hxxps://central-executor[.]com/

Analysis

max time kernel
550s
max time network
553s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
25-04-2024 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://central-executor.com/

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 15 IoCs

pid	Process
4548	Central Executor_05018736.exe
5052	setup05018736.exe
1200	setup05018736.exe
4024	OfferInstaller.exe
5556	7z2301-x64.exe
1812	7z.exe
5712	7z.exe
1408	7z.exe
3876	7z.exe
4684	7z.exe
1896	7z.exe
3160	7z.exe
1008	7zFM.exe
4224	central.exe
2856	central.exe

Loads dropped DLL 64 IoCs

pid	Process
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe
1200	setup05018736.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2301-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
5280	timeout.exe
5340	timeout.exe
5416	timeout.exe
1928	timeout.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

Process Discovery

T1057

pid	Process
844	tasklist.exe
5232	tasklist.exe
5296	tasklist.exe
5372	tasklist.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings	Central Executor_05018736.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\MRUListEx = ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Applications\7z.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7z.exe\" \"%1\""	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Key created	\Registry\User\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\NotificationData	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2301-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Applications\7z.exe\shell\open	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2301-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Central 1.2.rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Central Executor_05018736.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\7z2301-x64.exe:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5452	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
5052	setup05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
4024	OfferInstaller.exe
4024	OfferInstaller.exe
4024	OfferInstaller.exe
4024	OfferInstaller.exe
4024	OfferInstaller.exe
4024	OfferInstaller.exe
4024	OfferInstaller.exe
4024	OfferInstaller.exe
4024	OfferInstaller.exe
4224	central.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5516	OpenWith.exe
1008	7zFM.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	1832	firefox.exe
Token: SeDebugPrivilege	1832	firefox.exe
Token: SeDebugPrivilege	5052	setup05018736.exe
Token: SeDebugPrivilege	4024	OfferInstaller.exe
Token: SeDebugPrivilege	844	tasklist.exe
Token: SeDebugPrivilege	5232	tasklist.exe
Token: SeDebugPrivilege	5296	tasklist.exe
Token: SeDebugPrivilege	5372	tasklist.exe
Token: SeDebugPrivilege	5452	NOTEPAD.EXE
Token: SeDebugPrivilege	1832	firefox.exe
Token: SeDebugPrivilege	1832	firefox.exe
Token: SeDebugPrivilege	1832	firefox.exe
Token: SeDebugPrivilege	1832	firefox.exe
Token: SeDebugPrivilege	1832	firefox.exe
Token: SeDebugPrivilege	1832	firefox.exe
Token: SeDebugPrivilege	1832	firefox.exe
Token: SeDebugPrivilege	1832	firefox.exe
Token: SeDebugPrivilege	1832	firefox.exe
Token: SeDebugPrivilege	1832	firefox.exe
Token: SeDebugPrivilege	1832	firefox.exe
Token: SeDebugPrivilege	1832	firefox.exe
Token: SeDebugPrivilege	1832	firefox.exe
Token: SeDebugPrivilege	1832	firefox.exe
Token: SeDebugPrivilege	1832	firefox.exe
Token: SeDebugPrivilege	1832	firefox.exe
Token: SeDebugPrivilege	5556	7z2301-x64.exe
Token: SeDebugPrivilege	5556	7z2301-x64.exe
Token: SeDebugPrivilege	5556	7z2301-x64.exe
Token: SeDebugPrivilege	5556	7z2301-x64.exe
Token: SeDebugPrivilege	5556	7z2301-x64.exe
Token: SeDebugPrivilege	1832	firefox.exe
Token: SeRestorePrivilege	1812	7z.exe
Token: 35	1812	7z.exe
Token: SeRestorePrivilege	5712	7z.exe
Token: 35	5712	7z.exe
Token: SeRestorePrivilege	1408	7z.exe
Token: 35	1408	7z.exe
Token: SeRestorePrivilege	3876	7z.exe
Token: 35	3876	7z.exe
Token: SeRestorePrivilege	4684	7z.exe
Token: 35	4684	7z.exe
Token: SeRestorePrivilege	1896	7z.exe
Token: 35	1896	7z.exe
Token: SeRestorePrivilege	3160	7z.exe
Token: 35	3160	7z.exe
Token: SeRestorePrivilege	1008	7zFM.exe
Token: 35	1008	7zFM.exe
Token: SeSecurityPrivilege	1008	7zFM.exe
Token: SeDebugPrivilege	4224	central.exe
Token: SeDebugPrivilege	2856	central.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1008	7zFM.exe
1008	7zFM.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe

Suspicious use of SetWindowsHookEx 56 IoCs

pid	Process
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
4548	Central Executor_05018736.exe
4548	Central Executor_05018736.exe
5052	setup05018736.exe
4548	Central Executor_05018736.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
5556	7z2301-x64.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
3836	OpenWith.exe
3836	OpenWith.exe
3836	OpenWith.exe
3836	OpenWith.exe
3836	OpenWith.exe
3836	OpenWith.exe
3836	OpenWith.exe
5516	OpenWith.exe
5516	OpenWith.exe
5516	OpenWith.exe
5516	OpenWith.exe
5516	OpenWith.exe
5516	OpenWith.exe
5516	OpenWith.exe
5516	OpenWith.exe
5516	OpenWith.exe
5516	OpenWith.exe
5516	OpenWith.exe
5516	OpenWith.exe
5516	OpenWith.exe
5516	OpenWith.exe
5516	OpenWith.exe
5516	OpenWith.exe
5516	OpenWith.exe
5516	OpenWith.exe
5516	OpenWith.exe
5516	OpenWith.exe
804	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1832	1964	firefox.exe	80
PID 1964 wrote to memory of 1832	1964	firefox.exe	80
PID 1964 wrote to memory of 1832	1964	firefox.exe	80
PID 1964 wrote to memory of 1832	1964	firefox.exe	80
PID 1964 wrote to memory of 1832	1964	firefox.exe	80
PID 1964 wrote to memory of 1832	1964	firefox.exe	80
PID 1964 wrote to memory of 1832	1964	firefox.exe	80
PID 1964 wrote to memory of 1832	1964	firefox.exe	80
PID 1964 wrote to memory of 1832	1964	firefox.exe	80
PID 1964 wrote to memory of 1832	1964	firefox.exe	80
PID 1964 wrote to memory of 1832	1964	firefox.exe	80
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1864	1832	firefox.exe	81
PID 1832 wrote to memory of 1652	1832	firefox.exe	82
PID 1832 wrote to memory of 1652	1832	firefox.exe	82
PID 1832 wrote to memory of 1652	1832	firefox.exe	82
PID 1832 wrote to memory of 1652	1832	firefox.exe	82
PID 1832 wrote to memory of 1652	1832	firefox.exe	82
PID 1832 wrote to memory of 1652	1832	firefox.exe	82
PID 1832 wrote to memory of 1652	1832	firefox.exe	82
PID 1832 wrote to memory of 1652	1832	firefox.exe	82
PID 1832 wrote to memory of 1652	1832	firefox.exe	82
PID 1832 wrote to memory of 1652	1832	firefox.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://central-executor.com/"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://central-executor.com/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1832.0.999844758\1004270463" -parentBuildID 20230214051806 -prefsHandle 1788 -prefMapHandle 1780 -prefsLen 22035 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {66bdb3cc-9889-4ff1-8862-097dcbaf3fbb} 1832 "\\.\pipe\gecko-crash-server-pipe.1832" 1880 1d07f40c458 gpu
    3⤵
    PID:1864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1832.1.1492315471\632879627" -parentBuildID 20230214051806 -prefsHandle 2412 -prefMapHandle 2400 -prefsLen 22886 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac053f8b-cb09-411d-ba75-def09366e929} 1832 "\\.\pipe\gecko-crash-server-pipe.1832" 2424 1d072789358 socket
    3⤵
    - Checks processor information in registry
    PID:1652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1832.2.1330024880\912193979" -childID 1 -isForBrowser -prefsHandle 2852 -prefMapHandle 2876 -prefsLen 22924 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99e01e8e-b11e-4347-a1ba-71c7ac68c186} 1832 "\\.\pipe\gecko-crash-server-pipe.1832" 3024 1d00252fb58 tab
    3⤵
    PID:3808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1832.3.1702405477\2125443352" -childID 2 -isForBrowser -prefsHandle 3808 -prefMapHandle 3800 -prefsLen 27575 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {12bf9788-452e-4503-8868-2755b085c404} 1832 "\\.\pipe\gecko-crash-server-pipe.1832" 3832 1d005205c58 tab
    3⤵
    PID:388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1832.4.596321193\1368024456" -childID 3 -isForBrowser -prefsHandle 5288 -prefMapHandle 5284 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f747f1cc-e546-4042-809b-0eb01ec664cb} 1832 "\\.\pipe\gecko-crash-server-pipe.1832" 5296 1d006e1bb58 tab
    3⤵
    PID:3876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1832.5.1642460511\546243140" -childID 4 -isForBrowser -prefsHandle 5124 -prefMapHandle 5072 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1acbacd-7605-4304-9bf5-a3f813a72951} 1832 "\\.\pipe\gecko-crash-server-pipe.1832" 5400 1d007bdd258 tab
    3⤵
    PID:5080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1832.6.59609212\61882882" -childID 5 -isForBrowser -prefsHandle 5612 -prefMapHandle 5616 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d24f7b78-3377-460f-ae05-f10a141d199d} 1832 "\\.\pipe\gecko-crash-server-pipe.1832" 5604 1d007bdea58 tab
    3⤵
    PID:4492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1832.7.1728776353\934664512" -childID 6 -isForBrowser -prefsHandle 2768 -prefMapHandle 4184 -prefsLen 28228 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {704c629f-e065-48b9-9639-e990508ea2fa} 1832 "\\.\pipe\gecko-crash-server-pipe.1832" 5928 1d0068fc058 tab
    3⤵
    PID:1812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1832.8.249191139\1110238886" -childID 7 -isForBrowser -prefsHandle 6180 -prefMapHandle 6184 -prefsLen 28228 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {08b4e75a-951f-41b9-80e3-12393214e477} 1832 "\\.\pipe\gecko-crash-server-pipe.1832" 6172 1d006ae6e58 tab
    3⤵
    PID:4944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1832.9.1252706363\516280757" -childID 8 -isForBrowser -prefsHandle 2904 -prefMapHandle 2920 -prefsLen 28228 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f47c5ec0-6ace-4ec4-ab95-5c5ba63c3b8d} 1832 "\\.\pipe\gecko-crash-server-pipe.1832" 3208 1d005211958 tab
    3⤵
    PID:1472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1832.10.1893228644\976422479" -childID 9 -isForBrowser -prefsHandle 3824 -prefMapHandle 4996 -prefsLen 28493 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e6ca3ba-062a-4f9f-8769-e76773c2d528} 1832 "\\.\pipe\gecko-crash-server-pipe.1832" 2736 1d0012b0058 tab
    3⤵
    PID:1596
- - C:\Users\Admin\Downloads\Central Executor_05018736.exe
    "C:\Users\Admin\Downloads\Central Executor_05018736.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4548
  - - C:\Users\Admin\AppData\Local\setup05018736.exe
      C:\Users\Admin\AppData\Local\setup05018736.exe hhwnd=262716 hreturntoinstaller hextras=id:d8d090d10951db6-AU-oK3im
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4024
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""
        6⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "PID eq 4024" /fo csv
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5232
        
        C:\Windows\SysWOW64\find.exe
        
        find /I "4024"
        7⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        7⤵
        Delays execution with timeout.exe
        
        PID:5280
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "PID eq 4024" /fo csv
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5296
        
        C:\Windows\SysWOW64\find.exe
        
        find /I "4024"
        7⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        7⤵
        Delays execution with timeout.exe
        
        PID:5340
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "PID eq 4024" /fo csv
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5372
        
        C:\Windows\SysWOW64\find.exe
        
        find /I "4024"
        7⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 5
        7⤵
        Delays execution with timeout.exe
        
        PID:5416
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""
        5⤵
        
        PID:3144
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "PID eq 5052" /fo csv
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:844
      - C:\Windows\SysWOW64\find.exe
        
        find /I "5052"
        6⤵
        
        PID:1728
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 5
        6⤵
        Delays execution with timeout.exe
        
        PID:1928
  - - C:\Users\Admin\AppData\Local\setup05018736.exe
      C:\Users\Admin\AppData\Local\setup05018736.exe hready
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1200
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt
      4⤵
      Opens file in notepad (likely ransom note)
      Suspicious use of AdjustPrivilegeToken
      PID:5452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1832.11.752588089\336432842" -childID 10 -isForBrowser -prefsHandle 6196 -prefMapHandle 6120 -prefsLen 28804 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a28255f-6fc6-461e-a0e6-490f2db378c1} 1832 "\\.\pipe\gecko-crash-server-pipe.1832" 6128 1d0068fa858 tab
    3⤵
    PID:3160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1832.12.150099349\1692779687" -childID 11 -isForBrowser -prefsHandle 5544 -prefMapHandle 6176 -prefsLen 28804 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59ed72a6-d33d-496c-a291-b89edd60fd05} 1832 "\\.\pipe\gecko-crash-server-pipe.1832" 6216 1d006ae8f58 tab
    3⤵
    PID:5260
- - C:\Users\Admin\Downloads\7z2301-x64.exe
    "C:\Users\Admin\Downloads\7z2301-x64.exe"
    3⤵
    - Executes dropped EXE
    - Registers COM server for autorun
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5556

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1056

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3836

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5516
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Desktop\Central 1.2.rar"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1812

C:\Program Files\7-Zip\7z.exe
"C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Desktop\Central 1.2.rar"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5656

C:\Program Files\7-Zip\7z.exe
"C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Desktop\Central 1.2.rar"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1408

C:\Program Files\7-Zip\7z.exe
"C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Desktop\Central 1.2.rar"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3876

C:\Program Files\7-Zip\7z.exe
"C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Desktop\Central 1.2.rar"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Program Files\7-Zip\7z.exe
"C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Desktop\Central 1.2.rar"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Program Files\7-Zip\7z.exe
"C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Desktop\Central 1.2.rar"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3160

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\Central 1.2.rar"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1008

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:804

C:\Users\Admin\Desktop\Central 1.2\central.exe
"C:\Users\Admin\Desktop\Central 1.2\central.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Users\Admin\Desktop\Central 1.2\central.exe
"C:\Users\Admin\Desktop\Central 1.2\central.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FF

Filesize
812B

MD5
ec95ba152315371a12b61e59736ef2af

SHA1
5420ca8697ddefc184f61745f4737305a68a4e75

SHA256
55c56ef40fb19a4cf6d03acd5c5232286fe429d79e0f619701f32d51a5428198

SHA512
ecb8c92181c02083b06272b5d92acbbc51abcd3eee7e42e06d8df77fb2e4240d5fd2f5a1a084dc9c4f7945218fadc1f6a4532145c12dbc1887961cee79f19be9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D

Filesize
1KB

MD5
ab73abce648517476f9a7a4e3be79c3d

SHA1
36de2bd3bfb86ab4a48c8ea885736f9080b361e6

SHA256
183b5d1a91ccb92b83845832dd6c0225b9fbae2854e46b702735f49bfb977143

SHA512
fb599b26b2e5937027035ca73a765cf8e97d6f8ba94d2361213b4f2203e365b0072fb3392b1543267ce3a3b6ec979fcb07bf9482f213c2b699dec209196475a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FF

Filesize
540B

MD5
8b0940f12c30ce69ea75e017437fed69

SHA1
a3025016c4646fb327ef12d2bbbd2ec45f68f17b

SHA256
193e41e2779f77771a895cf2c067638142bff5c13a44eeb23c7b1058a04a5feb

SHA512
536e77ed8d5d1b334cdbd83853cac3619732f73089b2f41cb3d754ad15cafaf79e4c61e6bfae15a3f22a77b6c66bb99388db6fe63565c63ca10f06e62f0cfb94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D

Filesize
528B

MD5
8651499c7dab97a86c63cea90129660f

SHA1
d4c42e924f262760a3aed9f795d8d9f9899741af

SHA256
1b871504d9252307f45ffae8bb93046f27534973917caa57bba7453230b2b049

SHA512
3f65a6dc00b2f687f0bcf239203fdc4455a80fe071a8d0b211810d0cbbf5de424074bebe9b24e7586853fde8297ccd200dd6532c75dbce3cfc2d8f8e6814cf6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
e161f3449d88ed589cf560f2a3822be2

SHA1
22c5f34a9a4b82ed1af5cbc278835799a733d928

SHA256
1f14718334b43dd8a92369e379c6acc1a8cbe9aac21788de668553a93ab3d20b

SHA512
dab40336917b7d6d84051eac6fe71cb7b8bab1b62a2d46eadd5b8a32ceaa46f8eaafd063b82f6b461837ff2c0f2ae036b58f7c7f1adb1771f97afe43a0977c9f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\activity-stream.discovery_stream.json.tmp

Filesize
26KB

MD5
d387a8e89e988cdad6347ddf9144752d

SHA1
8b27c03dbc2ee32594ffeb25fafed7437964352f

SHA256
4393f2a30004ad621f33c311f9f0c9a057bc070fdde96ff92ca85c97fbddae88

SHA512
727b3b2437550be3e72bc6c081f2fb401acc5fea3d09f76fd343f73923a954ea548e3e76f531fc627ad122577cca3f8493d04e1de0ccf8a662f716381dc793af

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\cache2\entries\219CDD362BBACDB78C8056F40E811330344CC293

Filesize
51KB

MD5
58258e16e6af4ce65593f62f3205c1fe

SHA1
c3f02fb8f6e326f7f900ae011d712f68e906eebc

SHA256
ad5258b60bc560f4f60055eff39c01c26db4d05b1b5c146fe94f812f9597accc

SHA512
9f960886fecd3317820e5978f816111d1acb6ebf21e26aedf773e9a2001153740e52b7928914652f04c3435679e798b8d239c6616793a290d02d50a07801057f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\cache2\entries\8F0C9277206D9582868BA32634A29AD866EAA7D3

Filesize
26KB

MD5
e14b4f2d54645a25b248136d2448241d

SHA1
e602d5cad79e8401e4177b20018141c1e0e057eb

SHA256
65045edf98c31a4251d54f2b70be3066c450b04c3a32b5142c307317ed629d33

SHA512
64c6f6317e6249e049a087c24d6c815d6595f861e30f69b657ad4b025c0882598ceeafbc94a656fa4c892187a7be2b774cf690c752af038ee3bb076c184ec41c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\cache2\entries\B231951ED82AAA413478C0C1CAEF5D586948A47E

Filesize
22KB

MD5
1587ae24d599c3b05c692567a98d76eb

SHA1
9a31a0f527bded7ebec4110c9e733570f56f66ce

SHA256
5a07ac49b7d90737e63c19477b93f42278bc33b20ca99920cd61e119e2e37d7f

SHA512
3af13908b0fd75ffcd928e237e332e8922d468d7e3910cecabe9b06d8f4797bba20f655eadb31bdf99461d75db8998162a0116b8eae70fc805350bf70a79487d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\cache2\entries\C72D4296C2EBC6FD41A9F780CD0C8F30F0FF937C

Filesize
13KB

MD5
6733b35b21d1dfdc1b1a688a147de830

SHA1
bcbcd3cacd9d9c50400baff4692869f4a60537fd

SHA256
63db351e17c8ee4b167beaf1fd1323d84db483ed2487022f26488e611569dec4

SHA512
9f99c6f98cfe02b9da42f05e62cd63f701930927b421bc6126772cd2f21999fcda1b636d66a487864a4449c50375f9af87683fba420294f08a11531a18b0f0be

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\cache2\entries\CC9AFF3BE02AD27708D587AE49B3DC68644172BA

Filesize
13KB

MD5
1c97becdefe6cc2b1d8dafeb212499dd

SHA1
f785a8efc2b56a6b8307465ed6220d34528bcd4c

SHA256
852d332ba49430521461b05752176e513223ced8234d371ec2fb83e4e2306a46

SHA512
60d0aa157929fee876a2c5aa1390d11f5020a9fd05d9e384e1d089be4e910a137c8cf3ba81b047e8ab81cf81734a82a10a6eddb311065e360b3aa7c2ad180e9a

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
5b431d6f7e2b9ad35ba13b2d16cb21e3

SHA1
db0a9b00ca39f14ee5be3269b8527bdf65ae2fc1

SHA256
63e00add8cd4078903228714758131588a3f1165a916bfc66e1a82076558acd0

SHA512
f27f5b3c9c23adaf50ff44e0b2af4dd121038ed4bd5ebc0b8d63094b4266a151edf94214ce85990d8e545f1f4b8b288539b7d8003979deb24629825f5b966183

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
e51dafe414a652360bb13068cb89f30e

SHA1
70cf874ffedbb7dc2422530261193fd6a0b6271c

SHA256
58e87eb01269c20618026620782ab6409efe3fc42607a9d9c380823b661d37e7

SHA512
bc894af738c4270b0293b2b49e897c74e5a8777c90a6f11a158f5c1e8b3dd9179f05a884e3d9768fe1f1b1979f92df9b19e2df5c05cf21d36949e092051f072a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.LastScreen.dll

Filesize
57KB

MD5
6e001f8d0ee4f09a6673a9e8168836b6

SHA1
334ad3cf0e4e3c03415a4907b2d6cf7ba4cbcd38

SHA256
6a30f9c604c4012d1d2e1ba075213c378afb1bfcb94276de7995ed7bbf492859

SHA512
0eff2e6d3ad75abf801c2ab48b62bc93ebc5a128d2e03e507e6e5665ff9a2ab58a9d82ca71195073b971f8c473f339baffdd23694084eaaff321331b5faaecf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.dll

Filesize
117KB

MD5
08112f27dcd8f1d779231a7a3e944cb1

SHA1
39a98a95feb1b6295ad762e22aa47854f57c226f

SHA256
11c6a8470a3f2b2be9b8cafe5f9a0afce7303bfd02ab783a0f0ee09a184649fa

SHA512
afd0c7df58b63c7cfdbedea7169a1617f2ac4bad07347f8ed7757a25ab0719489d93272109b73a1b53e9c5997dedad8da89da7b339d30fc2573ca2f76c630ddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OCommonResources.dll

Filesize
5.7MB

MD5
38cc1b5c2a4c510b8d4930a3821d7e0b

SHA1
f06d1d695012ace0aef7a45e340b70981ca023ba

SHA256
c2ba8645c5c9507d422961ceaeaf422adf6d378c2a7c02199ed760fb37a727f2

SHA512
99170f8094f61109d08a6e7cf25e7fba49160b0009277d10e9f0b9dac6f022e7a52e3d822e9aee3f736c2d285c4c3f62a2e6eb3e70f827ac6e8b867eea77f298

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2ODAL.dll

Filesize
15KB

MD5
422be1a0c08185b107050fcf32f8fa40

SHA1
c8746a8dad7b4bf18380207b0c7c848362567a92

SHA256
723aea78755292d2f4f87ad100a99b37bef951b6b40b62e2e2bbd4df3346d528

SHA512
dff51c890cb395665839070d37170d321dc0800981a42f173c6ea570684460146b4936af9d8567a6089bef3a7802ac4931c14031827689ef345ea384ceb47599

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OModels.dll

Filesize
75KB

MD5
c06ac6dcfa7780cd781fc9af269e33c0

SHA1
f6b69337b369df50427f6d5968eb75b6283c199d

SHA256
b23b8310265c14d7e530b80defc6d39cdc638c07d07cd2668e387863c463741d

SHA512
ad167ad62913243e97efaeaa7bad38714aba7fc11f48001974d4f9c68615e9bdfb83bf623388008e77d61cee0eaba55ce47ebbb1f378d89067e74a05a11d9fe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OResources.dll

Filesize
19KB

MD5
554c3e1d68c8b5d04ca7a2264ca44e71

SHA1
ef749e325f52179e6875e9b2dd397bee2ca41bb4

SHA256
1eb0795b1928f6b0459199dace5affdc0842b6fba87be53ca108661275df2f3e

SHA512
58ce13c47e0daf99d66af1ea35984344c0bb11ba70fe92bc4ffa4cd6799d6f13bcad652b6883c0e32c6e155e9c1b020319c90da87cb0830f963639d53a51f9c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OServices.dll

Filesize
160KB

MD5
6df226bda27d26ce4523b80dbf57a9ea

SHA1
615f9aba84856026460dc54b581711dad63da469

SHA256
17d737175d50eee97ac1c77db415fe25cc3c7a3871b65b93cc3fad63808a9abc

SHA512
988961d7a95c9883a9a1732d0b5d4443c790c38e342a9e996b072b41d2e8686389f36a249f2232cb58d72f8396c849e9cc52285f35071942bec5c3754b213dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OUtilities.dll

Filesize
119KB

MD5
9d2c520bfa294a6aa0c5cbc6d87caeec

SHA1
20b390db533153e4bf84f3d17225384b924b391f

SHA256
669c812cb8f09799083014a199b0deee10237c95fb49ee107376b952fee5bd89

SHA512
7e2e569549edb6ddd2b0cb0012386aed1f069e35d1f3045bb57704ef17b97129deb7cde8e23bc49980e908e1a5a90b739f68f36a1d231b1302a5d29b722e7c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OViewModels.dll

Filesize
8KB

MD5
be4c2b0862d2fc399c393fca163094df

SHA1
7c03c84b2871c27fa0f1914825e504a090c2a550

SHA256
c202e4f92b792d34cb6859361aebdbfc8c61cf9e735edfd95e825839920fb88a

SHA512
d9c531687a5051bbfe5050c5088623b3fd5f20b1e53dd4d3ed281c8769c15f45da36620231f6d0d76f8e2aa7de00c2324a4bf35a815cefc70ca97bc4ab253799

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\HtmlAgilityPack.dll

Filesize
154KB

MD5
17220f65bd242b6a491423d5bb7940c1

SHA1
a33fabf2b788e80f0f7f84524fe3ed9b797be7ad

SHA256
23056f14edb6e0afc70224d65de272a710b5d26e6c3b9fe2dfd022073050c59f

SHA512
bfbe284a2ee7361ada9a9cb192580fd64476e70bc78d14e80ad1266f7722a244d890600cf24bfb83d4914e2434272679ba177ee5f98c709950e43192f05e215e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\MyDownloader.Core.dll

Filesize
56KB

MD5
f931e960cc4ed0d2f392376525ff44db

SHA1
1895aaa8f5b8314d8a4c5938d1405775d3837109

SHA256
1c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870

SHA512
7fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\MyDownloader.Extension.dll

Filesize
168KB

MD5
28f1996059e79df241388bd9f89cf0b1

SHA1
6ad6f7cde374686a42d9c0fcebadaf00adf21c76

SHA256
c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce

SHA512
9654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Newtonsoft.Json.dll

Filesize
541KB

MD5
9de86cdf74a30602d6baa7affc8c4a0f

SHA1
9c79b6fbf85b8b87dd781b20fc38ba2ac0664143

SHA256
56032ade45ccf8f4c259a2e57487124cf448a90bca2eeb430da2722d9e109583

SHA512
dca0f6078df789bb8c61ffb095d78f564bfc3223c6795ec88aeb5f132c014c5e3cb1bd8268f1e5dc96d7302c7f3de97e73807f3583cb4a320d7adbe93f432641

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Ninject.dll

Filesize
133KB

MD5
8db691813a26e7d0f1db5e2f4d0d05e3

SHA1
7c7a33553dd0b50b78bf0ca6974c77088da253eb

SHA256
3043a65f11ac204e65bca142ff4166d85f1b22078b126b806f1fecb2a315c701

SHA512
d02458180ec6e6eda89b5b0e387510ab2fad80f9ce57b8da548aaf85c34a59c39afaeacd1947bd5eb81bee1f6d612ca57d0b2b756d64098dfc96ca0bf2d9f62f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe

Filesize
26KB

MD5
cef027c3341afbcdb83c72080df7f002

SHA1
e538f1dd4aee8544d888a616a6ebe4aeecaf1661

SHA256
e87db511aa5b8144905cd24d9b425f0d9a7037fface3ca7824b7e23cfddbbbb7

SHA512
71ba423c761064937569922f1d1381bd11d23d1d2ed207fc0fead19e9111c1970f2a69b66e0d8a74497277ffc36e0fc119db146b5fd068f4a6b794dc54c5d4bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferSDK.dll

Filesize
172KB

MD5
b199dcd6824a02522a4d29a69ab65058

SHA1
f9c7f8c5c6543b80fa6f1940402430b37fa8dce4

SHA256
9310a58f26be8bd453cde5ca6aa05042942832711fbdeb5430a2840232bfa5e4

SHA512
1d3e85e13ff24640c76848981ca84bafb32f819a082e390cb06fe13445814f50f8e3fc3a8a8e962aae8867e199c1517d570c07f28d5f7e5f007b2bb6e664ddb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\tis\Config.tis

Filesize
291B

MD5
bf5328e51e8ab1211c509b5a65ab9972

SHA1
480dfb920e926d81bce67113576781815fbd1ea4

SHA256
98f22fb45530506548ae320c32ee4939d27017481d2ad0d784aa5516f939545b

SHA512
92bd7895c5ff8c40eecfdc2325ee5d1fb7ed86ce0ef04e8e4a65714fcf5603ea0c87b71afadb473433abb24f040ccabd960fa847b885322ad9771e304b661928

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\SciterWrapper.dll

Filesize
134KB

MD5
105a9e404f7ac841c46380063cc27f50

SHA1
ec27d9e1c3b546848324096283797a8644516ee3

SHA256
69fe749457218ec9a765f9aac74caf6d4f73084cf5175d3fd1e4f345af8b3b8b

SHA512
6990cbfc90c63962abde4fdaae321386f768be9fcf4d08bccd760d55aba85199f7a3e18bd7abe23c3a8d20ea9807cecaffb4e83237633663a8bb63dd9292d940

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.Net.dll

Filesize
101KB

MD5
83d37fb4f754c7f4e41605ec3c8608ea

SHA1
70401de8ce89f809c6e601834d48768c0d65159f

SHA256
56db33c0962b3c34cba5279d2441bc4c12f28b569eadc1b3885dd0951b2c4020

SHA512
f5f3479f485b1829bbfb7eb8087353aee569184f9c506af15c4e28bfe4f73bf2cc220d817f6dfc34b2a7a6f69453f0b71e64b79c4d500ff9a243799f68e88b9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.dll

Filesize
151KB

MD5
72990c7e32ee6c811ea3d2ea64523234

SHA1
a7fcbf83ec6eefb2235d40f51d0d6172d364b822

SHA256
e77e0b4f2762f76a3eaaadf5a3138a35ec06ece80edc4b3396de7a601f8da1b3

SHA512
2908b8c387d46b6329f027bc1e21a230e5b5c32460f8667db32746bc5f12f86927faa10866961cb2c45f6d594941f6828f9078ae7209a27053f6d11586fd2682

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\app.ico

Filesize
766B

MD5
4003efa6e7d44e2cbd3d7486e2e0451a

SHA1
a2a9ab4a88cd4732647faa37bbdf726fd885ea1e

SHA256
effd42c5e471ea3792f12538bf7c982a5cda4d25bfbffaf51eed7e09035f4508

SHA512
86e71ca8ca3e62949b44cfbc7ffa61d97b6d709fc38216f937a026fb668fbb1f515bac2f25629181a82e3521dafa576cac959d2b527d9cc9eb395e50d64c1198

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\msvcp140.dll

Filesize
426KB

MD5
8ff1898897f3f4391803c7253366a87b

SHA1
9bdbeed8f75a892b6b630ef9e634667f4c620fa0

SHA256
51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad

SHA512
cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\sciter32.dll

Filesize
5.6MB

MD5
b431083586e39d018e19880ad1a5ce8f

SHA1
3bbf957ab534d845d485a8698accc0a40b63cedd

SHA256
b525fdcc32c5a359a7f5738a30eff0c6390734d8a2c987c62e14c619f99d406b

SHA512
7805a3464fcc3ac4ea1258e2412180c52f2af40a79b540348486c830a20c2bbed337bbf5f4a8926b3ef98c63c87747014f5b43c35f7ec4e7a3693b9dbd0ae67b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\vcruntime140.dll

Filesize
74KB

MD5
1a84957b6e681fca057160cd04e26b27

SHA1
8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe

SHA256
9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5

SHA512
5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Local\setup05018736.exe

Filesize
3.8MB

MD5
29d3a70cec060614e1691e64162a6c1e

SHA1
ce4daf2b1d39a1a881635b393450e435bfb7f7d1

SHA256
cc70b093a19610e9752794d757aec9ef07ca862ea9267ec6f9cc92b2aa882c72

SHA512
69d07437714259536373872e8b086fc4548f586e389f67e50f56d343e980546f92b8a13f28c853fc1daf187261087a9dceb33769ba2031c42382742d86c60e4b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\downloads.json.tmp

Filesize
646B

MD5
b5116726b264f2a7db6eec7e9ef3e3bf

SHA1
3c550502f8b88ff56dc2943d2934d2c0fc8fe536

SHA256
1ac620f53381e9921bbccffb710c6b0f2fd891a5f5bf4aeb3526d9b0bf49c3a9

SHA512
348749193a8ccf0fb97c0480dd19bfc2ef5d0b5e3f3417fb3c43042a75011a9663a2b9f4ec7d0016d18b3684970cbb2b2f3a7744f9a53c38eb044ccc5d280bbc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\prefs-1.js

Filesize
8KB

MD5
6d26876b65be37a7835ee2efd8c1dc26

SHA1
ba0ed5f98b282d5e618cab3036fac92bf3492f08

SHA256
78d1d68aba07b5741ded935169bf3095a655a2bc004c0d509fbbc6d4c1f2dbcf

SHA512
ce165b30ed0abf0392a661afbcdc44190993f5ecc1798be7b6ec6829e7e3633adb6f2e0804bcb00145415bc8d7d76aed5ba99bedbaa8f90a20059bb20445e7b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\prefs-1.js

Filesize
6KB

MD5
0466ac9aba67cdef088bc4229b5f6104

SHA1
13cda9c2be7076f216b24353372c0375686ef890

SHA256
3bd1d6c4d5b0bfefb552227d31bfee603352f240f480770397d3ea00a7671687

SHA512
4f9147c20f886f01885540aebc11da8af75683b71dcadc30ef19dc16d71b1faaf6318221ae0ba51a382ada99417f56d1f0e14f413f0b0fe83452e63b30af1742

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\prefs-1.js

Filesize
7KB

MD5
205ce2af5d543e447449a59b2867b03b

SHA1
18e43e8de0b82804aca245c5fa8c54bc36993d35

SHA256
a1a0500e44ed406c819b16e3cd9ee57033c639b11d1b8ba2ca249363a25f93c9

SHA512
7cbefea80dd0e810c3ffadd9aa5b76326fe8bc0bebf9436d8368737212b776dfe4c18a3159116443d97fdf0d129c5f23cdb289d59c00c13996d6274eb60fd143

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\prefs-1.js

Filesize
7KB

MD5
05a95bb8db3d60759f2a69b9723b001a

SHA1
c661a4426c9bb5078e549fb18e9a1d63b6eed94d

SHA256
f417480e00160656c9a7870c76b693154dc7f0138484fccf46eb1c6cdf044b70

SHA512
1af7e54a998f628cfa295ed63f60ac389c7e780f4edb62f0dd12040b5824c3f92331f48946ab689e2c8ae6679399d14ac78420c71a9a9de510dc6c3333d02e7e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\prefs.js

Filesize
6KB

MD5
6e4a5fd2f0366fd2e9f71c256f88eec0

SHA1
fa508a3b89c633ed400caa0aee7578304a2c98fa

SHA256
f0aad6ce2641ac813772c84e31707feef0012f7f51a3df8b8ab185a3a607c9f8

SHA512
0ac3fa2f6c30a7a64b7f190fdef7c50cc85da1e7fa66a41933127841efae715717f78b93b7eb5604c14c47881d53fc0df510a43a3c4b02d355801556f2068352

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\prefs.js

Filesize
6KB

MD5
61c23ff8b11a59e2eee1b684f318b29a

SHA1
4cee285785cb89fb7a1fcf09cb9291c4ab9e2a64

SHA256
1ffd74cb6764b3a6519b1f1eb3c6123416cd56b088708fb60ff16b68ca70cd6c

SHA512
b17a3f2ce44c1203c05afbb828c3b484bcb4d20af402e3286fe85aad2aa6ed17509fe11567a1d061607c6acbd48c50c65d78177e2aed067d2051b2d06073f8b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
35aba9471f1190fb38d512527aa3aa5b

SHA1
5a600e79fd26afd7b287637acc9625a535606413

SHA256
ae297474a672377a41ac7724a70c0f369e1fad13ba9d2357e4f4ce17d0377716

SHA512
f589660cdd0b1c44b2f8459e499636989267233fac722d0858bea1380297bd247566cf74e656c2d9ac4384c18631ede86381b5ef900f851db6bdb0d80f4b55e0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
112KB

MD5
ea8ac31ca1d87c6a132cef288feb75cb

SHA1
bd0996b3e396282f4d789d239f111ff52b74c2a1

SHA256
6aae632ca2d12d21657bbd7982419fbde2ee27ddbff992bd6b220752b9567275

SHA512
7c4edf3958f8dd1908cb81d941f392bf7769b95e3875eac9670c275beeaefd9fc1e304e7d6b44df155689d90bae63a450904108c8ee563a99533c8811dc77f53

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
a4e7aa5c39e26c6885eefb691b40cc39

SHA1
a6ee13b8835196a3b2446e65e3eec9ed297adfcf

SHA256
66f316457ec145de582d54ef4fb8ebf823dc372f49266a4dc74821f074c11aee

SHA512
10133364521cee95f32bdcaab30922e8618deb014525e5ea80ace4a186f44f7315997a36d484d1cdb65be58fb14caae0646d42db6140ec0120097eaef92c7f06

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
1a1fb4533abc065c6e783482280bebca

SHA1
81c76ab8d9fdece08dbdecde15e3ca59ba50c7c5

SHA256
63474e6decf10619c16238b86f3565e5279ac62246b8d1b147df256596195d0b

SHA512
7736ffd269ad6b43db8c8d26fd2814987929624d1cb455f9847bc6078bdea154b636c0fcf18da1be70c3480f328080a5af17ca84e0d13733cbaaaa43ab964fb8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
3362abaa96c21db77851f965cf64aba9

SHA1
891a7b7ad5c1d7753767352b9100896ff6c479f1

SHA256
8a4bf7d5e7f16b39f04d2bfc82b405aa0d78ae72adec54182fa009d465d62574

SHA512
dbb81193871739b6a00bf1d2fe8f2c0836baf11415e71e875543936fdc215cf5413dc0763d23f272b7c8827d98968c57a465f9e25b82ea76e33c8ccff721b75c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
26c8d9ade650f9fb2aa171c5840480b0

SHA1
3aa127010435a6d4a73603970aab3bd44f7192c9

SHA256
8b6010bee57b5ab24362327d9d9ea093f62ce9108fcd57d80a0adb00d2143740

SHA512
4de0e06309d13e4f0518d9b37e1677b63875006b1b72b1920793c2ac12aa75100812bb6ad57ff24dc0123d899e97bcd4e5c92772913d1493fef212c5b1e9d48d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
ea7ac5de18c62bca70fd940b54796d5c

SHA1
2f8c6abb5eb1cb11cdc2aaf54f783f2483c194f6

SHA256
d984912ee63c4c628bd7a69d33c13f11ad3f0efe3e80924b08d7e5458efaa00c

SHA512
c98a7f1acd7fb11cc2a70b11fa59a4e630285ec0d03baa0bd8cc5edd96b16de4416af3e5fde26a190ec54a0ce6e7b0eb8d469771ead64567036c3408d697ae34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
b8f1599da44e8d4c567371687f1c4d0f

SHA1
68d67773bb9783dbb6a10b889adc984a1d306daf

SHA256
f3fc0e5077ec91f1efbd7c3f0415d2a7f5197d83402d4ec8cc0bfec69de49367

SHA512
a62924636174e8e0e4f728bd790bf7436f103ada84c6a6b3a61445c143068da955b59c16c1ef85d77aa5856a9c16140938ea2b13537e71813260ddb4a265a834

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\sessionstore.jsonlz4

Filesize
4KB

MD5
83ff1340669e1b66f51637454b30100d

SHA1
066b642fa57e6879eedb92f1343ac4570c19d193

SHA256
7fdd8eb6e72f2823fd9df3557ddf8ba12895ebfcb6e71753eaf7c71c55f7f054

SHA512
632628f6a03235f9db9d5c9544edffa7ac49c372c29ce8263367ee009acbef27a21b52735259fc0bd3b3eb79b9fdbcbfc41fd1a6506ef669479902e6810a3584

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\storage\default\https+++ixebg.nailsandothesa.org\cache\morgue\252\{aad98b1a-1feb-4da2-87f5-f71aa5283ffc}.final

Filesize
19KB

MD5
6c42e36825afd26c4ea4069c36a07b95

SHA1
eacf119a5dde3b43a94536607e8a493c3c4520e2

SHA256
28ea34cdbd330ccfd163810e0bbc9b7d4a3c9a1c2c0228207537c87593fa4d5e

SHA512
a1ad342c781f6f4ab46362e49b7dba2ed1c216bac6fb93b329c43e7b0079c6a94e9c75711b85ca44398796c718c6b91c08d0f7f8506b202c8a1773731a5d9265

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bcdi3zmp.default-release\storage\permanent\indexeddb+++fx-devtools\idb\478967115deegvatroootlss--cans.sqlite

Filesize
48KB

MD5
9a1bbc1eb08a46e386195d801b301487

SHA1
dc8615c5dcf754e90fc9e48f6940c62128d9d6d6

SHA256
bc729c4514d0cb0cd3a7e2c7b499dad96bb1b6c1b5d60d285ca174ca04c5b4b6

SHA512
fde3db3e96585ffb5ce2c6933b118300caf3e9595237e39fc3cf06b2d6aa65248f83cb903167bafaf9624dc18f1e0786ef9a863015cd7e3177165b54fc327a23

Download Submit
C:\Users\Admin\Downloads\7z2301-x64.exe:Zone.Identifier

Filesize
110B

MD5
df8bbd5d1aba282f39d4237bdb0672f1

SHA1
703dde200690eebeafc13ceea3f5b1812ed23c48

SHA256
7f45f77418cd6c0549352c7544fff1d760ab5d353b0fc4d0d361ff30943249e7

SHA512
c9e58dab4b6dc306d1ff8bc49952f69a296c63569b8c9c6663ec5869a1d98388d82c0c8563cfed1ac35ab1464227e3e99a9bed0145c7efd5d77f61376f135a49

Download Submit
C:\Users\Admin\Downloads\7z2301-x64.z-F2CdtB.exe.part

Filesize
79KB

MD5
18b6ceed224b755c4398b2b1aa997563

SHA1
af16f0b101b88f70b0a7c3f2813c350bd6b277df

SHA256
59eb41503fb5fd133d3b060802ebd552d6b87f2de2ed541da82bbeb9d4ec9fa3

SHA512
fbfcd338712c58ff0134585505dd01aa43323a9effe568077f0ecfc916b27e4a5bd0db17a318c9ab09ed9749bf945eddc93bc6c04423be29c1ea57fc9f91fc12

Download Submit
C:\Users\Admin\Downloads\Central 1.-y-Ipk6V.2.rar.part

Filesize
12KB

MD5
7a58530ff51a9f61e3c52859d7a55cbd

SHA1
58d79112015dd4e92de7e83cc8714f5df30fc6bb

SHA256
75f7c528810346a6d6db3d62c26d8b9b1f8d94919dfb5b332bfb0bb2d817e332

SHA512
57729d068afb1d0c3728209a3bf14292af2d1651fe264b1346f289b6080b68159eef28d18492d2845c067d0022bac1c49913cb5eac5c3753ff2f9d09cc6245c2

Download Submit
C:\Users\Admin\Downloads\Central Executor_05018736.70WVZhRi.exe.part

Filesize
426KB

MD5
17e58e83f7e252be6fd0bca4e5f70984

SHA1
b96c51dad4a8be8bb267413d7a6c607b6859ff59

SHA256
f8a2c247a152660c7caba372988d37b3133375ad44cd2e82be970f4fd461976c

SHA512
49d8f674d367cf6308166d939a3a1b5e60e6aa6f8460adf9c6fdc7675bef06f72349d25e9419823d1287ac62db9101eec5a8a4485e6c4e85e476b03c24ea6da9

Download Submit
C:\Users\Admin\Downloads\Central Executor_05018736.exe

Filesize
9.5MB

MD5
1198daaa23f0af650c7cd4555fbef9e8

SHA1
783f86460785027a41a84e41b42a05b4d4a1a462

SHA256
25c846183e10bd2a146325effecddbabf0f390717fd11d597012a033e6daf600

SHA512
1a67d52794c2047936fc4814b70dd6474837b90df7a8b5653eb8a09cf98d4df2c93fb07451a29254e2e161e9e3f0c3f87e9f5e1252a2c89f2b7f95537e80227d

Download Submit
C:\Users\Admin\Downloads\Central Executor_05018736.exe:Zone.Identifier

Filesize
166B

MD5
58264818e8475fa0c41d1b1a1aa4f3e9

SHA1
8b7e6b48064b582838f9b85e9183ca5a4f6f43f9

SHA256
b60bc6240f8dcb5b0c68f953e25348d7206c6bac6052162e7e53a11bb5a546f0

SHA512
23050006d21912b6fd0380e993bc67a5fd0563fc2f2ab16056d0fb4035d65f027f7cd3fb5c83f7aa7a71ea25efc3017e9b29f703fa6dfa2f2a1ffb3c1a631a05

Download Submit
memory/1200-737-0x0000000072250000-0x0000000072A01000-memory.dmp

Filesize
7.7MB

Download
memory/1200-759-0x0000000072250000-0x0000000072A01000-memory.dmp

Filesize
7.7MB

Download
memory/1200-747-0x0000000005800000-0x0000000005810000-memory.dmp

Filesize
64KB

Download
memory/2856-3391-0x00000000752C0000-0x0000000075A71000-memory.dmp

Filesize
7.7MB

Download
memory/2856-3392-0x0000000005980000-0x0000000005990000-memory.dmp

Filesize
64KB

Download
memory/2856-3393-0x0000000005980000-0x0000000005990000-memory.dmp

Filesize
64KB

Download
memory/4024-784-0x0000000000430000-0x000000000043C000-memory.dmp

Filesize
48KB

Download
memory/4024-785-0x0000000072250000-0x0000000072A01000-memory.dmp

Filesize
7.7MB

Download
memory/4024-786-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Filesize
64KB

Download
memory/4024-796-0x0000000072250000-0x0000000072A01000-memory.dmp

Filesize
7.7MB

Download
memory/4224-3379-0x000000000AE90000-0x000000000AE98000-memory.dmp

Filesize
32KB

Download
memory/4224-3376-0x00000000061D0000-0x00000000061E0000-memory.dmp

Filesize
64KB

Download
memory/4224-3375-0x0000000000A10000-0x0000000001610000-memory.dmp

Filesize
12.0MB

Download
memory/4224-3374-0x0000000075220000-0x00000000759D1000-memory.dmp

Filesize
7.7MB

Download
memory/4224-3378-0x00000000061D0000-0x00000000061E0000-memory.dmp

Filesize
64KB

Download
memory/4224-3377-0x0000000006280000-0x000000000631E000-memory.dmp

Filesize
632KB

Download
memory/4224-3380-0x000000000B2E0000-0x000000000B318000-memory.dmp

Filesize
224KB

Download
memory/4224-3381-0x000000000B2B0000-0x000000000B2BE000-memory.dmp

Filesize
56KB

Download
memory/4224-3385-0x0000000075220000-0x00000000759D1000-memory.dmp

Filesize
7.7MB

Download
memory/4224-3386-0x00000000061D0000-0x00000000061E0000-memory.dmp

Filesize
64KB

Download
memory/4224-3387-0x00000000061D0000-0x00000000061E0000-memory.dmp

Filesize
64KB

Download
memory/4224-3388-0x00000000061D0000-0x00000000061E0000-memory.dmp

Filesize
64KB

Download
memory/4224-3390-0x0000000075220000-0x00000000759D1000-memory.dmp

Filesize
7.7MB

Download
memory/5052-492-0x0000000005260000-0x0000000005270000-memory.dmp

Filesize
64KB

Download
memory/5052-489-0x00000000003F0000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/5052-490-0x0000000072250000-0x0000000072A01000-memory.dmp

Filesize
7.7MB

Download
memory/5052-637-0x0000000006230000-0x00000000062BC000-memory.dmp

Filesize
560KB

Download
memory/5052-577-0x00000000053F0000-0x00000000053FA000-memory.dmp

Filesize
40KB

Download
memory/5052-653-0x0000000006EF0000-0x0000000007496000-memory.dmp

Filesize
5.6MB

Download
memory/5052-642-0x00000000061B0000-0x00000000061BA000-memory.dmp

Filesize
40KB

Download
memory/5052-585-0x0000000005480000-0x0000000005488000-memory.dmp

Filesize
32KB

Download
memory/5052-593-0x00000000054D0000-0x00000000054FC000-memory.dmp

Filesize
176KB

Download
memory/5052-643-0x0000000006420000-0x0000000006442000-memory.dmp

Filesize
136KB

Download
memory/5052-620-0x0000000005B50000-0x0000000005B62000-memory.dmp

Filesize
72KB

Download
memory/5052-603-0x0000000005460000-0x000000000547D000-memory.dmp

Filesize
116KB

Download
memory/5052-513-0x0000000005230000-0x0000000005244000-memory.dmp

Filesize
80KB

Download
memory/5052-644-0x0000000006450000-0x00000000067A7000-memory.dmp

Filesize
3.3MB

Download
memory/5052-569-0x0000000005410000-0x0000000005434000-memory.dmp

Filesize
144KB

Download
memory/5052-789-0x0000000072250000-0x0000000072A01000-memory.dmp

Filesize
7.7MB

Download
memory/5052-521-0x00000000052A0000-0x00000000052C4000-memory.dmp

Filesize
144KB

Download
memory/5052-529-0x00000000052D0000-0x00000000052F8000-memory.dmp

Filesize
160KB

Download
memory/5052-537-0x0000000005300000-0x000000000532E000-memory.dmp

Filesize
184KB

Download
memory/5052-767-0x0000000005260000-0x0000000005270000-memory.dmp

Filesize
64KB

Download
memory/5052-766-0x0000000072250000-0x0000000072A01000-memory.dmp

Filesize
7.7MB

Download
memory/5052-650-0x0000000006910000-0x000000000691C000-memory.dmp

Filesize
48KB

Download
memory/5052-545-0x0000000005330000-0x0000000005358000-memory.dmp

Filesize
160KB

Download
memory/5052-688-0x0000000007A30000-0x0000000007A5E000-memory.dmp

Filesize
184KB

Download
memory/5052-553-0x00000000053A0000-0x00000000053D2000-memory.dmp

Filesize
200KB

Download
memory/5052-669-0x0000000006B60000-0x0000000006BF2000-memory.dmp

Filesize
584KB

Download
memory/5052-659-0x0000000007A60000-0x0000000008014000-memory.dmp

Filesize
5.7MB

Download
memory/5052-561-0x0000000005380000-0x000000000539A000-memory.dmp

Filesize
104KB

Download