Malware Analysis Report

2024-09-11 16:49

Sample ID 240615-v1bw1ssejr
Target https://github.com/kuzemisu791/Bandicam
Tags
stealc vidar discovery spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file https://github.com/kuzemisu791/Bandicam was found to be: Known bad.

Malicious Activity Summary

stealc vidar discovery spyware stealer

Vidar

Stealc

Detect Vidar Stealer

Executes dropped EXE

Reads data files stored by FTP clients

Checks installed software on the system

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Runs ping.exe

NTFS ADS

Delays execution with timeout.exe

Checks processor information in registry

Enumerates processes with tasklist

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Process Discovery
T1057
Remote System Discovery
T1018
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-15 17:26

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 17:26

Reported

2024-06-15 17:29

Platform

win11-20240611-en

Max time kernel

146s

Max time network

150s

Command Line

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/kuzemisu791/Bandicam"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\latest-x86\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif N/A

Reads data files stored by FTP clients

spyware stealer

Checks installed software on the system

discovery

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2198854727-3842442895-2838824242-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\Downloads\latest-x86.zip:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\7-Zip\7zG.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4376 wrote to memory of 2984 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4376 wrote to memory of 2984 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4376 wrote to memory of 2984 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4376 wrote to memory of 2984 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4376 wrote to memory of 2984 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4376 wrote to memory of 2984 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4376 wrote to memory of 2984 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4376 wrote to memory of 2984 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4376 wrote to memory of 2984 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4376 wrote to memory of 2984 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4376 wrote to memory of 2984 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2636 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2636 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2636 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2636 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2636 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2636 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2636 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2636 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2636 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2984 wrote to memory of 2636 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/kuzemisu791/Bandicam"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/kuzemisu791/Bandicam

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2984.0.1278487167\1122489893" -parentBuildID 20230214051806 -prefsHandle 1796 -prefMapHandle 1792 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8871c3d-e428-40ee-97ce-de732a8878fc} 2984 "\\.\pipe\gecko-crash-server-pipe.2984" 1876 1bbd0a0b558 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2984.1.1149402895\746421974" -parentBuildID 20230214051806 -prefsHandle 2396 -prefMapHandle 2384 -prefsLen 22925 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1abcb5f2-1deb-4995-9128-0917a6caeabc} 2984 "\\.\pipe\gecko-crash-server-pipe.2984" 2424 1bbbc78a258 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2984.2.428714543\1602204814" -childID 1 -isForBrowser -prefsHandle 3032 -prefMapHandle 3028 -prefsLen 23028 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e1a53ce-764b-4753-ad0b-4c9f002801aa} 2984 "\\.\pipe\gecko-crash-server-pipe.2984" 3164 1bbd393f858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2984.3.1552788305\1241386723" -childID 2 -isForBrowser -prefsHandle 4004 -prefMapHandle 4000 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ec86f98-e0c5-41f6-9f59-a1258e5ca648} 2984 "\\.\pipe\gecko-crash-server-pipe.2984" 4016 1bbd66aaa58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2984.4.694953146\430839853" -childID 3 -isForBrowser -prefsHandle 5224 -prefMapHandle 5220 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {175dfb30-0a27-413b-bba1-818918cfc059} 2984 "\\.\pipe\gecko-crash-server-pipe.2984" 5228 1bbd8be9b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2984.5.1816290850\36215158" -childID 4 -isForBrowser -prefsHandle 5372 -prefMapHandle 5376 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b72b4b04-bccf-4b6e-9246-b5026b76a647} 2984 "\\.\pipe\gecko-crash-server-pipe.2984" 5360 1bbd8a76d58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2984.6.1755948471\1646705223" -childID 5 -isForBrowser -prefsHandle 5564 -prefMapHandle 5568 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {717cb3e7-7e78-4d48-8fca-1f3dc9dd0ce5} 2984 "\\.\pipe\gecko-crash-server-pipe.2984" 5552 1bbd8d2d558 tab

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\7-Zip\7zG.exe

"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\latest-x86\" -spe -an -ai#7zMap4725:82:7zEvent25296

C:\Users\Admin\Downloads\latest-x86\Setup.exe

"C:\Users\Admin\Downloads\latest-x86\Setup.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 389546

C:\Windows\SysWOW64\findstr.exe

findstr /V "MasBathroomsCompoundInjection" Participants

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Angeles + Ancient + Phenomenon 389546\I

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif

389546\Cycling.pif 389546\I

C:\Windows\SysWOW64\PING.EXE

ping -n 15 127.0.0.1

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif" & rd /s /q "C:\ProgramData\HJDBAFIECGHC" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

Network

Country Destination Domain Proto
N/A 127.0.0.1:49749 tcp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 spocs.getpocket.com udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
GB 20.26.156.215:443 github.com tcp
US 34.117.188.166:443 prod.ads.prod.webservices.mozgcp.net udp
US 34.117.188.166:443 prod.ads.prod.webservices.mozgcp.net udp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 34.117.188.166:443 prod.ads.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 52.42.69.239:443 shavar.prod.mozaws.net tcp
US 34.117.188.166:443 prod.ads.prod.webservices.mozgcp.net tcp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
US 34.120.5.221:443 prod.pocket.prod.cloudops.mozgcp.net tcp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 140.82.112.22:443 glb-db52c2cf8be544.github.com tcp
US 140.82.112.22:443 glb-db52c2cf8be544.github.com tcp
US 185.199.109.133:443 objects.githubusercontent.com tcp
N/A 127.0.0.1:49756 tcp
GB 20.26.156.210:443 api.github.com tcp
US 35.244.181.201:443 aus5.mozilla.org tcp
US 34.160.144.191:443 prod.content-signature-chains.prod.webservices.mozgcp.net tcp
FR 23.200.86.251:80 ciscobinary.openh264.org tcp
GB 142.250.200.14:443 redirector.gvt1.com tcp
GB 142.250.200.14:443 redirector.gvt1.com udp
GB 173.194.183.166:443 r1.sn-aigl6ney.gvt1.com tcp
GB 173.194.183.166:443 r1.sn-aigl6ney.gvt1.com udp
US 34.117.121.53:443 attachments.prod.remote-settings.prod.webservices.mozgcp.net tcp
US 34.117.121.53:443 attachments.prod.remote-settings.prod.webservices.mozgcp.net tcp
US 34.117.121.53:443 attachments.prod.remote-settings.prod.webservices.mozgcp.net tcp
US 34.117.121.53:443 attachments.prod.remote-settings.prod.webservices.mozgcp.net tcp
US 34.117.121.53:443 attachments.prod.remote-settings.prod.webservices.mozgcp.net tcp
US 34.117.121.53:443 attachments.prod.remote-settings.prod.webservices.mozgcp.net tcp
GB 20.26.156.215:443 github.com tcp
GB 20.26.156.210:443 api.github.com tcp
US 185.199.110.133:443 objects.githubusercontent.com tcp
BE 104.68.92.92:443 steamcommunity.com tcp
NL 149.154.167.99:443 t.me tcp

Files

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\activity-stream.discovery_stream.json.tmp

MD5 dc623c408a99aae8357c163c3f0c4c99
SHA1 fadd0294134e88e8d036cfaafcc9f2a417e9dee6
SHA256 619ce4f9c8427359a9f578dbd6c312cc80fbe31ac70b762f5d23220f93abb98c
SHA512 e9c6de21972917ef6f7b279739044e5d396d0fe1e51b9f1fce3e3c6df39d9f67b2be64f93238967cd033889138dda22f4796b1e78d35959d1f6688e7ca64ced1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\prefs-1.js

MD5 b591f97641f37721f3c434d66308c27c
SHA1 5c2ff3efd3c4820848062846c87c4becdb07da4b
SHA256 926e5b8b874434516fb868b8dba7dfb6647fb7091f01277d2ec7d5e96b3b9fb6
SHA512 99f303aa35b09d86a716d095c29b49a9ccceb668673c54a763374365e05c09ba6f65dccdadee1c23fc1a7f98eabe15bda506cee7884934ef4e61eedf88e511d8

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\activity-stream.discovery_stream.json.tmp

MD5 d8bae469fc6d943946e40af1754c4743
SHA1 c8169746965cb86ebaa20ebf20fd5dbeaf3aa22e
SHA256 04b5beace3a7b77e667a6dd848896b8d1ff9ab7caccfe579d109f5b4bed4d03f
SHA512 07386b349a01397e7ab925a91ec5860b850028f16b944ff3ed67091297c25613a024c0a5a4f7edd75f047ceb50d681c519f3b6512f28c287e6611d3687b53345

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\sessionstore-backups\recovery.jsonlz4

MD5 34c7216b6fbc34b575adf902217e4063
SHA1 a33c8ec5f25d00728ce05cd22c82506585664f74
SHA256 ee548527e8a69292c5f88105f9e26c6311ed215e3a3045b21163b26bd3d2faa3
SHA512 4ef68bf6dcb6bfc60671dd9e62494ac9bd63672baf7c4f625992534d1c846c7671f0f445d53f1c4b59fdf6ca5725fc4e89734b693cb38c0f7ea1145556753e6d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\cache2\entries\383A97A57B113BD106DE6984E6DBA5F537327263

MD5 ee083181bc86caeac2755c75ff7c43c9
SHA1 55061b83637c57a447475c59152ecddc8e30b8d4
SHA256 6d69a492a31679b60335c4eed9c98a3e00540d9291a173b17a5a3249c20380fc
SHA512 9d9c00fce93ad132ab403298922f7f31886889d44e8fbb3bd02d1e1fba93243b26cb65fd22a8ef5abd9cf5d00591ac7c2e95aa8037713757ca5912239c2dcdc6

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\prefs.js

MD5 aae835825d561cf8085b44b12dd637a8
SHA1 3635809741405da8c9e044852154256c736c6324
SHA256 4cac7a5a0e7e4ce64cb81c2df22814d7313c8b27c5c98709d68efc0792750032
SHA512 b00b0c74a875efe066c1f716ffa8da1b47bf31a2d33452dbaf7701f43f9120d237797b38158bcd14eefbf3b1342c86e0020dba43104444127bff6f07cbd354a7

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\prefs.js

MD5 6821333db87431e7f61f46d4606552c6
SHA1 c79bdc9511c2a03299e9e6db438a2a038a4a5aae
SHA256 4101563c3827cd64cbe6f100ec3eeda2f993be4b92c9acb9db9bddc774a4d935
SHA512 ccf58c28503aa429df37ec061a29450f064e317257c6bd9219babeb27d1b596b7b54b8d6f1f7829855ad8791cbf886b30e5868796b39a4224ccb7f1b66d35f35

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\cache2\entries\F8CBD54DDA10F4286A41EC6A537240712D6C2308

MD5 5d02838b5c37ccfd6e1280ef0b6eca52
SHA1 e36c96804f7d2ab477dfc6c52c51395a5ff77fcc
SHA256 7898b97940ca8e7014537e3f560898a5f40a9e0e91defe8643edc9900b04a072
SHA512 bac111dbde3be11b56f32ce982f1ce6678f98355a243cb28520b4350736720b037913d404b7683f60d42030ad4077ad7ed38ab3f66dae0a45656f28ae7fc15c7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\prefs-1.js

MD5 8f68770e15dffdcbbc9edff0043d5329
SHA1 9ef061981bfc7a57394e154ef397c0414b4d9e16
SHA256 7f8d928917a54f39206cf288d097d3c6953196ac155aae1f5d3934ad3e583362
SHA512 07b2b3a6f600fe438a72d316b089a085bfcb3c09c04aaa4218e1513de49ce045a871da2d295eef8e3b53d07851324a5671d8b6e0e2fda5b4a0c06552583dfda5

C:\Users\Admin\Downloads\latest-x86.DGRND2Gd.zip.part

MD5 3c6bc8a4b0297c745ce59b32b3d9b713
SHA1 02c0f23bf1c45be209e635d3b99eb8da148841cf
SHA256 8ecfd9b331700af0dd858625393a39549519124461431da1673eb4bdaf0ab698
SHA512 63ba703b5fe3ae0e6fed3524c570b3e4c59372097d538b9fa8ce18adc40152972f8303298e3b1c72e8643a71b9f83834cead6ead4aecf1985b6b470b2201fcde

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\sessionstore-backups\recovery.jsonlz4

MD5 3ac9ed0728ca76f3ca5e74c7a869ac38
SHA1 aeb0a34da438e47b939ebd4a76a87d73cd4dfc03
SHA256 0e296484b1aceb532c53d2055f267c1d6c495c4b751f9c0072ad9bae71ad7a96
SHA512 6a4d505bc67ffe43ae25d4f79cd6c0542c092c56e5d6fc52cd9a500ebd79b2fe7fa85d76ee127246d3ad503da9b40a4dd58ab5e04d5bbd45bb2de2ca78c022ca

C:\Users\Admin\Downloads\latest-x86.zip

MD5 830d7ff79ed80bc302a1fa5f71ecfc39
SHA1 9052818e24b63c242ddcfad6915fd59ac3807736
SHA256 fe712bfa657a3d9d6928612053fc6073dad2caa0ec80efe71036aa421ad2d472
SHA512 74cda0961b375ee6734813440b06bb96c29dc503d880f58b866bc5fb5719b0207e907e5e1dd401c1dbcee9f18d93941d89c674639b6e3e94b48b1a164e5eb1ed

C:\Users\Admin\Downloads\latest-x86\Setup.exe

MD5 adabbcf799bdc6a5cd8b5fa95d3ddd66
SHA1 1000c59009164735c7528c015ddb5f4f27eec798
SHA256 0ca333d46ad10eb06eafb84b422b48f3426a0feb360699819742eb74a391f110
SHA512 6bfae8dfc14cedc6b8616e4fbe2efb979e7525a5ad0414f5f16fd375376711426377b464a84e5751d924546b553aca345c52266a6113a50d18c5e5cf246da35b

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Emotions

MD5 69188ac3cd99f1c625f0db889bac02ba
SHA1 68759675ac80a6de2b153d1b901ce8cbca9a97d9
SHA256 892a8bc72da3028f7001369f955f1663f336c68807ab70d66eb2ad233dd7cbeb
SHA512 4acf21b0d3c9f4b758787ebadc65aac7f1b8bed910e241fc2d1226fdf4f6725e010252fe88cd4a420fe5d5a35acf55ec1addbba8bd3ea950fc4cc420f3d5970c

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Participants

MD5 82a38745ff9cefa0859b47b8bd69f535
SHA1 6f97750b298ed3f3910e5aa4044b91e7409db9d2
SHA256 92f1df88e0467d0284f1de3e6d30bcf41b0ed56e055719872754627a2b4bb470
SHA512 d22a5ddfacf8c00cde7c3fa27612ca386ae68f79b9c93b52d40be33d584eaf3c18b100da9ad6ba4efacef1cba4fa5d1665e4c3004454f0eb41c3051b98c60569

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Richmond

MD5 b252ec42745814254c189355ff869ea3
SHA1 61df27702779e73a410dc952c6ac4dff2de6815d
SHA256 be397d303eb61155e30516038e8693e9f73fb5706b5bccd2a7081e84d05e2af9
SHA512 786ef34fd0b648f2f5a610a01640604c91b559a49765bd3803aead7aa1db8758364cdc9465fdd7bd022e864c01ea32481b14259fa9d001c32a0e3d91bbf7a9c8

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Alot

MD5 2263067cc70e1dbaa0a4a57b2a8e7fcb
SHA1 01c8de2133305a974f5308b656e7fc24518f929a
SHA256 22904ee52b888bd7eb7ade62c3b3c8718f2f425fe00bd2467f4af68a5138b36b
SHA512 288305e0cc15e1ecf54d7154ce9a350646bd5d23134e7ddd9c8802e8a88c191a8c69526d3851d2ca2ea033eea8eb71831f4dbd246e37607ef59cca123160a3e3

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Genre

MD5 e0fe0edd98e8d5dc6206008db5a219dd
SHA1 ca09cd966570766274e70bcb609baecfde867983
SHA256 1ed2640a2eec933b97b205b03836bf13b4650f67ab23f7cc3c52455b62a6c4cb
SHA512 30a5f2242713cd515148039ed70d7f675759baeff977e7c45d9cd2741c3e3102b86506a724b47abcd31f6d47d3717d40617ebaa84ac6c314594a4a984bdcaa9d

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Fighter

MD5 99f6f630ace0d999eccb54edd426d0bf
SHA1 87359e3c75da0f27efafbf0152b946c446134e18
SHA256 a4a8b1486887631a2eb8c670d79638a02711e6ff0e8198c95b1f39ca8a281ccb
SHA512 8158bcb0c865e16c2132d4ee786f7faf7906d15291812eb400441378ece24690300a2ae95542c5e48ecfd435211be9fa41850d973161be52bcbd5e46630f5b1c

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Que

MD5 d9d16c848154f20853faf4599f32865a
SHA1 ebe0d941af4e7923b7bdba2a488530459089522b
SHA256 7b5a4d134252047a49d9f45b2c94593eb01e9be75a5af8f26db7eac6cc84ba41
SHA512 23e205741a8391197fc25083741328af0a274425bff5d1defb5d5d0d41f994edf6e880cffb1b57243ba0fa06f4515a21477f98daa5ddfb9eff870dcda8e5cbc4

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Favourites

MD5 7f0ae6287a123437680291caa6cb27e2
SHA1 5535de659a740d784b197317f00a3cc33cabbaee
SHA256 d1b0a933ba1302745b34c999f5d2b32555d73a195cc313159aef6f111f4af46e
SHA512 607e0fc745e289bc156f83bcec8cdcb387892124b1de3f7d8a36afb523b2b8e1132e78f2401c71ffaec9fefa05f23e4c15275748717ceb3ea1d6aa2d5e2264c9

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Hayes

MD5 71bd261427fbdf72899b417c38c977bf
SHA1 b2eff3eb04fb8aa9c92506e998314aed1deae969
SHA256 1524cf81ca46d5bcf334ab7fe5a0fc06c8d29de88e28831b57611381bc7b9996
SHA512 c1d3459f36d460536ad7bf0301ef8a9c808946926b39e6592a09154baf80f81ddc185dbae6179909e930fe4b27c5b12020914f6bcf71db92bf4573b61aaa5545

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Kde

MD5 4ff55e1b173517e7a3714232c67aba27
SHA1 b85a132ce34a7f9c9583a4bbecbc668bbf68ef80
SHA256 85e6dcbcf863bd85bc1de8fe888c531bc2432629097876a1c9c56dca05f1b41f
SHA512 fec8be986ec5a445d021891222192d362207577e5b67290df3a499838eee4b9b5128cfc5223035a18ca9fdab669d28aca5fbecf3c7a6e7e6cf7493fa9484a389

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Portrait

MD5 d32f5a642703f9de4203fe03ff99444e
SHA1 1402f204d957ea840fed0b7a9fe2cde550838efc
SHA256 f30741289eec81c0bedd3833e3fddcce7c55ab7bb515aadba853b0f64c92b75f
SHA512 673c4a11a7c77f277dc320d09c00d44bfcf0e24e1a8a47f566250bcc6f7cd58a59c8e4ee0dfb101cb6c09f062951d9f6853168df75f9a3ace416e8d619d9fe96

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Studios

MD5 81f9103329f1d1987bc8acabf4479213
SHA1 9f6cd4c95d8832cad521141cd9b855b392257e01
SHA256 afd8f25d62dbe8d415e349d3eefe69148f45f23380fbf6589112aa9b761f6552
SHA512 e7b53e546f4c24d8d7917515a71f02c117a8082aff35954b761caa011c3a71c775dc618b35cbc1b2c6a7d379a9f8ade59aae17a298ecdc3535d758102bee048d

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Referring

MD5 6c9db7026814dfc28550b4240ec184ba
SHA1 398a75ace24d683836f0ca18a637991f89655ebe
SHA256 e78c9ed0b98d8bbf333ce827206fe92ccc83f0a922fc85e3587fa9b212be0b09
SHA512 2893fb7ce3e4ee0f3ea9361b2d9e907a265281cbfaa13552c54c88e3a453792e979d4c9907c10ee92a81bedef931474c5cbf3891970549a18e4d074390ef61aa

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Smtp

MD5 ce280a16fef13a2bcf02f5f535ddd8e1
SHA1 4a5a4127efeaee15f2334989fa44e285e40872ca
SHA256 f22cea8cbbc1d159736eb46e0863a1b2ecdc345988280cdd689c1ccfb8c8e3a0
SHA512 052d6286d0e7f5d01fb58a3a6e65450980b37172e569c91239f2e0f46b7199838a4f64209f90b9f671be9c574411c50123bbe9350fc49bd18863a5087d7a4e63

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Tags

MD5 8bf1c767ee20182c10c754b4b0cee496
SHA1 9d2e97d270846e6b8a0b371313928c894cafa0cc
SHA256 be3945010b4e40b7684c41739b18fbc638e00b5e0fe7e1ac73a4786e949b60c9
SHA512 7eff4d9150a899d8fc21b41c0e66d2b5d448055a7600cc414a69332c2cafde3973a6aeca91c569eabed2b489f8c26b5560792ed1941284a82a7bfe372a40fdc4

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Consecutive

MD5 2c410a64dd126d7005c8bb1a4fc277ad
SHA1 dfcb97b8cea5d3544f21528d3dc4652ab97bfb22
SHA256 741d23db94df6edd906f6ed35e582592c47a23bfa92263a37de42851cca0c724
SHA512 6e0f4a9453377ce01be8a7a78f48f13bfd83490bb3292d3d9db9f635bd2bdd690a4a019c5a3230b56ccedc4242ab1060801c7dc0981e43843cbb5b4ba606fc4a

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Old

MD5 d7be099bae3b2243941057b48b091c00
SHA1 c3bf3cf0716a87a2bb34aa1d1a498be867be3bae
SHA256 8afd0803ab97c78f1e57240725b202493210e6590f1736910621d73a48fd461e
SHA512 fd51583cae94ab7f39ea0001faf43c84bc119ddc100794181ff6c0cb222f76cdb5b0bd320ec918aa89ee38f0e3f6d1975fa06bd0a62c5a45d3ce5a110685d56f

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Race

MD5 df7307d02f71ebdb3919ac12fc622327
SHA1 390ad98fa3a2b897b1a4eb10793e8a209a0132c3
SHA256 dab5df5b32f1793ca245121b64b5df054945e8d1db26d144c00259e9393a7ddd
SHA512 004deb72899edee10c25370954430007cc8b349294a566563fb6ec39b864a13cf2af5d460e1bfe21cd4def3c1b2309cbf472977d9e35db9830c53c3f5146c297

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Cruises

MD5 df5dfe5b6a0421e48a25a415c324c11b
SHA1 f7acf9305f714e0010857ddf48c9ea3e3e5d5170
SHA256 c099fde206d6afa36fe381eb40d80ad056a5d049da2e95ebdb066b96873c9741
SHA512 7ff3f9af4205f08e5796d03af6d969527b61ec00bdd31d0afe2627d275788487549a525e10dd041f649a946d175dceb4b3ba2ca9d9a11f88ba116d05467578af

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Chad

MD5 1b7c6eb44770326634fddf223e06ae7d
SHA1 a7370710bbf5a975c072e8429875b94fb1d4d9d8
SHA256 418be1485e5b9461b7f9f2500f1d1c33b2d6453ddcc7c46833bf42fd9038d698
SHA512 141fef2985fc468ea16f5e8cd48362c6904ea869960110ceeb456c0994e7e9fde8a759b9845b369b74d68eaa38ffcbebc1b620c50a644a6147fbda17016400bc

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Instances

MD5 c84879bb6f191c6e0661c2a2058cebec
SHA1 8a8d2b2b8f96360475447d2a7d47a9c339a08d38
SHA256 277ca96c002e9975c25d5f21a9813a7dcc4e585e62643cd76d2c787bd9f0154b
SHA512 a4b4efb19b2e9701d8eccf512185047c8e6110450d45d9dd30ce6fa7221ce146233ddc1a740decaf895eabcd154fdcb70d3810f4a3acd6b39535efbe57470ced

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Seek

MD5 4facdde04a7bffe2209d9bd9fb94631f
SHA1 b01c2f8c543d49091dd7e33d2e6dba2e802d3f5b
SHA256 ff0dc2ee0664e496a8fbc378a5c0c8459fb792af08748d698788ab5f8f536db0
SHA512 84eb023feaaa363d37deb5c234ec9fbb47913f11cb607503235233e44a7b3cc2c67911cb34d61ce342d4bf2e06f9ccf191dd65d9a7bdadbdb173a835629ca244

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Tokyo

MD5 d6a17dab5e811d782e263a629d69466f
SHA1 dc3469f41ce8b71fe4ada357bfaa07dc9c9bd463
SHA256 e5d23cd1f82c5a8c3074dfec1595228581288957cd2d33c0087fb70f4376f10c
SHA512 094e2cf79fdc3497caa9cadc66b59bf9a0c3ce420e519e79b11f28c2d37ed21db35e138f998ae16ddead8b558aecb9cc1c102a72f2bcde4c111c571fc1c6235b

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Double

MD5 e88293eb64ab8248601f2ee5d8ad574c
SHA1 4cb79b530be9e6a3ab4a45a08e8bf081482606c7
SHA256 6ef532a05e1ecf4a3c9f898f8d7624d16bcd396fefae9bd828b6f3863e3b54d4
SHA512 86786414372dfa2ce88c7e4948ceefc568fb3e785ec3d49fad190238de7c65c5a764b43e56e99c9b43c23ab705aedfeb256c95ac52ef654e712850741c16ecbc

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Bucks

MD5 169031d6f24eaba592bf2c6fe549b404
SHA1 82ee98c7082a38556e54fa4cf979cc611c218ea9
SHA256 4dfa1177500499fc4008ff8dc7e8f1b1525efc9baae5574a8d42ed8732f63b54
SHA512 f492e29103ccf76c0885e22102d3bb436fea3e82b2f1c624c413447d1017e64b32248329d7a10fee483aa9819aedd00ad9abbd50f38fa8377c33d0726bef8423

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ld

MD5 196c44643861d00545bdfbd7814dab39
SHA1 31f2c9e373882787ee917dcc9a2c66afcf516db7
SHA256 3b9db2986d5abe357587c91996c61fef6300d86b06ae93185652d11f6d785c34
SHA512 03a873eda79f429517a47ce84a30b179cadba102e0b6a49423c851159d978fde0beee9cb31ac68d7ddf4a21b07a74bb57eb78cae661fde385e09f80fab891a3f

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Violence

MD5 5e5fa7a1a85689440ef2feb8b7ce8d71
SHA1 b8a7e25ce423171c5abce09d385deea95e4d0206
SHA256 d735a47e18a38017f1601ae2f432f177d635211bacbbcab9ed8e9c3632c47bd6
SHA512 c5d29400a1e7602f906e59384c63783978688675f4f72cc28d512bdb442d5834edcf7f0c94af5bf63ac76393ca8ba2827f79f1cf8abacb1bcf72a61ecacf56d1

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Angeles

MD5 05d31ddcaff9b3500b871cee4185b495
SHA1 93d4923c5083ff322524884823aeea410b1e4aa8
SHA256 5ea8db4abde48b663420e066e16d2f91c45ae0203a60d4bde5c978137091c30a
SHA512 590a70654041cbc3779c5ad9b194a91566c8d72df08567f58cedc06f282af93b38d06f353e90e065cd66e95f70466124fb0fba7b334c483ed8ee9992d1a74948

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ancient

MD5 379bfbbb562917f48f1c3b88464bea8e
SHA1 e7c124ab47a45dedb0edaf6bc4a2dcb126446dd9
SHA256 26828bfdf0a00deb494bb5151f72010f4ec0006efff4530336aa7096d0b7ac97
SHA512 f4bd4d53a009bf68877406daa1ba278370f38c25827b176088aef55dbb3492ba99a0f81093165211810457cc70fc7d7aca283982f07b0c2b9b8d2dbe585798fc

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Phenomenon

MD5 b32330c50f312bccc185650c3b7c6b69
SHA1 5a26c0bb1bcc56fefa03f964f96e4d22806e9062
SHA256 b58e65919f7e1f7e1bc9389775546473f91162a539f6954caf89beeef6535d51
SHA512 d571f3b1690628fde595a128fdf0acda8df9a452cf83cd5586962cf04a89ad0409d5efc5da7946391b28dcd9eb180294195db4e5bf9bed862db07934ede66978

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\Cycling.pif

MD5 b06e67f9767e5023892d9698703ad098
SHA1 acc07666f4c1d4461d3e1c263cf6a194a8dd1544
SHA256 8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb
SHA512 7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\389546\I

MD5 babe65ed34141cf5f73a21e84c06349d
SHA1 6571bac8d9e020c2faf44dd312ef66b51d733ced
SHA256 65807df1cb1ee39b8d544e4a4481bff18ba6cb803d0de93345c6c2733012ceec
SHA512 deac1458d7cc988cc8df9943563f0944a254d1137166ea973fcc499617ac819de7105df2a7701275440bce61870d61f9752ad490e09d54e7d5a031f1f8abd67f

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\sessionstore-backups\recovery.jsonlz4

MD5 096c9a2ecb5b91e54e1bdda806a8db06
SHA1 98a76dba4c7b31c3fbb496dff2741258b0e8da65
SHA256 bd82544549a0ab8c56c355e4af1bccee02b2e64610867ea65cd9ccc5de65bb01
SHA512 5dfd4d24b0ec87e51ae9b63a7446313111e1b59c1cddbc4305a4674fc6163256aa242bc0cd219e5150db9f855a46e68a9c8b60607f1ee63d176cb2ad0a48bd44

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\sessionstore-backups\recovery.jsonlz4

MD5 9f502eb464b01397adfc44b56ad981ca
SHA1 3729abcb54f8455f0f17c30135e410d992744071
SHA256 8783a68765a1501f0ad7b64be42fb05d9d184cf574bcf736faf37ca16474bca2
SHA512 966022ffb4092b37aa0e713885ca2334a632e94b2a9813e70e7606514c7d0115eccf88819e87ff33cd26e683fcd550783b944a5536c4d8a9038a27b58116300a

memory/2076-2808-0x0000000004A50000-0x0000000004C96000-memory.dmp

memory/2076-2809-0x0000000004A50000-0x0000000004C96000-memory.dmp

memory/2076-2810-0x0000000004A50000-0x0000000004C96000-memory.dmp

memory/2076-2811-0x0000000004A50000-0x0000000004C96000-memory.dmp

memory/2076-2812-0x0000000004A50000-0x0000000004C96000-memory.dmp

memory/2076-2815-0x0000000004A50000-0x0000000004C96000-memory.dmp

memory/2076-2814-0x0000000004A50000-0x0000000004C96000-memory.dmp