Malware Analysis Report

2024-10-18 22:20

Sample ID 240423-m9qgrsff56
Target poster copy.jpg
SHA256 59a5632736ce0a74810969b57eedc5b27d24b7867393cb92c37d1b1591b6be81
Tags
qr link ransomware
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

59a5632736ce0a74810969b57eedc5b27d24b7867393cb92c37d1b1591b6be81

Threat Level: Shows suspicious behavior

The file poster copy.jpg was found to be: Shows suspicious behavior.

Malicious Activity Summary

qr link ransomware

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Sets desktop wallpaper using registry

One or more HTTP URLs in qr code identified

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

NTFS ADS

Suspicious use of FindShellTrayWindow

Modifies Control Panel

Suspicious use of SendNotifyMessage

Suspicious behavior: GetForegroundWindowSpam

Checks processor information in registry

Modifies registry class

Opens file in notepad (likely ransom note)

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-23 11:10

Signatures

One or more HTTP URLs in qr code identified

qr link

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-23 11:10

Reported

2024-04-23 11:15

Platform

win10-20240404-en

Max time kernel

268s

Max time network

274s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\poster copy.jpg"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zO45A0584A\MLG.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A camo.githubusercontent.com N/A N/A
N/A camo.githubusercontent.com N/A N/A
N/A camo.githubusercontent.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A camo.githubusercontent.com N/A N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" C:\Users\Admin\AppData\Local\Temp\7zO45A0584A\MLG.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Control Panel\Desktop\WallpaperStyle = "2" C:\Users\Admin\AppData\Local\Temp\7zO45A0584A\MLG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Control Panel\Desktop\TileWallpaper = "0" C:\Users\Admin\AppData\Local\Temp\7zO45A0584A\MLG.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\Downloads\MLG.rar:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
File created C:\Users\Admin\Downloads\EULA.txt:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
File created C:\Users\Admin\AppData\Local\Temp\7zO45A0584A\MLG.exe:Zone.Identifier C:\Program Files\7-Zip\7zFM.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4288 wrote to memory of 2420 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4288 wrote to memory of 2420 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4288 wrote to memory of 2420 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4288 wrote to memory of 2420 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4288 wrote to memory of 2420 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4288 wrote to memory of 2420 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4288 wrote to memory of 2420 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4288 wrote to memory of 2420 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4288 wrote to memory of 2420 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4288 wrote to memory of 2420 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4288 wrote to memory of 2420 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 3620 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 5000 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 5000 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2420 wrote to memory of 5000 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\poster copy.jpg"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.0.1856894760\1944202381" -parentBuildID 20221007134813 -prefsHandle 1700 -prefMapHandle 1676 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e22e34c-d6eb-46bd-a368-962a660a4ecb} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 1780 21d82df5158 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.1.1762528581\1542053061" -parentBuildID 20221007134813 -prefsHandle 2108 -prefMapHandle 2104 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9bfecccc-3a2d-4e71-994c-b98d5e5091a7} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 2136 21d82cfee58 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.2.35472776\789539696" -childID 1 -isForBrowser -prefsHandle 2960 -prefMapHandle 2756 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d9bcaa1-682e-4bf6-8bef-948faabe06c2} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 3048 21d82d6c158 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.3.1816382261\573649444" -childID 2 -isForBrowser -prefsHandle 3576 -prefMapHandle 3572 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1824fd3d-6112-44ef-9531-3db53775593c} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 3588 21d857b3258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.4.841437538\1545827566" -childID 3 -isForBrowser -prefsHandle 4412 -prefMapHandle 4408 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {efbc9d3e-6a6e-4a5d-b958-aa5c7f29e719} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 4424 21d88ab1558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.5.1247472796\806928633" -childID 4 -isForBrowser -prefsHandle 3800 -prefMapHandle 4800 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a324d82f-818b-4415-b0ac-702c6ee98b9b} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 4680 21d8935f258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.6.981717931\133183534" -childID 5 -isForBrowser -prefsHandle 4976 -prefMapHandle 4980 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0af0722-f4c9-4ab7-b1a9-4a591e7ac78d} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 4968 21d89361058 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.7.1655557889\1043231382" -childID 6 -isForBrowser -prefsHandle 5172 -prefMapHandle 5176 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec188856-f55e-460c-8a9f-da64bca1f578} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 5160 21d8935fe58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.8.56030557\1702739205" -childID 7 -isForBrowser -prefsHandle 5576 -prefMapHandle 3800 -prefsLen 29562 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b33a09a6-51a2-4345-8d02-7e9c136b24e9} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 5352 21d92829e58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.9.1011419428\1760801480" -childID 8 -isForBrowser -prefsHandle 4484 -prefMapHandle 5716 -prefsLen 29737 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6faa3fd0-4c71-4f06-a72a-69148d67a9da} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 5352 21d8b75b158 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.10.129210850\1505843262" -parentBuildID 20221007134813 -prefsHandle 6032 -prefMapHandle 6028 -prefsLen 29737 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b43388b7-caff-41f5-91c4-bf026ffa278e} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 5952 21d8f08be58 rdd

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.11.1815415335\157745347" -childID 9 -isForBrowser -prefsHandle 6156 -prefMapHandle 6152 -prefsLen 29737 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4ccb234-54a4-4c38-a418-117bd97fd288} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 6168 21d8f360358 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.12.1598949687\1272446004" -childID 10 -isForBrowser -prefsHandle 5752 -prefMapHandle 5756 -prefsLen 29777 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e235133-3690-4c24-b4db-7574b9274d4f} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 4660 21d8e320b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.13.1531255879\1860303062" -childID 11 -isForBrowser -prefsHandle 5448 -prefMapHandle 5628 -prefsLen 29777 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d9da70b-efb5-4aca-92bc-e87aca89860a} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 5440 21d8f088258 tab

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\EULA.txt

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.14.841426523\1867323797" -childID 12 -isForBrowser -prefsHandle 4440 -prefMapHandle 6552 -prefsLen 29777 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {47c3b915-e383-42be-8702-ce70ccaa2666} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 3528 21d9282a158 tab

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\MLG.rar"

C:\Users\Admin\AppData\Local\Temp\7zO45A0584A\MLG.exe

"C:\Users\Admin\AppData\Local\Temp\7zO45A0584A\MLG.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x428

Network

Country Destination Domain Proto
N/A 127.0.0.1:49772 tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 34.117.237.239:443 contile.services.mozilla.com tcp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 44.233.67.78:443 shavar.services.mozilla.com tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 firefox-settings-attachments.cdn.mozilla.net udp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 78.67.233.44.in-addr.arpa udp
US 8.8.8.8:53 53.121.117.34.in-addr.arpa udp
N/A 127.0.0.1:49780 tcp
US 8.8.8.8:53 aus5.mozilla.org udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 35.244.181.201:443 prod.balrog.prod.cloudops.mozgcp.net tcp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 34.160.144.191:443 prod.content-signature-chains.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 ciscobinary.openh264.org udp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
NL 2.18.121.73:80 a19.dscg10.akamai.net tcp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 201.181.244.35.in-addr.arpa udp
US 8.8.8.8:53 73.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 172.217.16.238:443 redirector.gvt1.com tcp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 r5---sn-25ge7nzs.gvt1.com udp
GB 172.217.16.238:443 redirector.gvt1.com udp
FR 74.125.4.234:443 r5---sn-25ge7nzs.gvt1.com tcp
US 8.8.8.8:53 r5.sn-25ge7nzs.gvt1.com udp
US 8.8.8.8:53 r5.sn-25ge7nzs.gvt1.com udp
FR 74.125.4.234:443 r5.sn-25ge7nzs.gvt1.com udp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 234.4.125.74.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 216.58.213.4:443 www.google.com tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
GB 216.58.213.4:443 www.google.com udp
US 8.8.8.8:53 4.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 35.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 i.ytimg.com udp
GB 172.217.16.246:443 i.ytimg.com tcp
US 8.8.8.8:53 i.ytimg.com udp
US 8.8.8.8:53 i.ytimg.com udp
GB 172.217.16.246:443 i.ytimg.com tcp
GB 172.217.16.246:443 i.ytimg.com udp
US 8.8.8.8:53 246.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 www.youtube.com udp
GB 172.217.169.46:443 www.youtube.com tcp
US 8.8.8.8:53 youtube-ui.l.google.com udp
US 8.8.8.8:53 youtube-ui.l.google.com udp
GB 172.217.169.46:443 youtube-ui.l.google.com udp
US 8.8.8.8:53 46.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 static.doubleclick.net udp
GB 172.217.169.66:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
GB 142.250.200.6:443 static.doubleclick.net tcp
GB 142.250.200.6:443 static.doubleclick.net udp
GB 172.217.169.66:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 static.doubleclick.net udp
US 8.8.8.8:53 github.githubassets.com udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 8.8.8.8:53 github.githubassets.com udp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 8.8.8.8:53 static.doubleclick.net udp
US 8.8.8.8:53 github.githubassets.com udp
US 8.8.8.8:53 66.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 6.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 154.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
GB 216.58.201.106:443 jnn-pa.googleapis.com tcp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
GB 216.58.201.106:443 jnn-pa.googleapis.com udp
GB 216.58.201.106:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.178.14:443 play.google.com tcp
GB 142.250.178.14:443 play.google.com tcp
US 8.8.8.8:53 play.google.com udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.178.14:443 play.google.com udp
US 8.8.8.8:53 106.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 camo.githubusercontent.com udp
US 185.199.110.133:443 camo.githubusercontent.com tcp
US 8.8.8.8:53 camo.githubusercontent.com udp
US 8.8.8.8:53 camo.githubusercontent.com udp
US 8.8.8.8:53 collector.github.com udp
US 140.82.113.22:443 collector.github.com tcp
US 140.82.113.22:443 collector.github.com tcp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 8.8.8.8:53 133.110.199.185.in-addr.arpa udp
US 8.8.8.8:53 22.113.82.140.in-addr.arpa udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 185.199.108.133:443 avatars.githubusercontent.com tcp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 8.8.8.8:53 api.github.com udp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 210.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 8.8.8.8:53 drive.google.com udp
US 8.8.8.8:53 drive.google.com udp
GB 172.217.169.46:443 drive.google.com tcp
US 8.8.8.8:53 drive.google.com udp
GB 172.217.169.46:443 drive.google.com udp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.178.1:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
US 8.8.8.8:53 drive.usercontent.google.com udp
US 8.8.8.8:53 1.178.250.142.in-addr.arpa udp
GB 142.250.178.1:443 drive.usercontent.google.com udp
US 8.8.8.8:53 tiny.cc udp
US 157.245.113.153:443 tiny.cc tcp
US 8.8.8.8:53 tiny.cc udp
US 8.8.8.8:53 tiny.cc udp
US 8.8.8.8:53 153.113.245.157.in-addr.arpa udp
US 8.8.8.8:53 10.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 ssl.gstatic.com udp
US 8.8.8.8:53 ssl.gstatic.com udp
US 8.8.8.8:53 ssl.gstatic.com udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.180.14:443 apis.google.com tcp
US 8.8.8.8:53 plus.l.google.com udp
GB 142.250.180.14:443 plus.l.google.com udp
US 8.8.8.8:53 plus.l.google.com udp
US 8.8.8.8:53 accounts.google.com udp
NL 173.194.69.84:443 accounts.google.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 14.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
NL 173.194.69.84:443 accounts.google.com udp
US 8.8.8.8:53 content.googleapis.com udp
US 8.8.8.8:53 blobcomments-pa.clients6.google.com udp
US 8.8.8.8:53 content.googleapis.com udp
GB 216.58.212.234:443 content.googleapis.com tcp
GB 172.217.16.234:443 content.googleapis.com tcp
GB 172.217.16.234:443 content.googleapis.com tcp
US 8.8.8.8:53 blobcomments-pa.clients6.google.com udp
US 8.8.8.8:53 content.googleapis.com udp
GB 216.58.212.234:443 content.googleapis.com udp
US 8.8.8.8:53 blobcomments-pa.clients6.google.com udp
GB 172.217.16.234:443 content.googleapis.com udp
US 8.8.8.8:53 84.69.194.173.in-addr.arpa udp
US 8.8.8.8:53 234.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 234.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 peoplestackwebexperiments-pa.clients6.google.com udp
GB 142.250.179.234:443 peoplestackwebexperiments-pa.clients6.google.com tcp
US 8.8.8.8:53 peoplestackwebexperiments-pa.clients6.google.com udp
GB 142.250.179.234:443 peoplestackwebexperiments-pa.clients6.google.com tcp
GB 142.250.179.234:443 peoplestackwebexperiments-pa.clients6.google.com tcp
GB 142.250.179.234:443 peoplestackwebexperiments-pa.clients6.google.com tcp
US 8.8.8.8:53 peoplestackwebexperiments-pa.clients6.google.com udp
GB 142.250.179.234:443 peoplestackwebexperiments-pa.clients6.google.com udp
US 8.8.8.8:53 234.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 142.250.180.1:443 lh3.googleusercontent.com tcp
US 8.8.8.8:53 googlehosted.l.googleusercontent.com udp
US 8.8.8.8:53 googlehosted.l.googleusercontent.com udp
GB 142.250.180.1:443 googlehosted.l.googleusercontent.com udp
US 8.8.8.8:53 1.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 213.143.182.52.in-addr.arpa udp
GB 172.217.16.234:443 content.googleapis.com udp
GB 142.250.179.234:443 peoplestackwebexperiments-pa.clients6.google.com udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\datareporting\glean\db\data.safe.bin

MD5 f9d4e64f2d77d5d723e303f492b1c1c6
SHA1 e989bd0e5668b3b4094303a1ca187e2f67db9335
SHA256 bc055281e56f6ec2108c69e777b8fdf276cf291a67f728da11c6fed66c4df181
SHA512 75c75d47ba06f41ced5b8ef330d48a8de6b3aed1ff7205f36945ca297e745a5b3d29964b7d87a7d7341e168e889567fd1f9d1d8e6a62872d9ebc19a2888d449d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\datareporting\glean\pending_pings\af4e617f-4141-4512-a0cf-cdb4f2455f76

MD5 78b97d0dbfc264606f608e9fbb833086
SHA1 a202aded2c1b426e6c68f42fb29276362b38ca07
SHA256 e6fc0b7ded824f04394dc3a5f07c5576f37e88e86084143cdc4bce0d481d901f
SHA512 c62323261a795563691a8c22b048d7398309c472ec0d3a853b5f9b2205c2aad33cb11dbd29b4c64790a77145f5e035e6eee9bc8e299296e5b5dd880f7822c681

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\datareporting\glean\pending_pings\6ab39e12-9d11-42fb-8077-885573ebfa3b

MD5 a553de20e674fdbe71d5d7508615a9d0
SHA1 470f0b7a3aabf8c803d91cd4be52acaa57a3ccf9
SHA256 4b82070f6a25ed0ac7752c5edb77bfec03352d11f95c860e5c657216c3c99e64
SHA512 93add0716b4d3c937579542a6494088c9ec8c6ce266a663c3a88c606db2e7cae4da48d58fcaba0f67a1c8fa242bbc78ae35f585d2601c1a8f3fd571112812534

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\prefs.js

MD5 47a3018d6f2cf92def15cac5d4657c1b
SHA1 58bf49fc564085971366e25a9db5e26ca1c9727d
SHA256 0ba954aacb299e9f7493fac179fc8f2be362b0f9929c3a9119a369aef173cca8
SHA512 2eddbe4ddf9fb76642f77e5a45a59ac7a195ff42a1716ffb2cc1bd3c172fa427f8ddc4650a3716964cf473c5a1e089de2dbdecce62c1cc3867e16dd8e43b5c56

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\41eh5pdr.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

MD5 c460716b62456449360b23cf5663f275
SHA1 06573a83d88286153066bae7062cc9300e567d92
SHA256 0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0
SHA512 476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\prefs.js

MD5 d6e2564880cd90f1119d002ae1f51766
SHA1 a2de1cfce0385a1620c252acbc092991e98b91fd
SHA256 6f6ba941dca3efe3e159b941dbc39f367003810e5d1ab73019152cfe1939822b
SHA512 94441dcab44bc763cfc19876dbe1e1e5da40d1ab00905de192510af18d453e99576990fd3e6c31886fe676e43bcc87b645f17e92c775552779584e1b71311a6b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\sessionstore-backups\recovery.jsonlz4

MD5 71be7f78649fdf83d0cdb040a21d7f0e
SHA1 78f8a7afac864a2044e8326876c175a49813a770
SHA256 564a5e6b9abb4a5c2381405de330fd8cc8d48abb78dabd0f9b60d2037bf70b6c
SHA512 f7b3104fe2aeebed379753e9f507ebbb7c77ceb2d07cb3c5304e7ee05bdabbaf1221315da38b694c459e7d2566cafe7a94debfe8e2cf69877f3c006094b6813b

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\prefs-1.js

MD5 61d2b9f974e32070d678f09bc11af7e3
SHA1 4497edbd2f3cc2994d9427ab1030a1e2fe57c27a
SHA256 5ee37960cc8e81857df3d728993503a31b8fedf395c1414175d7a1d0b4aa22a3
SHA512 12c7e8116a76b419f1c0cb3798b8a86ce1a68fc201c161b73b1e4fb3559879bfc0cd05d67bd7de8cc43040af0493c4be65b7e41c1ab46341ba1b22d69d744997

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\41eh5pdr.default-release\cache2\entries\C72D4296C2EBC6FD41A9F780CD0C8F30F0FF937C

MD5 0d079bf0645b0e4b391280136ae3f3a0
SHA1 9dfe2e2cc27ec0a6a6b6c48962e1913650bd4e8d
SHA256 702e56324b2c66a9bdac3b69e2e98a95df6ad68e7053f31461043052acccefdf
SHA512 43db4353ce15cf1f2c3c1cb290f75f5bbe32ea2c3c5c166998bf8dca76405ec3c73dbd80c1c78ffedc12d0e952ed3f557512acac4f9d9ac0a6defdf10895461f

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5 fa756fe8825aa81c3901a0a551d7afec
SHA1 7456d906fb89c84318901945af58e0c99fd2f036
SHA256 83ccc0cb1c2fb5c76ec87358aebb10bb681559625dfcbff7c6568f625af6120c
SHA512 0f51f6468638139ea3e0c4c08e60f789591f402023c6365bc9ca2b9bc25db28a076d4b7afc8c3a6ebfaae4a6e770733560ccecf040f55fea61d0aa05ff755fe8

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\sessionstore-backups\recovery.jsonlz4

MD5 719123b23b1ba79020be5492e7b80019
SHA1 6cd8613ec6ca678c04df6da30d9f780a9e7e5939
SHA256 91003332238156876694561e63ba4432a06d08f4cf74f5719c5a8292daa2c62d
SHA512 2eaa28a06f56d95c6dd391293a84844d4b8d18e8b375912092b6c281db453baffdf49b189226c15d35b98cad37b928643d25aef3746cd10ba471e6c322e98fab

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Cgoogle.com%29\idb\2232182701SeesravbiacteaWDosrgk.sqlite

MD5 997a3bac033ad0ddabe1fedf99d01015
SHA1 a54f69cb6388f587b7cc000692991a7a192d2234
SHA256 43e16e4fe21ba06cbf15d5b6a4ba57cae3e55a15fcd9b0cd1a7bc51ab3d25775
SHA512 f0b038af59c80341b388d22f3f55ecfa35b45b98d38ce4e500e85e42854339a3c144be7feba439f0da8bc8aa4fdef72e0b744716bc9fa84a29c141523273eb83

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\sessionstore-backups\recovery.jsonlz4

MD5 7261c56aef5503145ee8a577fcacb26c
SHA1 965c3180cf27f3288a879461db1bbe6d4354108f
SHA256 7deb1ddf10c6db0c16719384d5f10a2dcb00a8d8375c4ec7d265804c1bf9e2b0
SHA512 ab529307c4d413c436dd6b668bd3985f59b974f65e91e1b9ad828950e2f6e2ea8ecf7e1409b6626277541fd32fe4455ec3b1e3e3e9117c81b186092228525fac

C:\Users\Admin\Downloads\MLG.Dbdy1EfY.rar.part

MD5 46bb190b41d6959b3e9c538e05134308
SHA1 cb682c4b15aa6212599d3be31c1fa0356f67909a
SHA256 6d3d4fab38568a4b06dde14a1f6f59902ba3a548b1da437f68541be82e16b152
SHA512 666d7d2bb3209c1cd1182f0ca826c4de488c1d58a9ddae703273fec64b7389ed96d69a68e7f74ef8858101def35075562fc2e568c37524f76f8f8851062e31d7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\prefs-1.js

MD5 f7625317ba43441c17c8f172dd0546b9
SHA1 3b54916796416f54c1490ef3d3245a826d3dc84e
SHA256 c3d7437ef04deb1f141cbbe17c66fb8ad031cf8fb6f036429a7afbac824cdb35
SHA512 ba23b3d455c2b5bacb74e2830a65bb4c6dcebd1474a5102de296a4a6d7b4862f21bd0b83935440f7129443731b6b3c4f284cb9b4d1f6a4abd510a5a0277b831b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\sessionstore-backups\recovery.jsonlz4

MD5 6a91814421ee083c38befe17b691e5e1
SHA1 84584fe3274374f479c2483659c01f3a32ea65cf
SHA256 374933866c96d49d9c80ead9da6c2f6843904978b0f27bd955b5bdc16a8733b0
SHA512 a7e2e5887543dd5090c05333460cd7032d20405634549430a333ba90b12111059767a71f1aec5ca813ed37d27632fe6671cdb855e810eb9b3c9dd3b1a8df6bba

C:\Users\Admin\Downloads\QhVeWCbe.txt.part

MD5 73260f26eceb865bdcdd0c6dcb048734
SHA1 d6151f79bcc9cf4cdc1eaa856aee48ebeed5e6dd
SHA256 feeda441eef6bb3787db9dccfebf00f70ef30f5881ff2cb089f3e1dbc06d0c30
SHA512 2104cefa4087c91238a21b094f26bd48d188d6c40488b68c9656d47e1853a50533a4e5b2abda5b922572e01f60aee3b7d7e594c0f7e3491c3afe8f2fffbb5b4a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\sessionstore-backups\recovery.jsonlz4

MD5 d155b2148de36d157e8aeff21759e51c
SHA1 3618312aeb956d4c6e09c8c60e41cdaa3bdc6709
SHA256 22b7da918a0c7a14ac8f1f055a2573fbe49f4717f0e19003f43edd5a8c671c1f
SHA512 e45a8105d121ac0eb35b78cb5a68f0b4936e3a173e402b6bf70226b3d774e1ed4a885a54fb7882ee0d2d5ece0a61c82fbb153a3d5b0fd9014548142e49dfa117

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\sessionstore-backups\recovery.jsonlz4

MD5 6a5de58ef838f4a3f7845fd96b4243e3
SHA1 96d72dd483b1cefc938a9cd6a37ac88f0e7f5dfe
SHA256 0542d9b2878b0dc2d4f48cf0cb131b4b687f2acd8a80127bfd8c322e89dd6041
SHA512 b8cc3c2ae7e285021e02c7dde8b9ea23625cd844cc0f280003a3e0300cb8d5d71419945bd0ff8adfea9859165c9113ca2c8edcd858484fd1d7c1f87b0aa453fc

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\sessionstore-backups\recovery.jsonlz4

MD5 7ad5a1833f5ae41b94af83c878e2d5c0
SHA1 ebdf5c4ea3d361b2be515dc5ce4d1b75a251ac49
SHA256 22fa07c9e34504642fac2ca5ee2bbae8d228e3a345d0cf6791725b091d8eb5b2
SHA512 baa00f61319b707f8effb359546365d4ffab822775dd18a273d796923c9200bfa4944a82c41b624d948b2d9830037ba38c6e62664065b7d831e4c76ed9f57ba9

C:\Users\Admin\Downloads\MLG.rar

MD5 7c7fb86210ab287c5b1b8da0e493818e
SHA1 fd0c9501f63ab40ad21b18f744c0ab126407b305
SHA256 adad0eaee2468fbff99e0089b10b1afec28044a67c100bc70c90f24782a778fe
SHA512 d5e19368b06b73700e1f5b1bbd962ee5ef0293c8eea6f70ef2fe38681c2101f22b5ef6ad42208a0a1439e0435dd830cd94f673cb1756f0a078a181d94e7ec90b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\sessionstore-backups\recovery.jsonlz4

MD5 72125f59ec12ff72462e8a9067d7dcc9
SHA1 4bbdd6d6ad16c3eb6474265ec3dcf872b0515eb6
SHA256 c4028a575b1dda606bceff142e17c1285838da7acb0389f0eb0fd189e0fc5af6
SHA512 3628bee1728640c925f0e75f50609fc8d465b42543b208d89554925b2684e62a0b2ce56b20f0087ec0828898ede5c11d5f6c182cf9073c5278f273d3618c44df

C:\Users\Admin\AppData\Local\Temp\7zO45A0584A\MLG.exe

MD5 634728f2fe391f5369bf655cc7c2b482
SHA1 9da51bfb54343dc4d9220c3bb785dd2a1ea7c17e
SHA256 f6d1641642cebcdbef6bb2f110d0e3c6b592679d18f9dea71ac484c518417ea8
SHA512 07d0d3ec375e441e128bc9c5d2067f983bee1967e3075c3b76ddc5339ecccaf28fe2d626bb237ea2ba1aac475136c8be33a7e11a61286a70406fae95cf90e3ad

memory/1636-2807-0x000002CE63FB0000-0x000002CE64E08000-memory.dmp

memory/1636-2806-0x00007FFE94620000-0x00007FFE9500C000-memory.dmp

memory/1636-2808-0x000002CE66A60000-0x000002CE66A70000-memory.dmp

memory/1636-2816-0x000002CE66A60000-0x000002CE66A70000-memory.dmp

memory/1636-2825-0x00007FFE94620000-0x00007FFE9500C000-memory.dmp

memory/1636-2826-0x000002CE66A60000-0x000002CE66A70000-memory.dmp

memory/1636-2829-0x000002CE66A60000-0x000002CE66A70000-memory.dmp

memory/1636-2832-0x000002CE66A60000-0x000002CE66A70000-memory.dmp

memory/1636-2845-0x000002CE66A60000-0x000002CE66A70000-memory.dmp

memory/1636-2868-0x000002CE66A60000-0x000002CE66A70000-memory.dmp

memory/1636-2880-0x000002CE66A60000-0x000002CE66A70000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 fe11eebeed07c9c95ad284ebe203d402
SHA1 754eecbc7cbc18079cc06313ec352c99f5a16665
SHA256 b15fbd0d570c5642b162867c4c027dd6a83284d011522bf523ad1a4c1e345c13
SHA512 9950679c04297f3328b24cd1d53e9fb89527ca6d8c2d4e9e6e48b47f379ff85b73af53cf500a4b7f0f89879bbbdd3ec13b0bf9af1a1deb05436c774aac196342