe
Token: SeDebugPrivilege	3484	firefox.exe
Token: SeDebugPrivilege	2816	AnyDesk.exe
Token: SeDebugPrivilege	2816	AnyDesk.exe
Token: SeDebugPrivilege	780	AnyDesk.exe
Token: 33	5004	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5004	AUDIODG.EXE
Token: SeDebugPrivilege	2816	AnyDesk.exe
Token: SeDebugPrivilege	2816	AnyDesk.exe
Token: SeDebugPrivilege	3484	firefox.exe
Token: SeDebugPrivilege	3484	firefox.exe
Token: SeDebugPrivilege	3484	firefox.exe
Token: SeDebugPrivilege	3484	firefox.exe
Token: SeDebugPrivilege	2356	7z2404-x64.exe
Token: SeDebugPrivilege	2356	7z2404-x64.exe
Token: SeDebugPrivilege	2356	7z2404-x64.exe
Token: SeDebugPrivilege	2356	7z2404-x64.exe
Token: SeDebugPrivilege	2356	7z2404-x64.exe
Token: SeRestorePrivilege	5204	7zG.exe
Token: 35	5204	7zG.exe
Token: SeSecurityPrivilege	5204	7zG.exe
Token: SeSecurityPrivilege	5204	7zG.exe
Token: SeDebugPrivilege	3484	firefox.exe
Token: SeRestorePrivilege	5472	7zG.exe
Token: 35	5472	7zG.exe
Token: SeSecurityPrivilege	5472	7zG.exe
Token: SeSecurityPrivilege	5472	7zG.exe
Token: SeRestorePrivilege	5836	7zG.exe
Token: 35	5836	7zG.exe
Token: SeSecurityPrivilege	5836	7zG.exe
Token: SeSecurityPrivilege	5836	7zG.exe
Token: SeDebugPrivilege	3484	firefox.exe
Token: SeBackupPrivilege	6548	cleanmgr.exe
Token: SeRestorePrivilege	6548	cleanmgr.exe
Token: SeDebugPrivilege	7144	AnyDesk.exe
Token: SeDebugPrivilege	3484	firefox.exe
Token: SeDebugPrivilege	7144	AnyDesk.exe
Token: SeDebugPrivilege	3484	firefox.exe
Token: SeDebugPrivilege	3484	firefox.exe
Token: SeRestorePrivilege	2332	7zG.exe
Token: 35	2332	7zG.exe
Token: SeSecurityPrivilege	2332	7zG.exe
Token: SeSecurityPrivilege	2332	7zG.exe
Token: SeDebugPrivilege	3484	firefox.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3484	firefox.exe
3484	firefox.exe
3484	firefox.exe
3484	firefox.exe
4868	AnyDesk.exe
4868	AnyDesk.exe
4868	AnyDesk.exe
4868	AnyDesk.exe
4868	AnyDesk.exe
4868	AnyDesk.exe
5204	7zG.exe
5472	7zG.exe
5836	7zG.exe
4868	AnyDesk.exe
4868	AnyDesk.exe
4868	AnyDesk.exe
4868	AnyDesk.exe
7136	AnyDesk.exe
7136	AnyDesk.exe
7136	AnyDesk.exe
7136	AnyDesk.exe
7136	AnyDesk.exe
7136	AnyDesk.exe
7136	AnyDesk.exe
7136	AnyDesk.exe
7136	AnyDesk.exe
7136	AnyDesk.exe
7136	AnyDesk.exe
3484	firefox.exe
3484	firefox.exe
2332	7zG.exe
7136	AnyDesk.exe
7136	AnyDesk.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
3484	firefox.exe
3484	firefox.exe
3484	firefox.exe
4868	AnyDesk.exe
4868	AnyDesk.exe
4868	AnyDesk.exe
4868	AnyDesk.exe
4868	AnyDesk.exe
4868	AnyDesk.exe
4868	AnyDesk.exe
4868	AnyDesk.exe
4868	AnyDesk.exe
4868	AnyDesk.exe
7136	AnyDesk.exe
7136	AnyDesk.exe
7136	AnyDesk.exe
7136	AnyDesk.exe
7136	AnyDesk.exe
7136	AnyDesk.exe
7136	AnyDesk.exe
7136	AnyDesk.exe
7136	AnyDesk.exe
7136	AnyDesk.exe
7136	AnyDesk.exe
3484	firefox.exe
3484	firefox.exe
7136	AnyDesk.exe
7136	AnyDesk.exe

Suspicious use of SetWindowsHookEx 37 IoCs

pid	Process
3484	firefox.exe
3484	firefox.exe
3484	firefox.exe
3484	firefox.exe
3352	AnyDesk.exe
3352	AnyDesk.exe
3484	firefox.exe
3484	firefox.exe
3484	firefox.exe
3484	firefox.exe
3484	firefox.exe
3484	firefox.exe
2356	7z2404-x64.exe
5816	AnyDesk.exe
5816	AnyDesk.exe
6368	AnyDesk.exe
6368	AnyDesk.exe
3484	firefox.exe
3484	firefox.exe
3484	firefox.exe
3484	firefox.exe
3484	firefox.exe
3484	firefox.exe
1420	OpenWith.exe
3484	firefox.exe
3484	firefox.exe
3484	firefox.exe
3484	firefox.exe
3484	firefox.exe
3484	firefox.exe
4264	winrar-x64-700.exe
4264	winrar-x64-700.exe
4264	winrar-x64-700.exe
6736	winrar-x64-700.exe
6736	winrar-x64-700.exe
6736	winrar-x64-700.exe
6484	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 3484	2980	firefox.exe	80
PID 2980 wrote to memory of 3484	2980	firefox.exe	80
PID 2980 wrote to memory of 3484	2980	firefox.exe	80
PID 2980 wrote to memory of 3484	2980	firefox.exe	80
PID 2980 wrote to memory of 3484	2980	firefox.exe	80
PID 2980 wrote to memory of 3484	2980	firefox.exe	80
PID 2980 wrote to memory of 3484	2980	firefox.exe	80
PID 2980 wrote to memory of 3484	2980	firefox.exe	80
PID 2980 wrote to memory of 3484	2980	firefox.exe	80
PID 2980 wrote to memory of 3484	2980	firefox.exe	80
PID 2980 wrote to memory of 3484	2980	firefox.exe	80
PID 3484 wrote to memory of 2656	3484	firefox.exe	81
PID 3484 wrote to memory of 2656	3484	firefox.exe	81
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 3864	3484	firefox.exe	82
PID 3484 wrote to memory of 224	3484	firefox.exe	83
PID 3484 wrote to memory of 224	3484	firefox.exe	83
PID 3484 wrote to memory of 224	3484	firefox.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\42.zip
1⤵
PID:4500

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.0.1665997205\1981542847" -parentBuildID 20221007134813 -prefsHandle 1756 -prefMapHandle 1748 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {951a9fff-e22c-4570-87ff-a84f0915445e} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 1848 1e0ed8e7e58 gpu
    3⤵
    PID:2656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.1.785359188\1521060843" -parentBuildID 20221007134813 -prefsHandle 2200 -prefMapHandle 2076 -prefsLen 20783 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c81bbb4-d329-41ee-bee7-8c9b5dd72a47} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 2228 1e0ed332058 socket
    3⤵
    - Checks processor information in registry
    PID:3864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.2.1510325778\755057256" -childID 1 -isForBrowser -prefsHandle 2896 -prefMapHandle 2824 -prefsLen 20886 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a727c79-13c6-40f5-8624-fb99cf57aa30} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 2836 1e0ed85c958 tab
    3⤵
    PID:224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.3.1086709624\626063809" -childID 2 -isForBrowser -prefsHandle 3468 -prefMapHandle 3464 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {124e9f5a-bfd7-4f4a-90c3-890fccd00d00} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 3472 1e0e1761f58 tab
    3⤵
    PID:3696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.4.2113688944\1363770961" -childID 3 -isForBrowser -prefsHandle 4448 -prefMapHandle 4444 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e366f306-a7b4-4d59-be8f-877be8134877} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 4452 1e0f46fbe58 tab
    3⤵
    PID:4296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.5.1850795512\1025267640" -childID 4 -isForBrowser -prefsHandle 5036 -prefMapHandle 5052 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {16652895-f014-43f6-8780-eb1ae87080c4} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 4948 1e0e1730e58 tab
    3⤵
    PID:4768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.6.1246643241\1799472320" -childID 5 -isForBrowser -prefsHandle 5168 -prefMapHandle 5172 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {987bc88e-7825-4b8a-8c94-95df2a019b48} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 5160 1e0f4db7b58 tab
    3⤵
    PID:2816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.7.272610329\947697517" -childID 6 -isForBrowser -prefsHandle 5380 -prefMapHandle 5384 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aedb35af-74df-4f72-b6d9-d18dcb37adb9} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 5372 1e0f4dbab58 tab
    3⤵
    PID:3612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.8.1880972146\2144780828" -childID 7 -isForBrowser -prefsHandle 5840 -prefMapHandle 5844 -prefsLen 26458 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27bd8678-ea18-497e-b470-57c1404c8eca} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 5856 1e0f4f18358 tab
    3⤵
    PID:3868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.9.1936497697\1746965207" -childID 8 -isForBrowser -prefsHandle 5992 -prefMapHandle 5996 -prefsLen 26458 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {33546e3e-91a6-434f-bc06-9009d96d3524} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 5984 1e0f7377258 tab
    3⤵
    PID:3488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.10.2021738862\905153185" -childID 9 -isForBrowser -prefsHandle 5424 -prefMapHandle 4548 -prefsLen 26458 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {378796a5-ffd6-40dd-9e3c-ac482cae3f32} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 5116 1e0f7c4b858 tab
    3⤵
    PID:3376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.11.466542641\2010945056" -parentBuildID 20221007134813 -prefsHandle 9836 -prefMapHandle 9840 -prefsLen 26458 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {768e4741-3083-433e-8c2f-243866f6717d} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 9824 1e0eeb51058 rdd
    3⤵
    PID:1608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.12.1474413713\1947871400" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 9668 -prefMapHandle 9672 -prefsLen 26458 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa3127ec-03f2-440c-aee6-d7a855009012} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 9660 1e0f4db8a58 utility
    3⤵
    PID:1760
- - C:\Users\Admin\Downloads\AnyDesk.exe
    "C:\Users\Admin\Downloads\AnyDesk.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2816
  - - C:\Users\Admin\Downloads\AnyDesk.exe
      "C:\Users\Admin\Downloads\AnyDesk.exe" --local-service
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:780
    - - C:\Users\Admin\Downloads\AnyDesk.exe
        
        "C:\Users\Admin\Downloads\AnyDesk.exe" --backend
        5⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        
        PID:3352
  - - C:\Users\Admin\Downloads\AnyDesk.exe
      "C:\Users\Admin\Downloads\AnyDesk.exe" --local-control
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.13.561108868\437721767" -childID 10 -isForBrowser -prefsHandle 5264 -prefMapHandle 5148 -prefsLen 26763 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64fe8210-1a03-432b-842c-e03d4a86a1b5} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 5584 1e0f46f8258 tab
    3⤵
    PID:2684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.14.2009136046\973515724" -childID 11 -isForBrowser -prefsHandle 5888 -prefMapHandle 5904 -prefsLen 26763 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2751fb95-b7fb-4afa-8a80-06e9ebff6c9b} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 5968 1e0f2cc0c58 tab
    3⤵
    PID:4996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.15.1643494487\2027715800" -childID 12 -isForBrowser -prefsHandle 4256 -prefMapHandle 4248 -prefsLen 26763 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f36739f-6151-434b-b3a3-13c35b8b2f25} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 8604 1e0f4f18c58 tab
    3⤵
    PID:3108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.16.1811275924\1693311666" -childID 13 -isForBrowser -prefsHandle 5184 -prefMapHandle 5412 -prefsLen 26763 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {312a0d56-b0de-4d1c-a0ad-edc2ce687b00} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 8264 1e0eff98758 tab
    3⤵
    PID:4724
- - C:\Users\Admin\Downloads\7z2404-x64.exe
    "C:\Users\Admin\Downloads\7z2404-x64.exe"
    3⤵
    - Executes dropped EXE
    - Registers COM server for autorun
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.17.1848432517\141795793" -childID 14 -isForBrowser -prefsHandle 4776 -prefMapHandle 4496 -prefsLen 26781 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {144132f1-9169-40af-b01d-98426a63493c} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 5684 1e0f2cc0f58 tab
    3⤵
    PID:2680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.18.333510145\666652621" -childID 15 -isForBrowser -prefsHandle 8036 -prefMapHandle 8024 -prefsLen 26781 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d9c911b-eec1-454d-84b1-4ab1e50b73c4} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 8684 1e0f3cd7658 tab
    3⤵
    PID:5092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.19.1545129602\1353995591" -childID 16 -isForBrowser -prefsHandle 8052 -prefMapHandle 8224 -prefsLen 26781 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95089eda-4cfe-4925-96ea-a66931d47e59} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 8044 1e0f46f9458 tab
    3⤵
    PID:6096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.20.539707239\1902272492" -childID 17 -isForBrowser -prefsHandle 5356 -prefMapHandle 8260 -prefsLen 26781 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b92b4b83-ac7e-46d4-b504-e0e32d5d6b68} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 5140 1e0e176ab58 tab
    3⤵
    PID:3908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.21.172633518\1968845452" -childID 18 -isForBrowser -prefsHandle 6240 -prefMapHandle 1556 -prefsLen 27490 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24235f47-5dbd-4ffc-9fdb-5b50c83f5a60} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 8208 1e0f80f9658 tab
    3⤵
    PID:6984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.22.471581909\157420746" -childID 19 -isForBrowser -prefsHandle 6116 -prefMapHandle 6120 -prefsLen 27499 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {370a2c58-62ca-4836-8223-313e92993a0d} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 1532 1e0f7e21858 tab
    3⤵
    PID:4804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.23.210499503\2079468618" -childID 20 -isForBrowser -prefsHandle 8612 -prefMapHandle 5428 -prefsLen 27499 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30c6f1f6-e6a1-45d9-a394-03d5c7e30168} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 7956 1e0f46f9458 tab
    3⤵
    PID:652
- - C:\Users\Admin\Downloads\winrar-x64-700.exe
    "C:\Users\Admin\Downloads\winrar-x64-700.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4264

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004CC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2604

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap22257:66:7zEvent28456
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5204

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\42\" -ad -an -ai#7zMap15511:66:7zEvent28345
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5472

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\42\*\" -spe -an -ai#7zMap29075:1154:7zEvent30532
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5836

C:\Windows\System32\cleanmgr.exe
"C:\Windows\System32\cleanmgr.exe" /D C
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:6548
- C:\Users\Admin\AppData\Local\Temp\71AF232E-36C2-4794-AB95-62CA05AD285B\dismhost.exe
  C:\Users\Admin\AppData\Local\Temp\71AF232E-36C2-4794-AB95-62CA05AD285B\dismhost.exe {26617A73-1DC7-4677-BFD6-7C343AE8348B}
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:6888

C:\Users\Admin\Downloads\AnyDesk.exe
"C:\Users\Admin\Downloads\AnyDesk.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:6888
- C:\Users\Admin\Downloads\AnyDesk.exe
  "C:\Users\Admin\Downloads\AnyDesk.exe" --local-service
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:7144
- - C:\Users\Admin\Downloads\AnyDesk.exe
    "C:\Users\Admin\Downloads\AnyDesk.exe" --backend
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:5816
- - C:\Users\Admin\Downloads\AnyDesk.exe
    "C:\Users\Admin\Downloads\AnyDesk.exe" --backend
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:6368
- C:\Users\Admin\Downloads\AnyDesk.exe
  "C:\Users\Admin\Downloads\AnyDesk.exe" --local-control
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:7136

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\ZOD-master\ZOD-master\" -an -ai#7zMap5981:110:7zEvent1669
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2332

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1420

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\6b7638edeac94790962f447ec40a1e97 /t 792 /p 4264
1⤵
PID:1160

C:\Users\Admin\Downloads\winrar-x64-700.exe
"C:\Users\Admin\Downloads\winrar-x64-700.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6736

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\1c9a59a749c2480e851290a724c60999 /t 5768 /p 6736
1⤵
PID:6892

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39d3855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:6484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
29f6d49053de1408586f48681864ca5f

SHA1
1071e887849cb92776f4a6d4cb6d0dd1ec264b65

SHA256
84d2bcf774aba77e938d3f36bfe020e0d49cfb3074ad9de69b5af78054602b7e

SHA512
dcdb5252e660b0d186c8db508db3fdaab22d33bc20dcaca2b41d5d5e64d5780b25f2242389227ddefff96978f373f89942389673c737b3102778982b91ca6f32

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
691KB

MD5
4a8614832d2512e1b1cf73051f083185

SHA1
da8b5fbc538cfc186dde7292dc17f4580b789c4a

SHA256
2f4f3768ca8f50f9a8882a7ac99aa95513f26fda7a41ce8c7971735d9b7ce920

SHA512
4846340d1726f14b9a932e032d914e15d7122dc5b24c12f63ac4b9b04ada46fe7a83551870509720be39e67abc6e7d27499fb853b4df5871253b26901c2d6e55

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\d8xutbrp.default-release\cache2\doomed\17702

Filesize
7KB

MD5
191a5011684764e35bdc63845e563e4f

SHA1
92683fc75ae42aea88827f0c71941b01e87e7137

SHA256
ad45b6ccf9527dfc9caa31b3ced70cc9be94054f4f1dd4e3cb75ba380bcd524b

SHA512
08dd23daa9557c526400bf41c4e390880fcf745f0cf61675f5dffeceee01bc8e7a30387d00ef3e99fcba4391dfe27d1aedfb4d86f954a20a40ad0a14216b9e79

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\d8xutbrp.default-release\cache2\doomed\23507

Filesize
15KB

MD5
2ea1fd5271cca5a10c16196161e1604d

SHA1
75807a27520b8d3a07be1403b2aa88edb37d5190

SHA256
9ade1166ffda74e651b1e7ecfa9b7b48cf8abd62fb547f6979e4ac457c454f6d

SHA512
937f2f3777e26548ccc7d23b84349fb23156e7fd7d2b49b617028b89ef3c2c3b16a77c235b972c403285afc2ec972abd49b27817167064ae28752c07b1831a00

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\d8xutbrp.default-release\cache2\doomed\8592

Filesize
15KB

MD5
acc79fbdb020efa6ee1ba54487891734

SHA1
600d99126ea4ef402eb6cd3a1a0bf9ff416fb4e6

SHA256
967fea1410cebe659083a0ffb685367ad9c0bf3a4e3d90ae8316ad009332262f

SHA512
c4392ba47bfcc3b1368628b5992616df27a55c723fa3ce6f007b64605c18f3a1bf292343958d239322e78f2d496a16d883fd5809a9da7163d441cbd12055c6a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\gcapi.dll

Filesize
385KB

MD5
1ce7d5a1566c8c449d0f6772a8c27900

SHA1
60854185f6338e1bfc7497fd41aa44c5c00d8f85

SHA256
73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf

SHA512
7e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
173KB

MD5
99790592daf0d78b85be2c0e041aaf1c

SHA1
c5c197f863c97b97fe9b43bb7651cab47f168313

SHA256
10c7f5d42ae84621fee122e3231225e8232ee6724a09e5d6e50aafa0365b2b21

SHA512
04017a1d50a0f3ce1ed90dc8e785727ae469dbc4f89a19a036e6c31175b4f4eab126da40fe72a5d1200c31104d25e2c9ed2cdd49c953755f9385ea7005400ef7

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
9KB

MD5
ae3debe21fa213e50047f8ed7fd952cb

SHA1
ec5dfc8e8c8fcdbddd52e62359f037340250e2cb

SHA256
3bff812a72595f6f8ba251fc966e1b5649d535211603523451a0e443bef04682

SHA512
f8d6b6c74e0f0cf394241314d4b99db25048d844a63f6b9c2d956af4629b5e682993bc4ff4ef6279b63887b358aebcab2696187ce2b1b279d780b5c3b889577d

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
38KB

MD5
9c8181d765dddd1f53ae0a0557d6004e

SHA1
52db6f9fecc5cf8c87190fd680ec1fc78d82de8e

SHA256
eacb42e28a63adf9d2fb81ce5a41a3453a76a7fc5b1482ef8efce37419241015

SHA512
8cf02de11fd60c04527e4fdfad6499e21579725719e03098aa9639ef38b21d6c36d27d40314dff324731df0335a04ebbc1310ab146d195d8f0b654317c56eb70

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
94711899a12df426360b21b1254429d4

SHA1
eafb45d9af1133ce35f8d0993ecc6b4a16fd5bc6

SHA256
e80000885efca178f3a225d4d186f4cce155e367ecaa5aa9a3c5d23179e413dd

SHA512
67c7aada02b577f7a0b24a72b23c595569d9c469b80beafe029cba921faafd47a9b8d723f2436e6d39b7c302bdcdc18be6d4bf7bebf621a5657bd0e8062872f8

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
849539d9142748900e4d97937edc1bc1

SHA1
da229fb10cef29d8a5bbfeb53fafb67d815f82bb

SHA256
e0a9edf5d677e4f77a227cfe8e07f1de7a84f6ce59f0c554eec1aea932657cfd

SHA512
457d1041ffc3cc2d0cc6ef4fb98ba40d3f95cd859b861b83ee270a03df2258a7c42accf66449d9a9e5d840020f1e36ba25f5fbaba54899bfb8fee80fce18884d

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
863B

MD5
b282e05554e0d98f0f894b3050ab467a

SHA1
438796e4bab01fcd6819744bd8da459b1a4b8de7

SHA256
017f5f4225a0378471bc05b0de9f530009177bc6b11d02c238299a09e029e70d

SHA512
f30c15d554a3c52465d377fbd1dfda525e10c280e25b9560985bb1a197082d2fdbb225faffa8ebd9f8193167548c6206b360a2fab4a9841b8d4b65f3a5a5830e

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
863B

MD5
12bf6dcd810cc04b26ca724a4be755ec

SHA1
1d7fb3098a31b4acfdff9959c1971dfab420fe94

SHA256
bdc5baa721d1f512de84197f7bf1d2f6fc3d958a38105dd1173e96a813640268

SHA512
98a001db8079f521d9e6da3e6b70ef4426c5dbb454d618b0af90e4cc47805fbae3e72605eef2ffda00d21d97a6e15120da19403c9985945ee552926518cae312

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
424B

MD5
e95ef5a11b6405215d22302d06c3ca09

SHA1
af8646a0c0179867d64763bc45a7e076cea1ad7d

SHA256
eb11c7923ecbdbb072842366155759b4ad21ec3c9d56b54ad604aede6196f0f8

SHA512
774a885466cbd253a6ae77ae27b8f198d70d1b1e571b00f7fcfc9536b13adc14b87c77bbcc85dac97b7e261358e3fc23ce2481bf96949e95bddd7f5d08f7fb5e

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
424B

MD5
a6693fc61459c1f0bba7dd32bf2d57fc

SHA1
ae6143538b52482df30f8ee85487214a2af6bcb3

SHA256
9eae3faa3aa8e4b8fb4e34032380daac00b826080648886ebf2959d052a9fc35

SHA512
7cf617ec6025e6a89044849b66361612c0bdd4012cc4708e29071ea5a789e7d125a3ea818049a9f290514e5ce5cbcd28da0abbcaceaa23a066bd7ff5282adfa1

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
681B

MD5
9fefe48d458a60b53a09794b6cee8ad0

SHA1
a3cad03eb40980d1145399c41f00522c1fecbcc6

SHA256
4b1f623c6007789aa4a4dac12a9f83da0bc2f7dd90c390cf5868d824ec97c87a

SHA512
28d165fdb8dd6d35f44c0cae5ab77736af8fd02110e09fbb22a819305b2bf835374b33a7000cf0e360ad670f998e10c00152bc5ee3ffd909a50bc8bfa8c8764c

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
802B

MD5
00b0a1a81045dd92795b02b776aa9703

SHA1
c0937d9318a15ab2b2b68150014cd8d693e327a4

SHA256
69ce9e3d7049e22ae111f1f3e44d8a0788e8fe52c21e2dff30aa3aac5a8196bd

SHA512
6a1176838a8c84f7dda9d34ec9b54f8960c7ad978f3f8ba5fd8309c97a9d9d16296b1f89d5098d42e1489c736f5d5356191760415b0bdb6d78a42f479d3e1239

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
7KB

MD5
c468f08fe491dba8afe675cbc4d321e9

SHA1
44cbfffeeee34ba321258f9589b10b912b1d03db

SHA256
afe929a6ecb087b68b551405b970e7394faac06a95d7a274e644fbccb1a80641

SHA512
8a5b9f62a4305628c226d2db5471c6a3a0240003ed91293ec7f50becdba7259567085d5cb592802a5686b0f3fd32957fac60deff5583a45ee11e4ecb264582b7

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
7KB

MD5
4765492e3854ca164fc1928df6372019

SHA1
5da0c2eeba8d5f89c0dc647959afbf2a3dc67cf7

SHA256
0ea5411f88ab056456a72a52e42d0784bbc78c7804ae97bd1857aea957658afc

SHA512
ee9d1c14e4316143e28d075fa6d3ae5e124b5176743f3472d270ed9eacd3b1aa3dfb8a3b62c17d09b62bc9b7912fb8039874d3757a375b4b5058315bd0a931ea

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
7KB

MD5
c1d343b16273be7925f79e34664e7758

SHA1
5d6ceb9c2557df25dd39ff36f21e0d521b8ad76c

SHA256
d07a9dc44053165f5ffcbe5acfa13f7a27c963cbe95470a4304318f9a8225a96

SHA512
d3a25dd05dc40dd22d8136b7ba9be26e1b72d0b9f32774dce993dadfdebb47ceada2d2913952e5ae418b355e1393b4c2c0374110aeba88773760971ce2b7b573

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
73c353d8b5448237d394cc19bc36c40d

SHA1
870fa251d4478779d41b3ba287dd449fdad743d9

SHA256
c768f7ace98a3312c33b6caf45035cc232724708fc76f51d1e3fb8b39bbe0f72

SHA512
2218119cc4b8130fb24fc6ae2ba1f2aba4703fe564da22ae6303a06d00b7a029471a26b5bc3369de954b593dadd6fe858afc06e4dcbfffa2e6d09208ee9480bd

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
17f7ed95ec16da5476995249ec75ad96

SHA1
382bf388710481e0b7c11b33291f0963030a616d

SHA256
7d0ae555c8f2d1e8d557921d1d97a2412c4496c41a042e0558c1d51aee2e7a02

SHA512
5b08a9627610ff557b8388796dc1e8e79140e979c4518a3464892adf5f93a336ab0d85d932e7f1c1eda0cd0e7a1b4d891041a8dd8763b160053419ca2e640c2e

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
84b92c8ed05e09fb9cf328128cd5ace2

SHA1
58c8bdb0b44e595139cd01fd1ece9a934ac45461

SHA256
e60a6058cc75a94f3bc6fd1f6319c16882c29a85aeefba9c0f7926772139f60e

SHA512
d2bf38949888321a899676c04f9e361b9295f55ed7721a3582c897e36d93f2dad4a792b2c61d7f3a19c91acfeca6e3a73b00571f4e3ba983b360564e2b43a345

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
2KB

MD5
d20ee5c7e54692f2969c9f95e5c68c4f

SHA1
d0beb10ec5117849d54900494d3a2f0e09417c5f

SHA256
a8316cbd0545f1aff2437813319ebd89233901c2feba390de56a0e928e3f22af

SHA512
af740ff19308372b430c5c44a4982c32386d20aa99d42863c0be0df25cd593046bf8f517c73ea1eae0cf9015f603f5e6328878f739c6c3701bc346cb8d864ce6

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
3KB

MD5
6ff0bdb1bb55bc75eedba9f7096ec42e

SHA1
08647273a7c4cb48aaf553f1beb7e6bc9940c9cb

SHA256
3dcd057873d6a2ce303f84754418b3cfb9b5e9cf66e41762cb748cf86176de2a

SHA512
47634c000d2549b32d509157df9e1090c79ec94a106269a2de5759b0091bce8dc47c38df0bc36acc59ac9300fde9c6ace28b45aa9f155259f3efc3f8e2da6be6

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
3KB

MD5
7d0aa794666f1a333a367f782d942880

SHA1
4a1dae6adcb804dace31c9dc8fa27f136834aee9

SHA256
3057d7442b248d76800fbbeb1892c751a1b1713e89df4c2b48f52465b3a83fd8

SHA512
ceab40c97499d057277d68497740bbcbe7cb4522c208f0827751ef5ad58b1861d24ee4834f53d711bc8ec6c84e65c9be83a46596de3a9f05a9e2466b14b95824

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
3KB

MD5
5b1d635fe68443017842439ba078412b

SHA1
1fa625d86f8edf3e5524e7bbe7562badd1e5eed6

SHA256
0518d56c472adfa414842829930e5e93e6a718331663dc9cde2c82e1a1ef8bd7

SHA512
e0a24d714cbd3b59375ecf211f799dec848ce4363fc5212d1bf1e1f4d96b3495b3fbcd184ba891f56dbb8275e9d3c4e0107f27a00b50782ef18198fb54b0e412

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
86697a403fef52162afff8e868579b0c

SHA1
1ea760030ff47fb62199b9e35721964b6d73faa9

SHA256
492633aca956df17a5df5c1b7517cd52126cfaf4c229fd2daa126b0ba1903aea

SHA512
cbe2d4590a4cebe34fcba61369fd63bf72506a20f1c52377292a2872c7f1d74a4d5b493335370bf195c5ee720bb8eb94ea663d672e0e82b0164849ecd0198d96

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
d434d0d2ec79c20053ca69949c63b230

SHA1
c48f748aa338148dce4b21527943f9a5adcb2ff5

SHA256
c9210bdd59aab6116d1d6645697abd5b177ac0f13d0a119350dd922509a0644a

SHA512
2cf8ccd76534e44a77ec858d8f2ee1ef3c38afe3e7a312a54043dd161319c2e4ab8cd275267ff34313cf51210d60b2532731be711528e5791a60651e483ba4e0

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
254c56f10303db8e584f217848e769d9

SHA1
3873a99728c77e31bed52e75a4865990b63ae9c4

SHA256
9f3872ff7dac5a441a86db58692183e9b6c056a0bd12e26013d3685525a54416

SHA512
70108cb1dc188f96ab6a51ac2b67da4fff72e2fc1fbb179e88ea99cd2bd0b199246a39c04b2908fa76e7bd05e17c53217d36c5b48cb6112c5b74a856653d6537

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
30dd57e620caed76b7a48b4495e53c7c

SHA1
eca93656af66e54e4558ac169c00badd54b42fcb

SHA256
d3070049fbba8eb785ec52c9f655d213682a5a6c824af2e9273691a2bead18ff

SHA512
56d2deb9e32faa621eb39fdbb1108aee585281cb9a5ddbb68e06a44df8f4d74e482cb7bbea58f6a3045b37309e5db443298c391f081c78fb9c11e5270801d57a

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
7KB

MD5
0d4020afe0af613883519f5eebecb1cf

SHA1
df3d9504f9ed4c2434e60f22bc10ebe28f38636d

SHA256
da5aed30a275a3d05463dfafd3f62e38e2e3a85a7d7ef0e589495e06e9c70e17

SHA512
07ce2b5b5c72da401b0a97d14659e4b873411371c7439c5aed0b96951477020fcbf95ce931859cfd2cb80391bcc9fd30d4eb1978df50904cb4289cbf5ee2f53f

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
7KB

MD5
6beced40335ffca00d8418b720d92491

SHA1
696fb07062d08dedec7cd41685a41f875000d67b

SHA256
e2ef4b14b6e0d6423d9e9fe6037227046efb5c6491d33449d7bbdca88a8ffdc0

SHA512
53ed96283336c6fb8f37f68639467b37b3e9c06a68079f4f38d771b531b2008d70979bc50a48c727feee065a9c4351f947c41cb7c658fe6ee33386b92a78757c

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
7KB

MD5
cee7324c06fdcc54a556171273b977a1

SHA1
e575e2bf2ebfcfed20c767a4b3ef4c349b027380

SHA256
8f5ef0158a7b71147a918c44957148316155d4876f9ba48a598f7461f6740adf

SHA512
756ca94b16b0363f580926c74dd311b3b23e6d1204a045bb3968417d6dc0cc85ff6de640d4f3070a68a6539398f7e968ffd45348c1201ad571acc73cf8eb6bc2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
18KB

MD5
25f0389aeb1fa15d48ac3d241683a777

SHA1
81e402a4b5e93cc2a607222228b5d419916ff055

SHA256
59ecb2179434e952bb10a90b029396661f62cec87f0316f0dfe1799e005f4cda

SHA512
8450fdd8ae4674c8bd48d7173a82218b758674b0d6c080a815c667e56832fa2720c0933e9a0a7a1e5c9e5c901b02f358ed241b2d3e880175670bed72db4596b0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
18KB

MD5
47df0cb38e2c6128847d56cb21f706f0

SHA1
405035f71251833f567bfdf60192d0aac55e7e0f

SHA256
af6d9bf467279fabf068eb16b1329d5dc39d0bff1d6ffa650707ce64389fc6f2

SHA512
6688e25c224d0d11a1fd8f4620012515e20a46c730cfcb7ae4d77b7b4d648f4d13d85464b7f91233ce9aa899c578cb2893b2aa45a702bccdab95f03e0eb1de65

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
18KB

MD5
24ffefdd8a89b13e3ca460a53b2a384a

SHA1
2ab2b148216373e0a652eade7f6878da058ac21d

SHA256
01c2ebf3143ac2f9474b1be23812dadc72107b42b0095a2386f5b1f48eb9102f

SHA512
4e9edeb5ac6f3284627a7efa94285143d5e83d51fd488ba57c0097b5938e166db0bf2b5eb35a0238584bee1a405000d19bf8cb1cb23c0548bba75640cdff409c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
18KB

MD5
2690e30a0337d80be210dc540565488f

SHA1
758ab81139e55ad112efd23fa062b5a8024f2de5

SHA256
a1a147087fc878efff29215328347d07865bfb65c7547cf7e5ff8c5f87fb06e5

SHA512
3b2d0cf3adde9ba95cc1b6a63e86da4ad7e630f3dc6cddab317c98217e54344393ab55fcd299cff4eda177cc9b6408cd9600d1512dfe1ca0f96d941bf2b1eb57

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
7670fb1577d2c53694435f93a64e43ce

SHA1
8745429023582d19e093631482e68dd882d18d2d

SHA256
6c6fe122e49c9b8f11e81022bf8556a51a3ac41b6fd541ce1fb9d7c052570eb3

SHA512
fd0dbf4738e12b78fab5e75d505c6d180e50e61e82cbf0319a141bae46534224b0c82d4b54f6bedb1a9e632f2e7a8961c68326a3a9f1fe5de2bbf541695638db

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
02d3f29a0959b6640aadd208fcfb3f1f

SHA1
a6ef97aedf6cb5d4dcc33d23d9ab782fa67322cd

SHA256
94983512363727b5f4f7f66eade3cf95ad40e5f09c494c5adaea1ddc388c3701

SHA512
cf890d9867980c1e5a738e00330b8c8933caefe1aa189dea8d1b3f6a66e360c75a914e01e67c0b9434865f49c58ed782913296f19204adf825f01a849f6aa006

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
8737f3b52211968632e83edfa54135a1

SHA1
b6caca60625ccab72901821973d80bce76c02e14

SHA256
9693aae7aacb62fd0100970b2586629dab1fe9ac9a9096c8c237601f3a1f4f89

SHA512
58eca642feb9af549391edfc2978e130efccd1c4e7810b4314089a870c6bb1a0e343766f9ce0ad21f201142d09426a68218d31e88fd6dbb29af0bbd113d659a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
770b93bb85b7b25845167d2789f1065f

SHA1
959cb1319453703d527c0fce136dd18259396f2d

SHA256
815a70b651138f22d68be22db54fb3070f30e813eb326c8ebb58744762ffc2da

SHA512
79f98d8df3d48a3fb5a9f3a510c9bccb86bc1827ddda427d977c63a38d3060538f02fea81ce13d6c8b5514b11b19ef1ff98651f1129be012db722802231958fe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
80541246252fe4441548e9b6323dfecd

SHA1
4c55654af8535b10a6bcb65849515f189a3049fa

SHA256
0c125e1d0fcd8ca97ba430ab305d34a12e92e7725edb6c414b8ffaec913dfd50

SHA512
2c7b2b1b1dda82859f0b5774272c1b37387b25911d4972c419e48a9052fc0cba5a21502d6011ca8a997fd8fe60f968243684fbb022abfb9caf71e1ff5ca66ac8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\AlternateServices.txt

Filesize
2KB

MD5
f51fa95655b93e8f864d4cef8e48e762

SHA1
8570ac1f5dc92c814bcb9bff5b7469f2e9e35db5

SHA256
1c1006967b04223cd5e6448d56b1dc53e0bbd9987b6802628c7d3b871dd25d07

SHA512
bf03aef0e8f8422153fe39c6f9b58c04d7823e476fadbaedb507301c81461114aa6ad37a16129656272affca966f272b9e22bfd4851abd9dce2b7b0cc895b6a9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\datareporting\glean\db\data.safe.bin

Filesize
9KB

MD5
2807b6d29172da5bb773905b515f5dfe

SHA1
7797b47a9fdca0cdaccb51242f9bc4cdfed8dbf8

SHA256
a439471adfe29969b9a961c0b1423f128095ede24d12c5118d0bf7a0ed1d9d49

SHA512
d33779b3cd0a567d1e6f490b84f93b89fe4e8b9605dd66bf0c0354d5b2a270663c1d5df23467478c85a426252083e532c0819bf425b09bb284ce161eb7264f4d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\datareporting\glean\pending_pings\457a9947-1f92-4e18-bf05-2159809ba419

Filesize
734B

MD5
566686ff368720a6cbdf16a668d49e71

SHA1
e9a15d9ef5f2eceac6e835cc123237d9a08c2bc9

SHA256
d9f322a837a71decdd2c15b486cc61b9df0e06c8e24e0bf19de9bbfe4740a5f5

SHA512
f500fef7850055c8b8819722448b6d79f9ba05b0339cb9577e94c56a4224e16ae1c5f3b8356991c64124f74bba9db566da8e8acca2887a483dfad695a328fb4c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\prefs-1.js

Filesize
6KB

MD5
67abd4e2b812191bab2463a09ce265fd

SHA1
fade20ea86b8953b47e8ecb3481b5f6d0d8987cf

SHA256
ea91566cba54be9781634eba2810a8f7107d4d47529dc17248fb150c567459c5

SHA512
3f00f6f29b581543fe849000c355b438938ee0db1fa40a1524a1c44501157c5d2ed65da925ac7464dd2e4467663ac75f906171c15d2d1d294b306b174de4aec4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\prefs-1.js

Filesize
7KB

MD5
22b6edb04ea4d2f02b56f3fde22a4189

SHA1
0978a697babd9224f800a01c360d02523eae61b7

SHA256
61582bdec441fa3a5d815a1a88ff82c12859ab836323d8110e72372b67cb787a

SHA512
fd4ca6524e89925dfc7e5e7854b08c56d651ccad3fef169ee3d21e5a395f9341be3d5235bc4f57b205aa011b5e2666fa0bc51e8b8f9ab08b906e63d09592d76b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\prefs-1.js

Filesize
6KB

MD5
50671d7472be87ecae3ab609f6b18eb4

SHA1
bb8f44eda2bebf0e8b0be6d63ee664938d758f69

SHA256
c49ce82c767cd055e576d810a21fb172a4493e0508dc2bcc4e5d2b493b8be8b5

SHA512
5da132173e7838d3cf9eab0a18542698038417602d5b1177f117dedf649d848c88eeb67390e091aefccfb9bbc11cec06a9e4514de6d6f46ecda8d9520d8e3c6b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\prefs-1.js

Filesize
7KB

MD5
d336e4bc88fc874478ef6fcf38dd1c35

SHA1
23101074d4de10d2844244540c22c071386aabda

SHA256
58bed1479fbf5804cad2dae757e3d1b849fe088bcb73e8d91c2415872e4d86a1

SHA512
3774ba7654f6e52dbd30c6d108155c67b808126b0ab43157c2f10005c50933a3f29722dae1fc02e64b158d56d19cd11a5a2e48b4f34d068f1bfecce82f541354

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\prefs-1.js

Filesize
6KB

MD5
2e47794fbd4f7b9dfee148c91cce03cb

SHA1
cb3e67e64589ba753b59cce8e2ea297a01a5a64e

SHA256
21bb2a1b0731dc299c0cb37892cee4d2c33c9fd45aaf4784d12e65c474c6262b

SHA512
f323a781b89a60c0f9bc562ed9b5c0b785c43d59e7851f3904c62b9b442dae1641c4120aa8bb32e4eeea311293f1cc0d2272f1a54f54d1b4aee454db5b30c6cd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\prefs.js

Filesize
6KB

MD5
0bf2a3fd0f0dc5cfdbb1650568465879

SHA1
1d399ca72ad32c74e5168d17fda8d3990fa34be4

SHA256
48466dab6da5d858a3c8f05c5d8f31ff2511577a161419741da14794289e53ae

SHA512
0073ee49a099b09823e0bad21742c19588882fef7ccd45a83dd1446ddceacc83b9a76c6a1d1bd8f18026f1cd0a70ef6550c8aa532cb166371378aec78b480589

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
c3506d7ce275dc163b38919b68bd0abe

SHA1
281ad72a7736cecaca32c1b3c89d8c9d074d1e20

SHA256
4d791fc4743316916872226662c1dd821d593edc82756ca438f3975e210000d8

SHA512
a05c377f34fe213945bba5c94e1825577d9b849f41bd56d05bbb93c1ad7149fe45fe99feeaef09b1072e57c79e32ef35ee3e4a8429a4b6511f3c12b8a9107ed5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
b288931f38c2c3ac3158473527341e80

SHA1
cad44ca169bda6d2991335bfdfa0ccbe369305f0

SHA256
e0279fba03417f1fc2c4de5a916d1b84474c0862b47fd4e393d5c98433bf0bb4

SHA512
ca2a9aaafc1ae285e9ae87e1a1d23731803dd060b3b2a5dceb6c65c9caeff8792cbaf0884be5c9333bb1659e223b5d633952c069e329f82fe79a6d18f92be8b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
6001ecccbb1ea6db248d1d73552ca1f8

SHA1
9af5cd78ea24dce5ff50dc447bc97b51abb1473c

SHA256
d4febe5e6edacf7bd36fc8a65b3a36b312e942fcc42b438b21fc6b62704e655d

SHA512
01aa2c1006e1c4da54aafc7efe0247935a0bcbde2831132fb7124290019463a9b9abd63eab7ec1dd65a41259fa4a5a4e713254b866f3b0e213396e492f7a84fc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
1a6cc0d59e3a0b4a33574c9539f98670

SHA1
1754fb7b29ecbe62a00d9c86e9559ef7697ac9ec

SHA256
e74d063fa6d6cef5a6b6a823fe2544a1dd6c8e84c21e2c83e12740a49021cc60

SHA512
e9330477acccaef7475ae8f6af665efa66d2ec601a50378fddfaa37fe5d35e8921ce1b559f621a1c0e7b2b9c9ffc5c5c577d73c2977ac9e8c1f315cf0164d670

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
666947d23b30c76a4f21c3bd41eeb933

SHA1
ed65d7ebde316590d3e297d6d6c20c1ed419f2f8

SHA256
3b41389964b35182918a3f02dc4143d06583b7faac0f21ca7b89a9c981ad09e7

SHA512
c6520c42260c3201a2b8e8f617226753a5327e088bda845d6bff8401392f833bd95f33ef534f27013ed775ea5f1ecbec5db34d3852b2de42b9f0a18dd3644f06

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
ba83e1db991447d463c23a9b901795e2

SHA1
259da9bc1722b5d9e0d2e27ae1a7a93e44d2e62b

SHA256
d30960fd7c9ee6b19f4763cd4b630c0c9ea04a692bedb63dffb1f08606f7d03c

SHA512
07b17517ece3f4f294ee34e97ae5433470de133f4b10491da82ab09106d13aaea1c0d5207bf4ecff784df747c2f7dbdd2898944374781b6e3c86617a6098f857

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
58c20296d148c18229ec9221505d1cca

SHA1
3fecbd9f6eb5f27d46009e2c2bd68666ea1e4c9b

SHA256
f4cfb027adea7ce29bfa7380115b40182d3c8376215f1335bf4e16c840c3cf56

SHA512
a386036a0caf982b2a08bfbb3adab2e292cb58207d4eeada65127eb0273f521d0224dd58f947f8ad93ddeb247c6e3bd2e8f3ee4ed1b6f70d1f7addd9187a0157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
afbfe55284301af42a18bb5c464ae13f

SHA1
0858bf2075b798551f6d0095bdd882badfe01301

SHA256
7a96cf2853a1635528e4afc7de0ba611a71dea731f0cc5b7823853ec103170d3

SHA512
f3f71cdd16b0aa50685424afde6dc29a23a8cc152e0607ba38010cf34a1c3abb30432448d3fb98c2b4e18f6293b4c72a3316c37c059dbd0a1268f2c91923f255

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
9f09e7e16f98da625a159982e7a1a6c2

SHA1
46dba3796f9212ced956caaaeeab7e86bc40dd31

SHA256
4309d837270fc5fa8e658c1410301433cb3972b1acb7221f296654c18921ce5e

SHA512
8d00b1b1aa066d21cc7795609d7cc474827cde701b87cd918ebbf99bec623d6f0dd677344ea95704c3807b59da2c1074a16c23578eeeb5b5c69d890c2c1d0957

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
d833752f51a737b6c5dbdd73dfd34cbe

SHA1
92871eeb51d4c279f3409d491378d2f25cbf80bd

SHA256
a1fc749b14c172d04680bf1285453d3a98fc0860fc23aa6e2784bbd6eb612860

SHA512
b931ed5663bca1b0f44781ca8fde699631e6bd2855e75954a9a6d6b9d913538372b8dbd7c4e178e65db0f575e7d6bf341ef7f9182d3af9dd74e6e8ae34df9a43

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
d6f1412970e0c62cea3419dc3d1d881b

SHA1
c09322329e9a8c1b0aadceabef90189cc8fd898d

SHA256
86c67a1f4fbe449341ad52aa1533fa9bbae7032938329ef009e38d5c2df133e9

SHA512
9d7371bee7a07ac977db0cda1e762363c4fe45643da4b60ebe32857ba23335597e9149f519687c0507aecb95dc0007f6aa5974ecbe305246474b5671c6272b25

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
ee2fd8f9b5f389912314883806ae98c7

SHA1
498e852a0cf5a11c700ff2c3de89166970a9bc2b

SHA256
db42455453ecaa8c16cd5d6d1583ddff5eafe96adeccf9af7d80697793e5e784

SHA512
322cec3027afff1783c3a1a8516915d100aaf2156e6b3d52446972c2e9c16c541980b3b52e7f2070627df9f6dd5e98fc55fd2b3bf0b767b0e402439559ba84a6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
aeb36697ff105925dbba85f055804249

SHA1
f1cac9c48ced7ee70149c21996aadb6b6c77799e

SHA256
9096160f2dc69138afb2bd07c903c0e192697719bcc0547da5838cdc88795c68

SHA512
297c1723d4834ca1bfc1757bfd9cb77180ac69a3e3cbe9709647e0ac98d8f7babd5e0c972d0553788e8aab11ebde712ce7a6e8cd4754652efd8a71749074570a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
a4915deb47a0a4804a630f6e94288ee0

SHA1
4f2a630c0041cea339faae03c59928206b5304bf

SHA256
ca9cc3edbd026061487679e575e4dffdcca318952a3ce68c5641a5979872da05

SHA512
6e09a9d6deed33ebf892fc2a0d9713ecb075c15cc86b4cd9dd5a37a903affa62f5da10fa695c1eb2b8b89224119f180fcda80866cd27066322dcc19a0b13bf6f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
de2d0d9fec2faf99cd58c01ec3a8f0fd

SHA1
878d07b436d79440dc9c944787fbfedd75cf2bec

SHA256
a9996a7b8baf32e81a85ddcc99e716307196d619e3f0f78074825b7d4ccea7cb

SHA512
6c2622a676541b072dedc86d5647093e03667e6fe90bbea2c801c01a6230d33457ad1f010080f350a151a99bcd1d6299a8ae19d497b582d79631d20897cd67b3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\sessionstore.jsonlz4

Filesize
8KB

MD5
25e612504dcf5d78bb248ba8e5e4f4c3

SHA1
66b9ba237c9bcdfe0b11f947191b6ecc3f228f03

SHA256
c54485082bee23dfccad1fdc37294a24d2046a0a1f5c52bb7a8c66464cb38476

SHA512
0ed49c3443e2450d0a14d8a2649a5a0007fd43ad07e06b260ddde65a33612730a7f7644fd318a0522ed56bc06861fe80c95c8a7ed9817e4c01b8b149639d4f88

Download Submit
C:\Users\Admin\Desktop\42\lib 0\book 2.zip

Filesize
28KB

MD5
38605a41eda691b378c8304bf914c777

SHA1
75f2667ccacce7c7947c186dca5029ffee720c01

SHA256
f791bea6d653eddcaf8be57e45b698e75f105e28a20c50f519ad43a2b2e27b2a

SHA512
d1876ebad38543260b3c4a2b83b69546da52b093f459890835ad02ea65ea712e91f40c5bf9ae0313fa2f4fec303cea2348c5272a4ac70088d1dbffb7d5163374

Download Submit
C:\Users\Admin\Downloads\42.93L6siRK.zip.part

Filesize
41KB

MD5
1df9a18b18332f153918030b7b516615

SHA1
6c42c62696616b72bbfc88a4be4ead57aa7bc503

SHA256
bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa

SHA512
6382ca9c307d66ab7566acf78b1afd44b18b24d766253e1dc1cb3a3c0be96ecf1f2042d6bd3332d49078ffee571cf98869c1284c1d3e5c1c7dc3e4c64f71af80

Download Submit
C:\Users\Admin\Downloads\7z2404-x64.ZPFbpGSp.exe.part

Filesize
63KB

MD5
2f49105d9c731def3bcb3b7204826222

SHA1
1e4949877ba30116aa6357271e29721c634791e3

SHA256
d6e001588f0bb159a7aed295efc488132ff116da2479ae7df6189e520a25399c

SHA512
dc6f543575ed41cff802c5ffd440d3be60e47bff6dc30752b3c3c54c515cdb36736ea164f6e04fe00cd75171ae660cfb8467a9a6171f038906296c2a5e62ecf8

Download Submit
C:\Users\Admin\Downloads\7z2404-x64.exe

Filesize
1.5MB

MD5
61ba723e67d41dd15e134b973f2d7262

SHA1
3282a5b7c20c7123ae6168f0c565d19930ffb6f6

SHA256
4931869d95ffa6f55788e3b5d92088f3fe590e13532b9d8e811a52e2b377bfb6

SHA512
b293d21403e8ac935a0ae8daf27a069b31b3b6c4d078d3966f2411e5df34094f9e0ea50c7fdb118ae7f2e7ca25a3b526f0bc172e769244bd92125858357ce0ff

Download Submit
C:\Users\Admin\Downloads\7z2404-x64.exe:Zone.Identifier

Filesize
123B

MD5
cf4f1f235224c3922d378d2a7f8f0568

SHA1
c9f308f24970f3140b4577e6b70501264c50f1a2

SHA256
4da5e2d0deddede874fbd9ab2814ce0cedc30289400376a2fe6c8fa74cae92b1

SHA512
6d6a661f8efd2ac37e87a29e40b37faa78ffedaeaf1133939c8c1a3a2ba6f717fad5dd1e768eea6e1d73c1db3bdda743e7e59f1f940d194471f6f31b4deb4de2

Download Submit
C:\Users\Admin\Downloads\AnyDesk.8oJCU1zM.exe.part

Filesize
5.1MB

MD5
863fa58aa1fe8a88626625b191d4722e

SHA1
e7fb4bf69be5ac4583c0c02e26a17bd3cdef4c02

SHA256
45126297c07c6ef56b51440cd0dc30acf7b3b938e2e9e656334886fe2f81f220

SHA512
ffd3bf831e8f0dc605706075a9763c68552f6560aa8660d7993e5156f64032fbc4ff6134fd333822e3090fb863cecff9e463316a8d9c3150152b73f8377aa2bd

Download Submit
C:\Users\Admin\Downloads\AnyDesk.exe:Zone.Identifier

Filesize
110B

MD5
27b5902c353ca1528d9fe4573b211800

SHA1
5aad114403c4ec2dc88c9a112c5466aa720f0594

SHA256
1640f1a3d869557f28b2b408bd03c580b030ef247424a60672d9641b22ab7351

SHA512
081517fe37d650441799372bfdc6e1d7c554a0b2cd87fa47991c57654f4a3ae91a2eb93130047839f70897542285089a53e495341f8b387e9f3fc879618cad37

Download Submit
C:\Users\Admin\Downloads\ZOD-master.8nM13S_E.zip.part

Filesize
41KB

MD5
ae6438a5a41352e5b7b37918259bea69

SHA1
684f4e642980875422c1e666ee349d9aee5c337f

SHA256
d53a7858a392b314ef7e63d5d8d2f7fa8b6067dc0b9cc926adf219c0c4c0b768

SHA512
28b14be2cadcc3d37afd2a501e553bb5d8df42cb376609c587348a2bfd3eab35e81b76ff2f61b1951a606739834eda607f9dc4334ea60f00bb806edb269c9784

Download Submit
C:\Users\Admin\Downloads\lib 2.zip

Filesize
34KB

MD5
0a76bd3e26768bba68aca3d210997069

SHA1
753690994a18cf58ed0fe3749d16448b763047b8

SHA256
9056b87f079861d1b0f041317d6415927d9ffb6498ce2530ff90fda69fa64e78

SHA512
14408ea7f44bc365a58d7480fff9ea3b10fa21bfbd3363c6e30b74a4d4121677e20ce1108cce12c203f0760768aee1c1aa69b130e090c409f9a516ea02d70c49

Download Submit
C:\Users\Admin\Downloads\winrar-x64-700.exe

Filesize
3.8MB

MD5
48deabfacb5c8e88b81c7165ed4e3b0b

SHA1
de3dab0e9258f9ff3c93ab6738818c6ec399e6a4

SHA256
ff309d1430fc97fccaa9cb82ddf3d23ce9afdf62dcf8c69512de40820df15e24

SHA512
d1d30f6267349bb23334f72376fe3384ac14d202bc8e12c16773231f5f4a3f02b76563f05b11d89d5ef6c05d4acaacc79f72f1d617ee6d1b6eddab2b866426af

Download Submit
C:\Users\Admin\Downloads\winrar-x64-700.exe:Zone.Identifier

Filesize
167B

MD5
013556ca5c1c75290515852704370adf

SHA1
c601702bd2d6344338ed20b4fbb228dd4d295c04

SHA256
35a873a462c5bbc9061d4dc9e7c4c08134fe8f5e6b2088c5d3d5efc50653b482

SHA512
62e2851711806a2bba9e3eaa01025238e31be6890dd836a38b787c72b912c153cb2b14280e657e6dc9ad988ac2922f777ed286595064cdd5b1adabff9152c516

Download Submit
C:\Windows\Logs\DISM\dism.log

Filesize
21KB

MD5
9e528dcea8816ddbd00a9eb44ca8d18f

SHA1
cc72bcedaeb1ac1d60f40fd9a5e143dfd4cd7b83

SHA256
0113a39c4ae8c698dcb7aa49518d438415a56da014ee8b9d6514249e42efc93a

SHA512
cccafecc41df1cb835f2d11fdfb8f68cd2f951f9187d3e4cf57ee511dfbf276ef1f7b2b113ff15bf622e223403c9fba6164d3409876ee25bed520289275f1e59

Download Submit
memory/780-675-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/780-780-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/780-2192-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/780-725-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/780-437-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/780-431-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/780-417-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/2816-729-0x0000000005950000-0x0000000005951000-memory.dmp

Filesize
4KB

Download
memory/2816-491-0x0000000006F00000-0x0000000006F01000-memory.dmp

Filesize
4KB

Download
memory/2816-407-0x0000000001F40000-0x0000000001F41000-memory.dmp

Filesize
4KB

Download
memory/2816-404-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/2816-405-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/2816-774-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/2816-434-0x0000000005840000-0x0000000005841000-memory.dmp

Filesize
4KB

Download
memory/2816-436-0x0000000005830000-0x0000000005831000-memory.dmp

Filesize
4KB

Download
memory/2816-490-0x00000000078A0000-0x00000000078A1000-memory.dmp

Filesize
4KB

Download
memory/2816-487-0x0000000007540000-0x0000000007541000-memory.dmp

Filesize
4KB

Download
memory/2816-640-0x0000000006F10000-0x0000000006F11000-memory.dmp

Filesize
4KB

Download
memory/2816-730-0x0000000005940000-0x0000000005941000-memory.dmp

Filesize
4KB

Download
memory/2816-732-0x0000000005980000-0x0000000005981000-memory.dmp

Filesize
4KB

Download
memory/2816-661-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/2816-731-0x0000000005970000-0x0000000005971000-memory.dmp

Filesize
4KB

Download
memory/3352-693-0x0000000005880000-0x0000000005881000-memory.dmp

Filesize
4KB

Download
memory/3352-704-0x0000000005950000-0x0000000005951000-memory.dmp

Filesize
4KB

Download
memory/3352-1357-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/3352-688-0x00000000057A0000-0x00000000057A1000-memory.dmp

Filesize
4KB

Download
memory/3352-2183-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/3352-691-0x0000000005860000-0x0000000005861000-memory.dmp

Filesize
4KB

Download
memory/3352-869-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/3352-722-0x0000000005EB0000-0x0000000005EB1000-memory.dmp

Filesize
4KB

Download
memory/3352-1354-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/3352-747-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/3352-690-0x0000000005840000-0x0000000005841000-memory.dmp

Filesize
4KB

Download
memory/3352-686-0x0000000005760000-0x0000000005761000-memory.dmp

Filesize
4KB

Download
memory/3352-678-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/3352-707-0x0000000005980000-0x0000000005981000-memory.dmp

Filesize
4KB

Download
memory/3352-689-0x0000000005830000-0x0000000005831000-memory.dmp

Filesize
4KB

Download
memory/3352-692-0x0000000005870000-0x0000000005871000-memory.dmp

Filesize
4KB

Download
memory/3352-706-0x0000000005970000-0x0000000005971000-memory.dmp

Filesize
4KB

Download
memory/3352-694-0x00000000058B0000-0x00000000058B1000-memory.dmp

Filesize
4KB

Download
memory/3352-907-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/3352-687-0x0000000005780000-0x0000000005781000-memory.dmp

Filesize
4KB

Download
memory/3352-682-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/3352-696-0x00000000058D0000-0x00000000058D1000-memory.dmp

Filesize
4KB

Download
memory/3352-697-0x00000000058E0000-0x00000000058E1000-memory.dmp

Filesize
4KB

Download
memory/3352-698-0x00000000058F0000-0x00000000058F1000-memory.dmp

Filesize
4KB

Download
memory/3352-699-0x0000000005900000-0x0000000005901000-memory.dmp

Filesize
4KB

Download
memory/3352-709-0x00000000058A0000-0x00000000058A1000-memory.dmp

Filesize
4KB

Download
memory/3352-695-0x00000000058C0000-0x00000000058C1000-memory.dmp

Filesize
4KB

Download
memory/3352-705-0x0000000005960000-0x0000000005961000-memory.dmp

Filesize
4KB

Download
memory/3352-700-0x0000000005910000-0x0000000005911000-memory.dmp

Filesize
4KB

Download
memory/3352-701-0x0000000005920000-0x0000000005921000-memory.dmp

Filesize
4KB

Download
memory/3352-702-0x0000000005930000-0x0000000005931000-memory.dmp

Filesize
4KB

Download
memory/3352-703-0x0000000005940000-0x0000000005941000-memory.dmp

Filesize
4KB

Download
memory/3352-708-0x0000000005990000-0x0000000005991000-memory.dmp

Filesize
4KB

Download
memory/4868-435-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/4868-425-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/4868-676-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/4868-2193-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/4868-726-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/4868-912-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/5816-2414-0x0000000005EC0000-0x0000000005EC1000-memory.dmp

Filesize
4KB

Download
memory/5816-2415-0x0000000005F50000-0x0000000005F51000-memory.dmp

Filesize
4KB

Download
memory/5816-2413-0x0000000005EA0000-0x0000000005EA1000-memory.dmp

Filesize
4KB

Download
memory/5816-2412-0x0000000005E80000-0x0000000005E81000-memory.dmp

Filesize
4KB

Download
memory/5816-2407-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/5816-2406-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/6888-2402-0x0000000007790000-0x0000000007791000-memory.dmp

Filesize
4KB

Download
memory/6888-2282-0x00000000060B0000-0x00000000060B1000-memory.dmp

Filesize
4KB

Download
memory/6888-2337-0x0000000007DC0000-0x0000000007DC1000-memory.dmp

Filesize
4KB

Download
memory/6888-2267-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/6888-2334-0x0000000007E70000-0x0000000007E71000-memory.dmp

Filesize
4KB

Download
memory/6888-2335-0x0000000007780000-0x0000000007781000-memory.dmp

Filesize
4KB

Download
memory/6888-2268-0x0000000003F40000-0x0000000003F41000-memory.dmp

Filesize
4KB

Download
memory/6888-2403-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/6888-2283-0x00000000060C0000-0x00000000060C1000-memory.dmp

Filesize
4KB

Download
memory/7136-2289-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/7136-2316-0x0000000002790000-0x0000000002791000-memory.dmp

Filesize
4KB

Download
memory/7144-2286-0x0000000000690000-0x0000000001DD5000-memory.dmp

Filesize
23.3MB

Download
memory/7144-2336-0x0000000003FA0000-0x0000000003FA1000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads