9126e76c155f2535afbffd10fb2a9109a65c789540c434e03cf3a9c1e7df4833

Analysis

max time kernel
258s
max time network
272s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 18:46

Sharing

Reason

Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-19T18:51:16Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win10v2004-20240412-en/instance_26-dirty.qcow2\"}"

Report Analysis Logs

General

Target

npp.8.6.2.Installer.exe
Size

4.5MB
MD5

c8cb32063d37894be9ad45bdf57eed0f
SHA1

55aba5a8c0c574a266ccfe54c3e8ac3ac42531fa
SHA256

9126e76c155f2535afbffd10fb2a9109a65c789540c434e03cf3a9c1e7df4833
SHA512

c175a94e4c71dd5142b350368f122bee988a6fbeb41d3277f58739a7f0f04544dec24d70dedf1609f15a2df6ac923e2b9d8438f106fdbda820fd3bf90cb6639c
SSDEEP

98304:DtviqLHjHq0Zft7BGDWL34yMJvUdewZJam4KcKgTtf8g7gOk7Xb1wQlj6asJvoEf:Dt6qnKmhwCL34tywwTvhkt0g74XbdGt

Score

7^/10

discovery persistence upx

Malware Config

Signatures

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000237ef-1834.dat	upx
behavioral1/files/0x00070000000237f0-1855.dat	upx
behavioral1/memory/5440-1883-0x00000000005B0000-0x0000000000643000-memory.dmp	upx
behavioral1/memory/5440-1887-0x00000000005B0000-0x0000000000643000-memory.dmp	upx
behavioral1/memory/4408-1886-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/5440-1880-0x00000000005B0000-0x0000000000643000-memory.dmp	upx
behavioral1/memory/5440-1866-0x00000000005B0000-0x0000000000643000-memory.dmp	upx
behavioral1/memory/5440-1848-0x00000000005B0000-0x0000000000643000-memory.dmp	upx
behavioral1/memory/5440-1837-0x0000000000400000-0x0000000000445000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
624	raw.githubusercontent.com
626	raw.githubusercontent.com
627	raw.githubusercontent.com
633	camo.githubusercontent.com
625	raw.githubusercontent.com
630	raw.githubusercontent.com
579	camo.githubusercontent.com
585	camo.githubusercontent.com
589	camo.githubusercontent.com
591	camo.githubusercontent.com
623	raw.githubusercontent.com

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	notepad++.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Notepad++\autoCompletion\lisp.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\autoCompletion\lua.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\functionList\cs.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\localization\english.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\themes\Hello Kitty.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\themes\vim Dark Blue.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\uninstall.exe	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\autoCompletion\c.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\autoCompletion\BaanC.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\functionList\inno.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\themes\khaki.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\themes\MossyLawn.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\autoCompletion\cs.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\autoCompletion\css.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\autoCompletion\cobol.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\functionList\cpp.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\functionList\krl.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\autoCompletion\cmake.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\autoCompletion\coffee.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\plugins\NppConverter\NppConverter.dll	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\autoCompletion\autoit.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\localization\german.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\themes\Zenburn.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\themes\Ruby Blue.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\contextMenu\NppShell.dll	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\functionList\pascal.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\functionList\hollywood.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\autoCompletion\nsis.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\autoCompletion\powershell.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\functionList\overrideMap.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\plugins\mimeTools\mimeTools.dll	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\themes\Black board.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\themes\Monokai.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\functionList\perl.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\functionList\typescript.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\updater\updater.ico	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\autoCompletion\tex.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\functionList\cobol.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\functionList\vhdl.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\functionList\batch.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\updater\LICENSE	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\themes\Bespin.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\themes\Solarized.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\contextMenu\NppShell.msix	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\functionList\lua.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\LICENSE	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\change.log	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\themes\HotFudgeSundae.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\autoCompletion\sql.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\functionList\asm.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\stylers.model.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\shortcuts.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\functionList\sql.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\autoCompletion\cpp.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\autoCompletion\gdscript.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\functionList\cobol-free.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\functionList\javascript.js.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\themes\Mono Industrial.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\themes\Vibrant Ink.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\updater\gup.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\themes\Navajo.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\autoCompletion\javascript.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\functionList\nsis.xml	npp.8.6.2.Installer.exe
File created	C:\Program Files (x86)\Notepad++\themes\Choco.xml	npp.8.6.2.Installer.exe

Executes dropped EXE 4 IoCs

pid	Process
2644	notepad++.exe
2436	notepad++.exe
3180	gup.exe
1948	notepad++.exe

Loads dropped DLL 16 IoCs

pid	Process
2884	npp.8.6.2.Installer.exe
2884	npp.8.6.2.Installer.exe
2884	npp.8.6.2.Installer.exe
2884	npp.8.6.2.Installer.exe
2884	npp.8.6.2.Installer.exe
2884	npp.8.6.2.Installer.exe
5072	regsvr32.exe
972	regsvr32.exe
3180	gup.exe
2644	notepad++.exe
2644	notepad++.exe
2644	notepad++.exe
2644	notepad++.exe
2644	notepad++.exe
2644	notepad++.exe
3408	Process not Found

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\InProcServer32\ = "C:\\Program Files (x86)\\Notepad++\\contextMenu\\NppShell.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\*\shell\ANotepad++64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ANotepad++64\ = "Notepad++ Context menu"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ANotepad++64\ExplorerCommandHandler = "{B298D29A-A6ED-11DE-BA8C-A68E55D89593}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ANotepad++64\NeverDefault	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\ = "notepad++"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\InProcServer32\ = "C:\\Program Files (x86)\\Notepad++\\contextMenu\\NppShell.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Ana.zip:Zone.Identifier	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2644	notepad++.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1184	firefox.exe
Token: SeDebugPrivilege	1184	firefox.exe
Token: SeDebugPrivilege	1184	firefox.exe
Token: SeDebugPrivilege	1184	firefox.exe
Token: SeDebugPrivilege	1184	firefox.exe
Token: SeDebugPrivilege	1184	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2884	npp.8.6.2.Installer.exe
2884	npp.8.6.2.Installer.exe
2884	npp.8.6.2.Installer.exe
1184	firefox.exe
1184	firefox.exe
1184	firefox.exe
1184	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1184	firefox.exe
1184	firefox.exe
1184	firefox.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
3180	gup.exe
2644	notepad++.exe
2644	notepad++.exe
2644	notepad++.exe
2644	notepad++.exe
2644	notepad++.exe
2644	notepad++.exe
2644	notepad++.exe
2644	notepad++.exe
2644	notepad++.exe
1184	firefox.exe
1184	firefox.exe
1184	firefox.exe
1184	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 5072	2884	npp.8.6.2.Installer.exe	100
PID 2884 wrote to memory of 5072	2884	npp.8.6.2.Installer.exe	100
PID 2884 wrote to memory of 5072	2884	npp.8.6.2.Installer.exe	100
PID 5072 wrote to memory of 972	5072	regsvr32.exe	101
PID 5072 wrote to memory of 972	5072	regsvr32.exe	101
PID 2884 wrote to memory of 2060	2884	npp.8.6.2.Installer.exe	103
PID 2884 wrote to memory of 2060	2884	npp.8.6.2.Installer.exe	103
PID 220 wrote to memory of 2644	220	explorer.exe	105
PID 220 wrote to memory of 2644	220	explorer.exe	105
PID 220 wrote to memory of 2644	220	explorer.exe	105
PID 2884 wrote to memory of 2436	2884	npp.8.6.2.Installer.exe	107
PID 2884 wrote to memory of 2436	2884	npp.8.6.2.Installer.exe	107
PID 2884 wrote to memory of 2436	2884	npp.8.6.2.Installer.exe	107
PID 2644 wrote to memory of 3180	2644	notepad++.exe	108
PID 2644 wrote to memory of 3180	2644	notepad++.exe	108
PID 2644 wrote to memory of 3180	2644	notepad++.exe	108
PID 4084 wrote to memory of 1184	4084	firefox.exe	119
PID 4084 wrote to memory of 1184	4084	firefox.exe	119
PID 4084 wrote to memory of 1184	4084	firefox.exe	119
PID 4084 wrote to memory of 1184	4084	firefox.exe	119
PID 4084 wrote to memory of 1184	4084	firefox.exe	119
PID 4084 wrote to memory of 1184	4084	firefox.exe	119
PID 4084 wrote to memory of 1184	4084	firefox.exe	119
PID 4084 wrote to memory of 1184	4084	firefox.exe	119
PID 4084 wrote to memory of 1184	4084	firefox.exe	119
PID 4084 wrote to memory of 1184	4084	firefox.exe	119
PID 4084 wrote to memory of 1184	4084	firefox.exe	119
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120
PID 1184 wrote to memory of 5828	1184	firefox.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\npp.8.6.2.Installer.exe
"C:\Users\Admin\AppData\Local\Temp\npp.8.6.2.Installer.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Program Files (x86)\Notepad++\contextMenu\NppShell.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\system32\regsvr32.exe
    /s "C:\Program Files (x86)\Notepad++\contextMenu\NppShell.dll"
    3⤵
    - Loads dropped DLL
    - Registers COM server for autorun
    - Modifies registry class
    PID:972
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Program Files (x86)\Notepad++\notepad++.exe"
  2⤵
  PID:2060
- C:\Program Files (x86)\Notepad++\notepad++.exe
  "C:\Program Files (x86)\Notepad++\notepad++.exe" "C:\Program Files (x86)\Notepad++\change.log"
  2⤵
  - Executes dropped EXE
  PID:2436

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:220
- C:\Program Files (x86)\Notepad++\notepad++.exe
  "C:\Program Files (x86)\Notepad++\notepad++.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Program Files (x86)\Notepad++\updater\gup.exe
    "C:\Program Files (x86)\Notepad++\updater\gup.exe" -v8.62
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3180

C:\Program Files (x86)\Notepad++\notepad++.exe
"C:\Program Files (x86)\Notepad++\notepad++.exe" "C:\Users\Admin\Desktop\1.bat"
1⤵
- Executes dropped EXE
PID:1948

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1184.0.2031678100\1342409030" -parentBuildID 20230214051806 -prefsHandle 1788 -prefMapHandle 1780 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6192e175-2244-483f-baa9-c1f3900acaff} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" 1868 2135caf2158 gpu
    3⤵
    PID:5828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1184.1.991522860\518412804" -parentBuildID 20230214051806 -prefsHandle 2424 -prefMapHandle 2420 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89fbd25e-1662-413e-adbd-c1e1ccc64cba} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" 2436 21350c89958 socket
    3⤵
    PID:3508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1184.2.155663103\828903766" -childID 1 -isForBrowser -prefsHandle 2944 -prefMapHandle 2940 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {35132b20-2fd3-4d8e-bb82-2cf95fd7ef4a} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" 2956 21360806358 tab
    3⤵
    PID:6064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1184.3.938590994\2073670125" -childID 2 -isForBrowser -prefsHandle 3816 -prefMapHandle 3812 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {71d3f771-e788-4975-aec7-f19e2218552d} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" 3836 21350c3fd58 tab
    3⤵
    PID:4064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1184.4.1688146863\168140470" -childID 3 -isForBrowser -prefsHandle 5164 -prefMapHandle 5160 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {68a8b328-7779-488a-b423-cacba986e1a1} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" 5176 2136506cf58 tab
    3⤵
    PID:3780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1184.5.1908895357\1431375225" -childID 4 -isForBrowser -prefsHandle 5400 -prefMapHandle 5396 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07e3e017-81b3-4345-b307-bf5a5388c520} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" 5320 2136509f258 tab
    3⤵
    PID:752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1184.6.823967633\2047315845" -childID 5 -isForBrowser -prefsHandle 5488 -prefMapHandle 5312 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60ae54ad-8a5f-4238-af20-aa48704f1d04} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" 5536 2136509f558 tab
    3⤵
    PID:4332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1184.7.960534509\963963455" -childID 6 -isForBrowser -prefsHandle 5968 -prefMapHandle 5964 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac2cd623-8e69-4307-a17f-39c076ecb577} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" 5948 21360805d58 tab
    3⤵
    PID:2884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1184.8.1479951634\1574689382" -childID 7 -isForBrowser -prefsHandle 5924 -prefMapHandle 1268 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b42ea8c-4ee6-4cf5-8fb8-a3cf07dd5ce6} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" 6188 2136275fb58 tab
    3⤵
    PID:2220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1184.9.1338471706\1918969036" -parentBuildID 20230214051806 -prefsHandle 6192 -prefMapHandle 6452 -prefsLen 27776 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b1e1576-fcab-445d-a3af-1f56f132336a} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" 6436 21360cfc558 rdd
    3⤵
    PID:4712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1184.10.507763812\1761745730" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 6464 -prefMapHandle 6460 -prefsLen 27776 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecd7a8aa-dbdb-4a95-b3d2-538891fe18dd} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" 6476 21360cfce58 utility
    3⤵
    PID:5544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1184.11.460863964\653524748" -childID 8 -isForBrowser -prefsHandle 6744 -prefMapHandle 6740 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7a79215-04c0-48d5-bce4-9d70b1fc4593} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" 6720 21364ddb258 tab
    3⤵
    PID:5184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1184.12.790495011\605005188" -childID 9 -isForBrowser -prefsHandle 9240 -prefMapHandle 9232 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecdfc92e-c202-471a-8248-15b65875e2d4} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" 9220 21350c73258 tab
    3⤵
    PID:3464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1184.13.1299566446\656582528" -childID 10 -isForBrowser -prefsHandle 9008 -prefMapHandle 5080 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1309ad50-4354-4d5a-9e4b-e50ea551ac52} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" 5640 21366f6a558 tab
    3⤵
    PID:5324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1184.14.308912828\1126706632" -childID 11 -isForBrowser -prefsHandle 8856 -prefMapHandle 8888 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0af28652-9cce-4220-b116-a89a64c501a4} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" 8868 2135e12aa58 tab
    3⤵
    PID:4764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1184.15.1932457417\1416667539" -childID 12 -isForBrowser -prefsHandle 3664 -prefMapHandle 6084 -prefsLen 28177 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d53e89c6-aae2-4832-8afd-707c0d72287a} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" 5704 2135f0d6d58 tab
    3⤵
    PID:6000

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5884

C:\Users\Admin\Desktop\Ana.exe
"C:\Users\Admin\Desktop\Ana.exe"
1⤵
PID:1284
- C:\Users\Admin\AppData\Local\Temp\AV.EXE
  "C:\Users\Admin\AppData\Local\Temp\AV.EXE"
  2⤵
  PID:2432
- C:\Users\Admin\AppData\Local\Temp\AV2.EXE
  "C:\Users\Admin\AppData\Local\Temp\AV2.EXE"
  2⤵
  PID:2428
- C:\Users\Admin\AppData\Local\Temp\DB.EXE
  "C:\Users\Admin\AppData\Local\Temp\DB.EXE"
  2⤵
  PID:5440
- - C:\Windows\SysWOW64\cmd.exe
    /c C:\Users\Admin\AppData\Local\Temp\~unins9812.bat "C:\Users\Admin\AppData\Local\Temp\DB.EXE"
    3⤵
    PID:4740
- C:\Users\Admin\AppData\Local\Temp\EN.EXE
  "C:\Users\Admin\AppData\Local\Temp\EN.EXE"
  2⤵
  PID:4408
- C:\Users\Admin\AppData\Local\Temp\SB.EXE
  "C:\Users\Admin\AppData\Local\Temp\SB.EXE"
  2⤵
  PID:4812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Notepad++\autoCompletion\batch.xml

Filesize
3KB

MD5
01e31d41e5cfb5d2b85c6aa0aabb0fff

SHA1
6ffcbf31a35c8674536cc2a8a9de7d3f2d48ca38

SHA256
c4025268b36bb02b2d25e5144d360f69cfc7dddcb3ac98cd2d588393b5cbd30d

SHA512
edd0921a8330aedd148da78fd364999c99fd745a87e7c699a3487bc084224d9a4a0ff89d496031a289591766b68e44c5b255abd9d8588100408e0d7ac993da74

Download Submit
C:\Program Files (x86)\Notepad++\change.log

Filesize
2KB

MD5
49289d54ac50144085f380ce7d6002a8

SHA1
6b18c63177c482ffe34f542e13b62632712dccdd

SHA256
c6462ec921d8aa721999a75022891c0bf8e12e75941a59808cd7cb6a7b30a0ef

SHA512
199d817633cf056c43dd23ab9450dc336486635e9beba584c01e8a4481300da036be6cb0caa079d1679528100ea9a891601e0aaa9b7ca8c364fc622cc84c2cb3

Download Submit
C:\Program Files (x86)\Notepad++\contextMenu\NppShell.dll

Filesize
388KB

MD5
a3f7ba2ee563b50dcd411376f66c8d02

SHA1
b865b1e878b3a68538c5ebe0aeffc98ff617736d

SHA256
42272408ffb295313636f3f3b19947079339e32b43368d6c379fd8c911ec5122

SHA512
40b69e2dca62984d4e28d9db822961ffd41df5911ed83b5e826668d5aafeb0ff101139dcfb7c51f96b7f9ee417155cf421ad7a743159b722bb2841729f4a7193

Download Submit
C:\Program Files (x86)\Notepad++\langs.model.xml

Filesize
451KB

MD5
e2720d29d41e4373d807701e8c7e74f7

SHA1
42f6abe22a32bc4a3e389205bb1e82f6685f81a0

SHA256
b21447e1d7fa8e21a8641638701e18a30ebf491766b8f2071aa12c5595b4b1e8

SHA512
4cacc1190641f4de8523751183f4edfc0042dad415a7963fe221e2186aad4759c4831b61fb77e27ee8bc1cb16c876e04288be00c972f6326821ef516336bbf99

Download Submit
C:\Program Files (x86)\Notepad++\notepad++.exe

Filesize
6.0MB

MD5
96624506944511bee13733d075521155

SHA1
0353d45b7868180e4d5450c9ed3cacc2ca4e3f64

SHA256
49b3a7c4d821c49db9b92a7d01abe61ef5205cbaabb483e8987b5d6ab76e89b7

SHA512
8ad9a7499f711a59f86b216a87cc3bf173f3c313b5cf4125d4e7841d838c111a77be2ebb606e99314779a85fbd3f2713f861ced28d57212d519eef6ff13a14ac

Download Submit
C:\Program Files (x86)\Notepad++\plugins\Config\nppPluginList.dll

Filesize
197KB

MD5
ea2b7e8cd059a1eee860ae70af6f769b

SHA1
05871eaac63683cdd10f1f311787978a18fb315a

SHA256
66b746d566c29cd733fb24e89b5b0e4a4dc6feba5f887f03cd8b382f1f56d2ce

SHA512
30d528768f0a470e10816330c479f2fca12656bbeca3702b5888f486dc633f687e583829381d44a6c578d112a2c2f19eadf6be9d769c6f9d349efa27cb7de0ff

Download Submit
C:\Program Files (x86)\Notepad++\plugins\NppConverter\NppConverter.dll

Filesize
148KB

MD5
532cbccda275f7b3333d30326a42d6eb

SHA1
b39224d768d4becf7120c253a96a8668767144fa

SHA256
58a31039809436c27753d99d43cfd1fbe9886345149c47c62a3783144a15c563

SHA512
5b35d8fd27908cda6daeb86f94bf218e2129efd96c49bad45a97b0faf382d834791dada82841b1245744f69f738ee67ed95975c1cfb443a7df14fa4fb3b286d8

Download Submit
C:\Program Files (x86)\Notepad++\plugins\NppExport\NppExport.dll

Filesize
127KB

MD5
d3867eb3f4d3f9534ea3e832e622ef88

SHA1
9ea739460c7bf09537e7fd215bdeba65535e4937

SHA256
09a940ca8da5dbc060d683512a1f9bdfd1c0bbfb2d2b39194fee35eb25ad936a

SHA512
4007b0fdb9a85701fcb2dead193cc4dd49f67558b9fd9252e577965683cdbd422cb99fd63564d8a37dce886656c5a8dffb1c9fe0738e400167d28dd67f15222c

Download Submit
C:\Program Files (x86)\Notepad++\plugins\mimeTools\mimeTools.dll

Filesize
106KB

MD5
0f31257b9c5bf79ad59fa8246db36860

SHA1
c34d6675a90ebfede48a75d64f9183a91aeca6d4

SHA256
0060921bce80b61461bff5919b9c211bd92ec70ccac18ebc33881e20bd71bcba

SHA512
54891a90b68374bf29b3c3d39f35d6712884d16d4827a6ea246da86aee3f6f3fa780971a503aedb92761db3f7051e6128d663136da0d3e3bf9f28396ff1db59b

Download Submit
C:\Program Files (x86)\Notepad++\shortcuts.xml

Filesize
3KB

MD5
fb573784b83033dd4361f52006d02cb8

SHA1
0a2923a44ec1bd5e7e8bc7cace15857ae03bf63c

SHA256
37a24662cd55b627807bc2bb7cbba5bbf2abaf6da4dd7bbb949bfaa7903eae9c

SHA512
753b44b5e8bea858cf5cc5ddfdc38098a2f3f921949cf98706ead95bdfa1de7ab0c115e9d69237623a03c422969480204c69d3ba277141527458c68230d0c67c

Download Submit
C:\Program Files (x86)\Notepad++\stylers.model.xml

Filesize
182KB

MD5
343b8f55f376e88674733286d027f834

SHA1
466886054d5c2641ba6058f58a7a84053aa4696e

SHA256
f002b36e70f0fb159885c21fa6e6395176cd50a254201a94cbed756d9843fa9a

SHA512
ef6643badbb87739f0ae847d201651f8d3e677c54ca2aa3f81277b053355772f71d9b0f490617c104ce861a29e2b283fe6d82faf4cfe8f10bfc571d683cfea8e

Download Submit
C:\Program Files (x86)\Notepad++\updater\gup.exe

Filesize
631KB

MD5
0f0afe416e942dba4fdb99eb2107d959

SHA1
3afeb8ed3c9406e0295963fcaee85b7e3cf678b9

SHA256
7404decb346a83ed4d87ca0bfdc855ed0c640e54f58dc1f69c9b68951a2e19a6

SHA512
8e74262d7f29b1a01831fa8576e135cffaf46d996d712c409b4cb5ef1de73a5c48e1e40624ec428f0fc80434f52034626b0b430ba89503afee2431347e4f69ec

Download Submit
C:\Program Files (x86)\Notepad++\updater\gup.xml

Filesize
4KB

MD5
abde55a0b1cb4a904e622c02f559dcd1

SHA1
1662f8445a000bbf7c61c40e39266658f169bf13

SHA256
92717951aae89e960b142cef3d273f104051896a3d527a78ca4a88c22b5216a5

SHA512
8fe75fb468f87be1153a6a0d70c0583a355f355bfe988027c88d154b500e97f2c5241d9557ebb981067205e2f23ad07b6a49c669cd3e94eaa728201173b235a0

Download Submit
C:\Program Files (x86)\Notepad++\updater\libcurl.dll

Filesize
619KB

MD5
ac283c4f55be7359e962dad6dc1a0b4e

SHA1
98f36c06e4a37423536e20cc570d61ac283818c0

SHA256
7064bfa364769a9fbbba5c4881654012c7dbf830bb664acb8891c1c89e24bcd7

SHA512
3ae7d044e40e268ce098566d238d1de4f0bfe10cb1d68429aa5496fa8e87a4286105719e5f26ae3e5fdec46a0fbe19337feba111d5313e9e470a65d86c7fa0d0

Download Submit
C:\Program Files (x86)\Notepad++\updater\updater.ico

Filesize
130KB

MD5
4550bd860351f6a78c739db8a37384dc

SHA1
b09e179b906d8477beee211724921e05d0126b41

SHA256
fb40c912b218a71bd7bc1aeef5530165df60d0b4f896929f989b8ff37a98d459

SHA512
29729d0244192370d6fb6d8b7243e4610cbdcea52ff69805b16f019b9e0b570ea71a0f1773bcc0b13ba39252cb201f2a12b473c2c1fe17b16f475261b723e032

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xgut1z79.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
e92cc769da00aef0283302c35e7ea3e5

SHA1
0079a2a91e2483db9d6dbf540911a210a33c4fea

SHA256
e9fbd8d89c61f41d1fe75f29b1095ad715838de0daad4a20c24da6ea631f322a

SHA512
4ea106463ecc6bfa1383289ee4152b2980e65790325854c916d75008b510a134fe6a4f8fb1d41b8c159ae6f046c6e435e29d8de209a37ea61a574088a9d6e86f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xgut1z79.default-release\cache2\doomed\14103

Filesize
17KB

MD5
2de9ec0cc111f50005596d01cdd31d9e

SHA1
3c5ab05b735a6ce73a2710240c8f5d98c7749ccb

SHA256
b27efbd86ae684569ceb3d6cba97b5f45b91587d659ce90bdaa68891736f2ef2

SHA512
24726a49f401d53a1bae4670a6d0d5a2dc1adb6d9016be296e9f06559cd9dc7c6364b299da52c165cb628f096bf8300870d96637d6dad80d660e779a5bd07212

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xgut1z79.default-release\cache2\doomed\23390

Filesize
15KB

MD5
da028f6522e1efb579084a840a6ce0a8

SHA1
57c86fe7b0c84de4ed240ba9993a5ecae7f54f28

SHA256
20087205388ab1bcdf775b36e3de90f56b4d5f9cd85e021a94d7d83cdcce6248

SHA512
b158f62d07a4ef17f7c4f71b31f127850fd3e4e716cb667af9f61268188f7261503404a65737ea0903e1a4ff17b9dd8b87ae502c4b116e080777e029e827457e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xgut1z79.default-release\cache2\doomed\28342

Filesize
15KB

MD5
cbb75363c6956325c458f145411b8e75

SHA1
5dbbe8e02bb51d460d34531c37f1f0ccd269d564

SHA256
f0de51f94c077921584aa6e3cd158b977a0da2105b5c2d0c74379cfe6296aeb6

SHA512
5a937ea7e5ba6c44b60166df25e4e79ea648eb91820e86ebe75572e8e453f33cf68dd33fe07ee952a6a83b16051890d00d00392cf36551c03db8054225744adf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xgut1z79.default-release\cache2\entries\6A52D81474A7F4FE3EB16D96313B59CBA6BBB6FA

Filesize
13KB

MD5
1b2adb4187535c2bf9da13d8b750744f

SHA1
e32e10eb32d024b3bb91893802983c4212ab29e7

SHA256
b70d4a721de5679ec67ec4bbe2cf6945abd68454ca6c88ffb72689eceb4243a8

SHA512
c99e03dd975086b408d120caecdecb5fc119b3405b6e09f6f781ba5c117085370acb9ed6094afb8094e35565b4324941437efa7f2be160cbc501e08ea16ed95e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xgut1z79.default-release\cache2\entries\CA53D51C3631BC5CD6400E5D29BAD441DCCF6AF2

Filesize
117KB

MD5
1e2b69dcc3082c9bcf09112b40979035

SHA1
349f4e92711c285ecd8f141e08faa3daf4e0b288

SHA256
e943a68fc68c1fdfd859e5ae3597c1f1fb3026400b7d901192355cda4cb949e6

SHA512
82eef865f5e036758e2923485c5a3061b3525b02b5e32b28cf41f8b3b5e72f4bfe59ad0bc501078afb00e9504bb9c9f1d95282d8090c08407b1300c7f5a2678c

Download Submit
C:\Users\Admin\AppData\Local\Temp\AV.EXE

Filesize
1.1MB

MD5
f284568010505119f479617a2e7dc189

SHA1
e23707625cce0035e3c1d2255af1ed326583a1ea

SHA256
26c8f13ea8dc17443a9fa005610537cb6700aebaf748e747e9278d504e416eb1

SHA512
ebe96e667dfde547c5a450b97cd7534b977f4073c7f4cbc123a0e00baaefeb3be725c1cafbfb5bb040b3359267954cd1b4e2094ef71fc273732016ee822064bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\AV2.EXE

Filesize
368KB

MD5
014578edb7da99e5ba8dd84f5d26dfd5

SHA1
df56d701165a480e925a153856cbc3ab799c5a04

SHA256
4ce5e8b510895abb204f97e883d8cbaacc29ccef0844d9ae81f8666f234b0529

SHA512
bd5159af96d83fc7528956c5b1bd6f93847db18faa0680c6041f87bbebef5e3ba2de1f185d77ff28b8d7d78ec4f7bd54f48b37a16da39f43314ef022b4a36068

Download Submit
C:\Users\Admin\AppData\Local\Temp\DB.EXE

Filesize
243KB

MD5
c6746a62feafcb4fca301f606f7101fa

SHA1
e09cd1382f9ceec027083b40e35f5f3d184e485f

SHA256
b5a255d0454853c8afc0b321e1d86dca22c3dbefb88e5d385d2d72f9bc0109e6

SHA512
ee5dfa08c86bf1524666f0851c729970dbf0b397db9595a2bae01516299344edb68123e976592a83e492f2982fafe8d350ba2d41368eb4ecf4e6fe12af8f5642

Download Submit
C:\Users\Admin\AppData\Local\Temp\EN.EXE

Filesize
6KB

MD5
621f2279f69686e8547e476b642b6c46

SHA1
66f486cd566f86ab16015fe74f50d4515decce88

SHA256
c17a18cf2c243303b8a6688aad83b3e6e9b727fcd89f69065785ef7f1a2a3e38

SHA512
068402b02f1056b722f21b0a354b038f094d02e4a066b332553cd6b36e3640e8f35aa0499a2b057c566718c3593d3cea6bbabd961e04f0a001fd45d8be8e1c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\GB.EXE

Filesize
149KB

MD5
fe731b4c6684d643eb5b55613ef9ed31

SHA1
cfafe2a14f5413278304920154eb467f7c103c80

SHA256
e7953daad7a68f8634ded31a21a31f0c2aa394ca9232e2f980321f7b69176496

SHA512
f7756d69138df6d3b0ffa47bdf274e5fd8aab4fff9d68abe403728c8497ac58e0f3d28d41710de715f57b7a2b5daa2dd7e04450f19c6d013a08f543bd6fc9c2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RGI6156.tmp

Filesize
24KB

MD5
d0e162c0bd0629323ebb1ed88df890d6

SHA1
cf3fd2652cdb6ff86d1df215977454390ed4d7bc

SHA256
3e6520cd56070637daa5c3d596e57e6b5e3bd1a25a08804ccea1ce4f50358744

SHA512
a9c82f1116fce7052d1c45984e87b8f3b9f9afeb16be558fd1ecbd54327350344f37f32bc5d4baabd3e1cf3ac0de75c8ba569c1e34aaf1094cd04641d137c117

Download Submit
C:\Users\Admin\AppData\Local\Temp\SB.EXE

Filesize
224KB

MD5
9252e1be9776af202d6ad5c093637022

SHA1
6cc686d837cd633d9c2e8bc1eaba5fc364bf71d8

SHA256
ce822ff86e584f15b6abd14c61453bd3b481d4ec3fdeb961787fceb52acd8bd6

SHA512
98b1b3ce4d16d36f738478c6cf41e8f4a57d3a5ecfa8999d45592f79a469d8af8554bf4d5db34cb79cec71ce103f4fde1b41bd3cce30714f803e432e53da71ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv6E2D.tmp\InstallOptions.dll

Filesize
15KB

MD5
ece25721125d55aa26cdfe019c871476

SHA1
b87685ae482553823bf95e73e790de48dc0c11ba

SHA256
c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf

SHA512
4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv6E2D.tmp\LangDLL.dll

Filesize
5KB

MD5
68b287f4067ba013e34a1339afdb1ea8

SHA1
45ad585b3cc8e5a6af7b68f5d8269c97992130b3

SHA256
18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

SHA512
06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv6E2D.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv6E2D.tmp\UserInfo.dll

Filesize
4KB

MD5
2f69afa9d17a5245ec9b5bb03d56f63c

SHA1
e0a133222136b3d4783e965513a690c23826aec9

SHA256
e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0

SHA512
bfd4af50e41ebc56e30355c722c2a55540a5bbddb68f1522ef7aabfe4f5f2a20e87fa9677ee3cdb3c0bf5bd3988b89d1224d32c9f23342a16e46c542d8dc0926

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv6E2D.tmp\gupLocalization\german.xml

Filesize
3KB

MD5
5e8aee546da4976836b0f7d3a042304a

SHA1
5c7856f74a9b54860f6550ab985f572c721e5e52

SHA256
6d457663c6fa12adc8b2a02602e25df988a591049439bd59658afc88b2b7a767

SHA512
8db3ce25597310a0d2db5004dc7af0c164f5882a55c5a3ed06161985f0d5d60601566f9080d3b34f67bd1eb6360b3888fc37b49b0b50ee5972f1580bc0d3ad80

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv6E2D.tmp\ioSpecial.ini

Filesize
1KB

MD5
ec3485de90d020bf887e79946b7fc5c7

SHA1
76e7465ec02fc8337265029a772be0e11920e435

SHA256
6c0f5dc7b16752eff824f89586047a6ca7c59855d1dc4c207e6a57c1c83e9e2f

SHA512
1823c3d0c7da9628e0f11bead89a892bbde96137f237ecc11f05f64778a371db2e18e1e801e424bfb132e7140f654a17d6ce88360354c7e0185bd5ca38a08bc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv6E2D.tmp\ioSpecial.ini

Filesize
1KB

MD5
20b84384d451254106e6485c386d2137

SHA1
837b3770e6055c92ba77b7f6286b3911740203af

SHA256
4b7cd815cccd874be3113429e16f397a5947b85bbab034eb23e570ff5f816104

SHA512
4fdb2d7ba4dcb72d1a60193c7b94a5ff6ba87c36aabbfcc0978973704c575f13dec2c7cb000fb498096afdd2ef61f454acdcc57bd654ead179b2fcba1e37b954

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv6E2D.tmp\ioSpecial.ini

Filesize
1KB

MD5
60eef5895032ce7bde1a732b2259b017

SHA1
337f67e96a6468474bc868d92b6cc6d10c521037

SHA256
681aab93d9723fbae77a6a4fa93ad060c10a5c8417dd15031e8a42f79b7d2be6

SHA512
aa45dea668954c3bc32ba9b16bd58f2778a1c5fbb722e21cf6d8d26f32546733454aac6d35dfdb5b64a1b2e9febc3506db4a0d72a430730418e6b28ce6e8d6c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv6E2D.tmp\nppLocalization\german.xml

Filesize
101KB

MD5
cb877f503991e394e70ab91b86985506

SHA1
ee0965d4dc89c415d813ab4c4927decc91bb7785

SHA256
abe1474935a08032a734ca34f308c20d7510fa8bee04f63bbfd470299978dd22

SHA512
c2afb96cf2cacf17c29aed1294452b16ba71a20228ea8b47c94a6200c3bd494bbeaac1668a4d70e318a53361623a15f3a8d02b7847a99038a563f2eb59f2df05

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv6E2D.tmp\nsDialogs.dll

Filesize
9KB

MD5
6c3f8c94d0727894d706940a8a980543

SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd

SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\prefs-1.js

Filesize
6KB

MD5
a8b251ba421b75d1ce39e3ab66397630

SHA1
fa4b54295f865cd7861b5d4fd213649eff4eaca5

SHA256
2ca626c8d81b00dc71c85729504fcb51c7ff493938c7f568d8ee32ba3a065d30

SHA512
415ef8e27a5c971c2a21652cb156ad1a03d5d8a8ff44bc64fd3aa07c3478d4dc7667095fd0a5a15f58944f2386909734c4c6c493de512e55a286945fdc8d4619

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\prefs-1.js

Filesize
7KB

MD5
b397360508fd270b49da8626dbdac592

SHA1
c2d20f0de1a82fb92d2fa30ec29ffb13578dfbb6

SHA256
fc0a69161757e0543499531fdeb1085b8e56be6e04b7420d99064aa428a28232

SHA512
c817e76ddd9a2a307de70cb40c28fe2d4394f32f4a9d8367b3b2cb6834cfae5a21637fbf7d40b20d42d4cd6a225bbb2bd4ec01ca2b2ad4c6d1853e191953647d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
03d339ceffb56bf9762e267545d14a16

SHA1
44541672d9d6e62c257b294998200ac736e51d9c

SHA256
2df781766647732bba15d9819f81f3b9faf8205f64b4e50d65904cfe4c75bc4b

SHA512
064ff1a366f557d9b362938e3d4af83275f78cad5711938232ef9ba88c2fbf81f1b599e1ca96739de20909da41d3444665e4fbddac2493a8b944dfd848de32ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
16KB

MD5
5eb6b98ba26a38c7a8bdc0c4cb86d7cd

SHA1
0aeaba1aa9f89a5cba9093d98f54ca4150f5cf62

SHA256
5a77391747a574ae364ae83843c18fecb57dc7fabe877e9f3b684ef11ae2a22a

SHA512
b27ede46ac7b7d9166afbcfdfb5e8ca688a784ba264b8f08657c0ff5b95af18ec2012a955c21c0165b6676201705765bbc0cc4f75239a50c3b49962a7f1f6fff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
16KB

MD5
c33288062698a0017beaf37f71531992

SHA1
3a6729affb161215d378f249920055886f54d328

SHA256
12383aba4a227afa2eb90ffc60ab25305dc47dd43ef34dea51d41f7310848c86

SHA512
ffee510e00c3cd2223e907889f31f6fdfb9c94fb59feb4a01d6b6c3fc3ffa450ef4fa579ff1b7c3b97d81a211f35e2433b265f20722bdc9e8cc022f949c1329b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
8013e52e44cf0312b16ad75ab5fc2e71

SHA1
cc6ad3ea754e36f6da1e56614ddf61043ce2e098

SHA256
8f2b5ad00104ce8571ca8c986d7613fb7bbcdefb7d92481401505feae5160743

SHA512
2d5d8fd114252723da3fea66713d4f4d273c493c0eca9a33ea0571f1b761012b6e617add4bed60b5ba5381de9b56a96d579f3da139eebc16221468844ce2c3ff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
18KB

MD5
8652650ef3d328dab69b0aedad06ef38

SHA1
6e44a827b93e40bee918b56a091e08c41ef68571

SHA256
cb096fb3b864b0fe7cc35585c8cb6cdaf7b8ac635167d2be69d6eee28b48d2ce

SHA512
84007375e27438117331b3033a85604fdccff03e93df105a648bfd853069f8c5427a93c97135a5eb335320a5c82e5d85789c634a5f5059142731086327e80b56

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
18KB

MD5
58d7942d8c67ce801add9172f7e2b3e3

SHA1
a5ff22cac5f6595e9d301aa11ff695457d9f7a84

SHA256
dacdbc3462b9088d2577b160cdec23271a577785fda3be617113ad6f52fff2ca

SHA512
99c996f5e759b0ad972abe8ecac563b7ecac7bccfdd1b6846f2f044d835a235c8ad885122501f5ce7b93b1330977b1d4b3cb104386210c9dcefa7d07a0b44c17

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
18KB

MD5
3e1fd805c418af283edf0b9d1b91ff89

SHA1
6430e6bef7089b4471b544f64a7d745470a0b79b

SHA256
9126f4806492f66f981451e09cf4df8de82c7abb3c7db6f068c0cb9b03e03f08

SHA512
b9cf35adc222a4f7f9b8fb5f2df0174f4b9d4cd219e73a4ff9e9b4946167290ac44f9e9e3f11bcff95678e27bffa49a5deed47c77946c0bc01376d4b284a4ae7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
18KB

MD5
2a9f9752c3811c48ed8d003b3df63e51

SHA1
2ad261fedd8cace4b6eb35e18f58a557163d9659

SHA256
4a911cab994f1da35990eb192e3cce2b30568f8583758309d2e6480daece37b6

SHA512
b5ef3819063575a272414f7204ac041ea6efa342ed95cf5c444a499876c604c427f9d0e59579b8be13b186f1f82da3573fab8ecea2c92052319c88368e53e589

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\storage\default\https+++www.discoverresultsfast.com\cache\morgue\178\{a8287005-572f-4b4c-bc2c-2810fd12fcb2}.final

Filesize
84B

MD5
f629befe58358986157e2e6b485d7be9

SHA1
bf75fdd0f2d8e883955dc017ccd5b7c4607791cd

SHA256
65af7332ca41bca7116593799170965999490c6ffa086d0e6cbc36f508d27fc2

SHA512
059a91dab00b1fafb880a84f6391097f07c423970f0f70fa80ac408c06b8325f69f3d297e60ed90e6876e40f7161bc5a8a1b759abf9e56dc294b29f78ef6017f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Cgoogle.com%29\idb\2171031483YattIedMb.sqlite

Filesize
48KB

MD5
868c45dadcbd45a7297184e0401a4403

SHA1
8ace72fa98a231332f0ba6ca0d3b42c2b233c352

SHA256
8e14f960889d8aaf89ac82519a3eb8ba43abd1f46fcf555f875385b2606c969d

SHA512
8aafd7c3ef080f8f6f9c3e92dada9bb788a5a4fa4c598d99a266773264943154cd3be21ded6d68915283fb7c704e58e1a954811ca34adfeddd00543367f9498c

Download Submit
C:\Users\Admin\AppData\Roaming\Notepad++\contextMenu.xml

Filesize
4KB

MD5
fde4cc09d1c18c6cd7c1a4878e89d27e

SHA1
22fba21b254fed1a60da5de2b8af3cf6e132b647

SHA256
43ac0b7ba9b1f91fd8d4841b8119344e6212b307a1decccf61658f31d38bb425

SHA512
fcc87b93cb4dd0949e82edb7d2788d7abd317f9f4c5f046ceba1cd85a64b12b29c6baba3e8646265db02a48a2dc20c3b5e893a1334d9b1e91d26692b4e9c2d29

Download Submit
C:\Users\Admin\AppData\Roaming\Notepad++\plugins\config\converter.ini

Filesize
644B

MD5
f70f579156c93b097e656caba577a5c9

SHA1
8abfdad2ac85b7433318952b7a7e385a8c18674c

SHA256
b926498a19ca95dc28964b7336e5847107dd3c0f52c85195c135d9dd6ca402d4

SHA512
1e79b8e6df1ac158317d4670a01d5fb811470ace0f1f0f547ae979b3eff9bfee65770ad8134a6bddf2e871dc8fa553e146c7d7d94d2c3e139ae4b4942562b5fe

Download Submit
C:\Users\Admin\AppData\Roaming\Notepad++\toolbarIcons.xml

Filesize
2KB

MD5
bc4b775a277672fc7edf956120576ecb

SHA1
fe7c2db5b4d4c5a3f5603cf56c4d71cc9ee2d71d

SHA256
4ec98de37193f41242c1a47507bcc4c1af555e71154f7354272bc3e664e19877

SHA512
f87dc3ce52831ee308fbfa2b1b94c07e2811e7028360f046e012f8ea5a8f0ebcd362de7a663dee810c3da0791474c1485b1a2626c7867e76236156b125ff39b2

Download Submit
C:\Users\Admin\AppData\Roaming\Notepad++\userDefineLangs\markdown._preinstalled.udl.xml

Filesize
6KB

MD5
672e6d5f89887666ec94711e442644e0

SHA1
8d069ae93347316eff0dcf7aff4d22da18a62af2

SHA256
b34fe6811dacfe49d77d434123867e866daf6e0e27387a0446887dabe8943f04

SHA512
8fc5e9bbe027826304fa6f329fb16e4c9e4e7a597d87e9c691ed6a9f505b7bc1967339b43c6426105432a030260b0654468ab8fcbb4312b2fb6ed6c6aa537edc

Download Submit
C:\Users\Admin\AppData\Roaming\Notepad++\userDefineLangs\markdown._preinstalled_DM.udl.xml

Filesize
6KB

MD5
3690cef1865e32fe6be1b2ec7656539a

SHA1
bc043bec63c310a60d9e242810036460c467945d

SHA256
e45e49f0895249d951df2c07e0f06ca1242e05c961dd921e5aa2781ae2e7ff25

SHA512
c2be869d96baec2018e13dcf5934dd9cf74146541e852cc2eedb4d83a8af23e2577cde7a0158fefaa11056416ff039df3a7725e320620193e9bfe72c8067c051

Download Submit
C:\Users\Admin\Desktop\tsa.crt

Filesize
1010B

MD5
6e630504be525e953debd0ce831b9aa0

SHA1
edfa47b3edf98af94954b5b0850286a324608503

SHA256
2563fe2f793f119a1bae5cca6eab9d8c20409aa1f1e0db341c623e1251244ef5

SHA512
bbcf285309a4d5605e19513c77ef077a4c451cbef04e3cbdfec6d15cc157a9800a7ff6f70964b0452ddb939ff50766e887904eda06a9999fdedf5b2e8776ebd2

Download Submit
C:\Users\Admin\Downloads\Ana.i8uqYZz1.zip.part

Filesize
47KB

MD5
4b427d3c4d9b9584f772e62fd4a30221

SHA1
fe0c5548f5cfb70f40e3b45d10c48acb384996bf

SHA256
fb7888afc527420d88f08e81ff7bc296c13f69f62f7a31d36213882918ecafda

SHA512
58b21d044ef69172a7420f8e63e1a66835516513a69dabd7b329243ef59fbffd12dd753fad7750c318ae187cab96b802d6e1d6768c384e91d2e83fe0ac0b4e0c

Download Submit
C:\Windows\INF\setupapi.app.log

Filesize
6KB

MD5
b9252e1df11920fa8762a8d1f674d06a

SHA1
f620fd7c67043af7fa542135d01b8a7e4a2ebe08

SHA256
727dd6e395641971b0a5f9637082459d446175595cc3cdfa64e5a66c7391fd8a

SHA512
13b1aac6551158442f472fb60a98f29d8e839971dd6f4e52b0d850b85798e4757a5cc0af7c5e6da84a12cb681167d3cebf54b60cee970d85578ff7d7bc61d095

Download Submit
memory/2432-1861-0x00000000717F0000-0x0000000071DA1000-memory.dmp

Filesize
5.7MB

Download
memory/2432-1862-0x0000000000C80000-0x0000000000C90000-memory.dmp

Filesize
64KB

Download
memory/2432-1864-0x00000000717F0000-0x0000000071DA1000-memory.dmp

Filesize
5.7MB

Download
memory/4408-1886-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4812-1889-0x0000000001FAB000-0x0000000001FAC000-memory.dmp

Filesize
4KB

Download
memory/4812-1888-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4812-1879-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4812-1882-0x0000000001FA0000-0x0000000002004000-memory.dmp

Filesize
400KB

Download
memory/4812-1881-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/5440-1887-0x00000000005B0000-0x0000000000643000-memory.dmp

Filesize
588KB

Download
memory/5440-1885-0x00000000001C0000-0x00000000001F1000-memory.dmp

Filesize
196KB

Download
memory/5440-1880-0x00000000005B0000-0x0000000000643000-memory.dmp

Filesize
588KB

Download
memory/5440-1884-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/5440-1866-0x00000000005B0000-0x0000000000643000-memory.dmp

Filesize
588KB

Download
memory/5440-1883-0x00000000005B0000-0x0000000000643000-memory.dmp

Filesize
588KB

Download
memory/5440-1848-0x00000000005B0000-0x0000000000643000-memory.dmp

Filesize
588KB

Download
memory/5440-1837-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads