infinitylock | 49998dd0366a3d7dff3ec1b6c2add1c0f7283b42198273980025a41942bd8178

max time kernel
143s
max time network
158s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
28-08-2024 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Screenshot 2024-08-28 at 14.57.55.png
Size

419KB
MD5

00345903f4db4bb2c44099a766cbadb0
SHA1

9fba40eb3a9ffb65b24c98e47d36d99b56fe588c
SHA256

49998dd0366a3d7dff3ec1b6c2add1c0f7283b42198273980025a41942bd8178
SHA512

efb23c5a838b2407d9b5544dd864734dbb8c892c445cca6f3e41ad8a77ce73e9f85fc6be960981de840aed20b4190f322742d40dbc4ddaa1de8e2b4d6876984f
SSDEEP

12288:m0EHCJmoNmRxMquJhItGXNBd/GyUtlsUVhVg:mviJ3OM3nH4yUt19g

Score

10^/10

infinitylock discovery ransomware

Malware Config

Signatures

InfinityLock Ransomware
Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
ransomware infinitylock

Executes dropped EXE 1 IoCs

pid	Process
5636	[email protected]

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
217	raw.githubusercontent.com
218	raw.githubusercontent.com
215	raw.githubusercontent.com
216	raw.githubusercontent.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pl-pl\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-tool-view.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\da-dk\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit-hover.svg.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons_retina.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\da-dk\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\selector.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_100_percent.pak.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adobe_spinner.gif.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\line.cur.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\combine_poster.jpg.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\AddressBook.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\delete.svg.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_hover_2x.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\example_icons.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\es-es\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-cn\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ja-jp\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\close_x.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\main-selector.css.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit-press.svg.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_nothumbnail_34.svg.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\virgo_mycomputer_folder_icon.svg.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\java.settings.cfg.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-disabled.svg.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-down_32.svg.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\root\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview2x.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\tool-view.css.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_close_h.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hr-hr\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-si\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\example_icons2x.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_listview_18.svg.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-gb\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\Microsoft.PackageManagement.MetaProvider.PowerShell.resources.dll.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOffNotificationInTray.gif.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\app-api.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\core_icons_retina.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-si\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\tr-tr\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\uk-ua\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\welcome-2x.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\css\main.css.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5	[email protected]

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	[email protected]
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	[email protected]

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E239EBC7-6577-11EF-9650-7A843C112E25} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "51200"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	PaintStudio.View.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\InfinityCrypt.zip:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
6116	PaintStudio.View.exe
3984	PaintStudio.View.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
5824	mspaint.exe
5824	mspaint.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
424	mspaint.exe
424	mspaint.exe
3984	PaintStudio.View.exe
3984	PaintStudio.View.exe
3984	PaintStudio.View.exe
3984	PaintStudio.View.exe
3984	PaintStudio.View.exe
3984	PaintStudio.View.exe
3984	PaintStudio.View.exe
3984	PaintStudio.View.exe
3984	PaintStudio.View.exe
3984	PaintStudio.View.exe
3984	PaintStudio.View.exe
3984	PaintStudio.View.exe
3984	PaintStudio.View.exe
3984	PaintStudio.View.exe
3984	PaintStudio.View.exe
3984	PaintStudio.View.exe
3984	PaintStudio.View.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	3888	firefox.exe
Token: SeDebugPrivilege	3888	firefox.exe
Token: SeDebugPrivilege	3888	firefox.exe
Token: SeRestorePrivilege	5532	7zG.exe
Token: 35	5532	7zG.exe
Token: SeSecurityPrivilege	5532	7zG.exe
Token: SeSecurityPrivilege	5532	7zG.exe
Token: SeDebugPrivilege	6116	PaintStudio.View.exe
Token: SeDebugPrivilege	6116	PaintStudio.View.exe
Token: SeDebugPrivilege	6116	PaintStudio.View.exe
Token: SeDebugPrivilege	3888	firefox.exe
Token: SeDebugPrivilege	3888	firefox.exe
Token: SeDebugPrivilege	3888	firefox.exe
Token: SeDebugPrivilege	3984	PaintStudio.View.exe
Token: SeDebugPrivilege	3984	PaintStudio.View.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3888	firefox.exe
3888	firefox.exe
3888	firefox.exe
3888	firefox.exe
5532	7zG.exe
1820	iexplore.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3888	firefox.exe
3888	firefox.exe
3888	firefox.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
3888	firefox.exe
3888	firefox.exe
3888	firefox.exe
3888	firefox.exe
5824	mspaint.exe
6116	PaintStudio.View.exe
6116	PaintStudio.View.exe
1820	iexplore.exe
1820	iexplore.exe
5756	IEXPLORE.EXE
5756	IEXPLORE.EXE
424	mspaint.exe
3984	PaintStudio.View.exe
3984	PaintStudio.View.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 3888	2568	firefox.exe	73
PID 2568 wrote to memory of 3888	2568	firefox.exe	73
PID 2568 wrote to memory of 3888	2568	firefox.exe	73
PID 2568 wrote to memory of 3888	2568	firefox.exe	73
PID 2568 wrote to memory of 3888	2568	firefox.exe	73
PID 2568 wrote to memory of 3888	2568	firefox.exe	73
PID 2568 wrote to memory of 3888	2568	firefox.exe	73
PID 2568 wrote to memory of 3888	2568	firefox.exe	73
PID 2568 wrote to memory of 3888	2568	firefox.exe	73
PID 2568 wrote to memory of 3888	2568	firefox.exe	73
PID 2568 wrote to memory of 3888	2568	firefox.exe	73
PID 3888 wrote to memory of 4624	3888	firefox.exe	74
PID 3888 wrote to memory of 4624	3888	firefox.exe	74
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 1544	3888	firefox.exe	75
PID 3888 wrote to memory of 2836	3888	firefox.exe	76
PID 3888 wrote to memory of 2836	3888	firefox.exe	76
PID 3888 wrote to memory of 2836	3888	firefox.exe	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Screenshot 2024-08-28 at 14.57.55.png"
1⤵
PID:448

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3888.0.1632592494\439276015" -parentBuildID 20221007134813 -prefsHandle 1696 -prefMapHandle 1672 -prefsLen 20767 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f53db0e-1fca-423a-bd41-cb5264464700} 3888 "\\.\pipe\gecko-crash-server-pipe.3888" 1776 1dc744d7858 gpu
    3⤵
    PID:4624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3888.1.1540472269\128245850" -parentBuildID 20221007134813 -prefsHandle 2120 -prefMapHandle 2116 -prefsLen 20848 -prefMapSize 233414 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea84ba43-715f-4171-b8c4-c9823e7f01a4} 3888 "\\.\pipe\gecko-crash-server-pipe.3888" 2132 1dc743f9258 socket
    3⤵
    PID:1544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3888.2.503072299\1100984426" -childID 1 -isForBrowser -prefsHandle 2876 -prefMapHandle 2872 -prefsLen 20951 -prefMapSize 233414 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {39c7c836-73e4-42f5-9d60-a3e1ce2886a5} 3888 "\\.\pipe\gecko-crash-server-pipe.3888" 2888 1dc7445cd58 tab
    3⤵
    PID:2836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3888.3.736838839\1378124648" -childID 2 -isForBrowser -prefsHandle 3544 -prefMapHandle 3540 -prefsLen 26136 -prefMapSize 233414 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {92e2b69f-cd24-45a5-b6b8-b94c29b5956f} 3888 "\\.\pipe\gecko-crash-server-pipe.3888" 3556 1dc78cdb558 tab
    3⤵
    PID:3660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3888.4.969346067\44605612" -childID 3 -isForBrowser -prefsHandle 3256 -prefMapHandle 3228 -prefsLen 26271 -prefMapSize 233414 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a79b566c-0f23-4d8a-9222-377a887bbaf1} 3888 "\\.\pipe\gecko-crash-server-pipe.3888" 3936 1dc6942f658 tab
    3⤵
    PID:3944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3888.5.2092900676\193160242" -childID 4 -isForBrowser -prefsHandle 4912 -prefMapHandle 4908 -prefsLen 26274 -prefMapSize 233414 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d621e05-15fd-46bb-bfd2-7c3b4ab8945f} 3888 "\\.\pipe\gecko-crash-server-pipe.3888" 4920 1dc7c041a58 tab
    3⤵
    PID:5076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3888.6.764473125\1272818929" -childID 5 -isForBrowser -prefsHandle 5224 -prefMapHandle 5220 -prefsLen 26274 -prefMapSize 233414 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7d5260e-b613-4cfd-a4ae-cbdc7adac2a8} 3888 "\\.\pipe\gecko-crash-server-pipe.3888" 5232 1dc7c042c58 tab
    3⤵
    PID:2480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3888.7.217880805\2124302960" -childID 6 -isForBrowser -prefsHandle 5256 -prefMapHandle 5236 -prefsLen 26274 -prefMapSize 233414 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0def9222-6a7e-404c-9980-44f3609a0921} 3888 "\\.\pipe\gecko-crash-server-pipe.3888" 5000 1dc7c040b58 tab
    3⤵
    PID:4416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3888.8.1992886879\1718619904" -childID 7 -isForBrowser -prefsHandle 5604 -prefMapHandle 5608 -prefsLen 26274 -prefMapSize 233414 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {34190ec3-35a6-48bd-8d0f-d5b446c9a32b} 3888 "\\.\pipe\gecko-crash-server-pipe.3888" 5180 1dc7c3c5e58 tab
    3⤵
    PID:4808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3888.9.1964668066\216971913" -childID 8 -isForBrowser -prefsHandle 5736 -prefMapHandle 5988 -prefsLen 26449 -prefMapSize 233414 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc74afba-bbf4-4f68-b059-9806f46a899e} 3888 "\\.\pipe\gecko-crash-server-pipe.3888" 6000 1dc775d1658 tab
    3⤵
    PID:5032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3888.10.881912689\1266227406" -childID 9 -isForBrowser -prefsHandle 6100 -prefMapHandle 6104 -prefsLen 26449 -prefMapSize 233414 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0013a79e-ce81-4803-84a6-7801b27e49e1} 3888 "\\.\pipe\gecko-crash-server-pipe.3888" 6088 1dc775d2558 tab
    3⤵
    PID:4160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3888.11.1218380330\595987547" -childID 10 -isForBrowser -prefsHandle 9604 -prefMapHandle 9580 -prefsLen 26449 -prefMapSize 233414 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff4f514a-54ce-427e-b302-3960f9cb309a} 3888 "\\.\pipe\gecko-crash-server-pipe.3888" 3944 1dc7a8b3558 tab
    3⤵
    PID:4236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3888.12.1727192052\1538916466" -childID 11 -isForBrowser -prefsHandle 9612 -prefMapHandle 9516 -prefsLen 26449 -prefMapSize 233414 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {31611fe1-83d7-48de-a937-f29a6fc9c078} 3888 "\\.\pipe\gecko-crash-server-pipe.3888" 9596 1dc7aafd258 tab
    3⤵
    PID:2960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3888.13.1193495976\1530982197" -childID 12 -isForBrowser -prefsHandle 8320 -prefMapHandle 7372 -prefsLen 26449 -prefMapSize 233414 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {13df0ba4-6786-4de4-bf0f-9c12b0ca6afd} 3888 "\\.\pipe\gecko-crash-server-pipe.3888" 3944 1dc7aea9c58 tab
    3⤵
    PID:4412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3888.14.151680278\1183780431" -childID 13 -isForBrowser -prefsHandle 8304 -prefMapHandle 8308 -prefsLen 26449 -prefMapSize 233414 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {96badb85-49d9-44bf-ab2b-46de53af6114} 3888 "\\.\pipe\gecko-crash-server-pipe.3888" 9460 1dc7b0f3558 tab
    3⤵
    PID:4544

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1380

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Virus\" -an -ai#7zMap22765:100:7zEvent21901
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5532

C:\Users\Admin\Downloads\Virus\[email protected]
"C:\Users\Admin\Downloads\Virus\[email protected]"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:5636

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\LockExit.jpg" /ForceBootstrapPaint3D
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5824

C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
"C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe" -ServerName:Microsoft.MSPaint.AppX437q68k2qc2asvaagas2prv9tjej6ja9.mca
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6116

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\MergeProtect.xhtml
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1820
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:82945 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:5756

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\SearchUnblock.jpg" /ForceBootstrapPaint3D
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:424

C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
"C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe" -ServerName:Microsoft.MSPaint.AppX437q68k2qc2asvaagas2prv9tjej6ja9.mca
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
16B

MD5
d2f9ec5f413a99203c9bbc2afadf0f38

SHA1
53fa2e1d494d2881ae32f7ca3d64f259f80c9a3f

SHA256
93e4e08517b6233f487490dc772beff46f15744e485a8888d58bcb81dff111db

SHA512
7c2a8e94e636ca2ce4246ab6b1783bfa848a4fe0f71521cf17c99c450043a60c74c57dca544d0635fb7fb114648bdb71f1e0b61ee6c8cbc96c1bc1a83c9695d3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
720B

MD5
7ec55d88780c66e1191415cf97e01fbf

SHA1
5a50a6d45d6697f48f770307e9d790bc8f880471

SHA256
55449a048932780926bdf3010b68f4fcc3d935090d8b70f9c5942abf9c4d74b7

SHA512
626e9004848bbd89f49c955f57b03f4f0ea965a3786088b0a1750a436dc277a305bc0f88e598146451ea4d02fd0ba82285c3287123ef24d949cccb603e655e95

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
688B

MD5
9adb498b7cefb6fe8e51f6810175e7dd

SHA1
001b2cb2d06e14f8b87148a9603a97171335ec5d

SHA256
d58b9d1b2dadfcecdc01634f8c1fd0628fbe8be0e8e62cd933797e02d7448151

SHA512
bd7561edc1df1de2add84f645f2f223b2223e06d9548c9c5680278151f3cbf7dc99d50dab82f35762ae6d4b18a336b4a173fe3469d2d36579e64b9ac1996db48

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
1KB

MD5
818a0e085d091b3b22f89d1f14d9643d

SHA1
72e84c310a10f9bd3b1a8a6a00b96608dbe60ff7

SHA256
4567895aec225b411287b1bc24f8e4cd711d20de0d145293e7da2edcb56195e0

SHA512
93cb02b6c9ecc377a9b3a7af4cf4f8458e1cec715f9e6c3d87b47022b13181571edcd5010ea4c0b56d87fe389710d93108a5258df4127f12b025ba6763de54d8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
448B

MD5
95108b3de9d59ccb8ea72f7af5676937

SHA1
48f9963fbbaf6ed88b3c45501b96d96774bac814

SHA256
33fb7c91e83145ad016b969d2a02504973653388a7afcc0e1516713138f672d5

SHA512
4651e60da50c209b9da2597171865729e3dc32be8905415109683aa4f54eca83c39d2a4426df60c540d41225ed19c1ca2eb6a80b56f0b9ac63e9b9e5fb92aadb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
624B

MD5
389e816ed06bf70025b1c72e176e0a80

SHA1
c69bcd2bb7dc0ec4a7bda855fd845013162653e9

SHA256
ed8d2ddd8da3a8cbe8e0cb19d4f7e98e4ca4c9a923fd6ca6c7749425ac56fa83

SHA512
59ef79fb11eeb5c4dba8ba07b3720ce79f5e6ad2f056282fea275afe639e09ddd247c99f68260247939e8d5300ca6fcacff1b46b141a44e5578d782d4105fd71

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
400B

MD5
db85b5dd95fb00b329b8114efcdf31aa

SHA1
fe3313c08ddac833db501cb875f2dfeeac30e5e7

SHA256
24c41b91510288e643097d1272e4321582cd90e0ece2936819f93fe0e0340cba

SHA512
c181ed2d4e3b49cc18e25fe7c327fc1bfac112dc63e197d3ac07a49ffea659f51efa8f7a3206c318f55701cbcf6e422416c43656ae2d6f8a70460ac65c7991e8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
560B

MD5
7c2e7be33baa2d257ff759deff76f935

SHA1
0221d6694bd48695d22402c946f19bebf6f6f0e2

SHA256
4771512de5392c0992a47a92de6e0fc9721951044f1f000407967bf60798fd8b

SHA512
945962754497343ffd7d91e1a30109b936fbddaeb6702cd237d3c4d51deb6589d77ffbb9c23d0496d398fe459492265e26b499469ef16c98a8e63c2282f056cf

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
400B

MD5
e5b7359da41c77c32235536a83350349

SHA1
b3ba0cd3a3a89c8a46a25ec6351054047b81674e

SHA256
4a34266ce206dce9c1b45c6d34ed07bf6dec6f9555c21a26744dc84863d11e82

SHA512
6194b1a1dc659f099fd0c18124f0302fde163512976385f23e3959816a6cd2ce5f754de7c4d26e3eb06e7cdc536703ffd223805ba3c0cc783fe06e969dfa68c9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
560B

MD5
2e4156260805b717739ab3b4a3dd5897

SHA1
8a3aef621bb0306a992cdc114e07312b606ad4a5

SHA256
9027a14731d1eb2d5e4217171479d7751244b595f7cd51fb077193cd4e551102

SHA512
d991baee22a7171cbb84f874060408102c9e50c62d94b96554e66c361d6358f6e0fc947b6a8dbe05280e9718f40c093a369198b485cfbca4a620389082b59401

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
400B

MD5
01edcc676927fe1cad2462aad1eca991

SHA1
a206f0c4d8aed73f2f47822aa64702e2647d9db0

SHA256
b2b09f20acfc7fe3644e2ac62c7fed711546586673a3b64550e78616c1d09169

SHA512
173542932346e521b3b5601c7cdd2ddcc5923fd86443d38824bd967eef387f1efc661d9c3eb778b9864ece2669594e3a7fcb1b4376d5168c085dcf16a9413a15

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
560B

MD5
0421438a50332c01638658cf9f2dffe6

SHA1
9a1e6856c23adc34bc3ef51df64480f5ddb3c218

SHA256
06cd6664515c4078dfde5790c3c957676ac999357519c9dd1dad728ed0a0de11

SHA512
69811ac88ee57c3b16c7ea93574b63609081f8c5a239b1dfb17c113ae17fb7d710d9072529fc400df3525d57f80036789af70cbfff695cc3151d4eadb04a49fb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
7KB

MD5
71554e5de75dcbfc078fcf3825d16510

SHA1
fe142b5e326e720e0849e3ec7317ac524cc242d2

SHA256
8f3b1dcc8ed70c2a36bfdc77ca85384f346a3a144d577987a7d0616e29fad2bd

SHA512
b46ba8df232d0e0a0514a768c097ea1cd2b2b041f13a36527e3c65dbe56673f2af74afbedbffb85419d982e428df88d21cced0e97837bfcd5dc89410f7ceac04

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
7KB

MD5
b0971d81c1c7d5ff3cac6395c7e2a58a

SHA1
f4677e9c808ce9d46bb0efc6ac448ed2f7dbcf37

SHA256
1729e12e87758ac4185761435f69889b70c2b6e2c6d2d90da9bf78dc4ecfd65c

SHA512
f15d8aabc9b446c660657242aa446e4c2931340619666a093250e9b172631312986812751239823bf07b1f05f7e0894f0e612700b1bd746d0f2da06363ebe52e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
15KB

MD5
6c264ff8a988add585130521cbe12cf4

SHA1
3ff1a0b63e4cfb8ed17d4974748d1cde0e5ff6a2

SHA256
c76581dfce487296b814deb6ba49118e32b417c39e95c222e2353b321a53cf9b

SHA512
7e127bcb10e4b5efbd3646202c537025e79c92d70c602f6440f766d09146334ad78632488c485ea26f431b5fe43a1b55ee3884754ece96a33e9df54246908bf7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
8KB

MD5
b5925bfa3215c87c492242d0303ce848

SHA1
65e1ba1b4331f3773ffc1ecbc567bd454f6eb99c

SHA256
cc57c155d2d315c5660babe10fdb932344534860ad9009b58f566d13963ee3a7

SHA512
db46fd6fec73c713e93781258e335bb1233b3efa60c0a78d74fdda4cb5285fc00a008817e0832f63a9b1c53204c115286d64e9e12ec528948c92ef3b7aa0e3f5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
17KB

MD5
eab607b7cace1692cfb0e53d00ccfa80

SHA1
38f1ac9b166f7079562c70779e8d75886c2f9b29

SHA256
9a159768a2e0c44a4062889ecc40e742b66447d716e080cd5e78a000a25aaf2b

SHA512
c47971053cb413f067397ee2d909710c654d0139137cf78a4b34f9b723d40275eb6adfb684fa45267b5971e28800624354ae891bee48092b260f0988ca85e933

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
192B

MD5
24b02dbe8bc33946ae5d122ead38d26d

SHA1
0aeb274428b2e822a8ea7e6434f629c1dbe7e096

SHA256
ae545c1a13c2d98b5f8bd9ca478773caf0d8ef40ac785f3b38fb592fbdd2c297

SHA512
f696c8845717b5e2c5fe0c719853ff9c36c885ee8668eeaee9461eb2315ecf896053c6a29473632604c0ab07bf208197595a7421802ed9d8e94622d8b0e4ec7d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
704B

MD5
1bd7831b4b84de6cd8b92eeb950a7057

SHA1
f178691a368495788f02960d332e9ede1c144a44

SHA256
ad4d40f0f139717ee996ed2d89d8fe1bbeae8b3183d5d21905407034bb45e65b

SHA512
1c3ed01f60ee692bb8d347c541f82c58ce21d2f0fa135b019bf90c9fdf052e4370d42ace9cf8a6ead70792c3635856be9c927774ede06a78f4d53855de7876e4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
8KB

MD5
9ce003d2d94bd7356a11867301ab8ebb

SHA1
f497a5160a790c56df9d36afe390bb6cd0938a91

SHA256
d63dd72570eb56a212c20a15539340809981502f0e67b5de7b5d6b16b98e7e93

SHA512
50f32b51f0df62ef8f89f3652083cfbc324eabf7e534c47b2418c518dab67a31ccefa6c286d9cf8a5af2a634b483b13a023cce2405c58f8c8c70819df5aeeeda

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
19KB

MD5
453aade8a62c119b20bfb0b8e555aedc

SHA1
eef2b009999615e59612a24b361d317e1ab035dd

SHA256
2c89dfce0c0a24b23af3ec276803d6af0dbdebd3a4800895c63ba87945e2bbed

SHA512
c88f215bf53c4cd2b3fe54aa3c629b452b612090c8dbddafec4a0406eec00fdb29394ebbbfcfe134e0023f36f05102998857e191036b04298a463ac1c3fee60b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
832B

MD5
4f652a1f54ccd0305cbec2b4306ed742

SHA1
1175d614032d296bc60d249dec21cef8a8c3fc72

SHA256
8e45b34382476d229cfa7269a28b567e921d842f24ff7d670936adcbf19aa3be

SHA512
444ea69c5ae8a07a751cec592aaba074f3439217a5619ddb6ac6de475266cd1a5f91db14fad890fc408c9d2d1bed006df9ca7f6e3e327363968dda975a7fef63

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
1KB

MD5
1f7544bdfe432403f128afedefd3cee1

SHA1
bee4faa5bc36e84268f0a43ae2913c43b3e35e1c

SHA256
7f4c6ac3e28d28404e2c3f1a45da69dd3fed82be5d8dfc6c4b41e0e866a5c730

SHA512
93006127549239c3f48ef18210f6cc47403561c7383f57cdab634082e56f0899f699e32fa8cbb468f2c074be51269d25d8ce45f060afac3a554e9251e61ecf75

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
1KB

MD5
c18fe0e110e31a8f7895b57137d724bd

SHA1
ae4176a72c8c6a69a3c686b117b59dca25829ff1

SHA256
6180450f0e50fb00496edb46b61b7c2e72f690988386b631b9a0d7ff2a22d0e5

SHA512
e3a8600123d95660ea10d542135d99af0fce93073d420aa2613d859e3ac0c79cdeaae2258681fadb7e45357f19cbce9e94a034125a8b66b2f113392ebe1df2d6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main.css.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
816B

MD5
b8a8abf2767356dd975bdad46aa3b9ec

SHA1
685b9b229dbc284f3126d560334c5ccaa2fc916a

SHA256
4e6a61f330e2ca3de1d6f9f488bad8a4a307a4ef0a1789b488bb7242f02f2b7c

SHA512
3adeaf6f335b28f99ae327a13be187fe2d490d9f02ec5e824524c33652bb9b10e1b01c68ea9db3d42b54499bd8319527516d23195b86a9e389b9e3328ff3feda

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
2KB

MD5
30771a649cf8dd77f41a8f8deadbef0b

SHA1
48832f2aaf696f999ecfa3671505c104628df7be

SHA256
0f66151d966f2ebfbf69b2516d912b0703591a5882ce58b33c58052d1cd1c39c

SHA512
ca901caee9b2cd29d27dce0e7e48e1f27a2c9d0d4e634b7674fa16113cf514c7052b55a5368b4e5db53699ce03253b94d2cdae4e1f23af2d1ec55f2069abaf77

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
2KB

MD5
0992a5f1fbb702c80b946f5068db9072

SHA1
fd65b7739396b9dd621c82c266923d7e0c482815

SHA256
e520d0f6e5dd9b6889b085aafdba1d29a3c8f73349956ec083f106c2870d7a12

SHA512
986a26b603a5b1579f48c1c5dcdcd44497676d43a4498ca1050059d4c97760d5d806510b27d50cffcc4ee229f35704229cd7d4979ca78c9e8d697bdbc12080d9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
4KB

MD5
5055aeb8d79ced633fc326b29675fe1f

SHA1
3e2ce4444a8221bccd656fa82ca0b111f4d928bb

SHA256
c582070575f321602ec145cf3ee396892cb42e61f79ebe971122c087bea8299f

SHA512
2e57f3576cdb0d09ca5eb6fe88a0d16df716c7344cddb39177835c0e2b21437716da73651b3a15f664ed9f548a123cb8a69fdb27793c1a70750eca5463d2a58b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
304B

MD5
07dc7bdff367479525be6fd26bda3c5b

SHA1
2494fc4d5af0c1ab23257659d0583c9c97c851cb

SHA256
742f51d9ebe364368f92fb3aaa213adf3c621dbd3f95d447a26e3e732703af80

SHA512
52e9d8b6e8b300196dc116a5488388559ea31dbc507b52914f97df35138679f9ba723ab32cfb3709828cd823aaf9d14ff4c14e5ee64df9240810647a154167fb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
400B

MD5
0de7fc38c1817b6cac7ef4891422449c

SHA1
638af49064f2a79c5c1c175f2486ee0ff2bc2430

SHA256
f6248cd247cc0a01cc9483db3b2c81ee096a83d2e2acb4c4e65484425fe5857c

SHA512
743edc89528b8e6c2255da2daad098ad23559e9b88e124eedf768b77c123ea1df19be0a5511cc7115601831c6109970960334437318d1fe1349354851835bc88

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
1008B

MD5
a34163f14fd3a1672895d760d077bc7f

SHA1
1b0a9988c86170388be6b3818e6bca3eb56c4082

SHA256
7f5b64d8526a497cb5f50da8828f67dae6a45567d2efa3a7d559ad4b32cd599f

SHA512
4007dec3e295ca938a0855cb5c519ff33199de4c5fbe2c77e32504e021ab95a1a68d6e8aeeb1f8e07885f86e7bc096b772bd46273ee2395a7d6e4ee9051ef154

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
1KB

MD5
d7f1e1cd1b6d3573755106b5fa33cad9

SHA1
edd261ed3e031812201477729a041e6229a91c4a

SHA256
cff2cf2272a650a1de26b3a82ca1953754116f73836dbd5768f0a8c639b87c2f

SHA512
2e839fc13ac0e9a3572038ed4c11d279383e44e26da2413537e8713264956c0892a150ae60a92ada552b74382f2bdbea9a53a570a0fc5899e4937eda589f3990

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
2KB

MD5
c9c60fe101271c562ccabf09f72bfebc

SHA1
c30eeda5152d6b6233f5fe90c9399607c8320fd5

SHA256
a416b92c2a7a7015f8c0852947df4ae2d7c71e725646a90af50a70d9b49415ca

SHA512
52d7f2232a30695c467e6299549cad047d41b55ead8c2728c069ad33632c5e40f2e2105cf0b7df8db482f86c8a03f23d7f6c1d9a950697384283771a91a9d2cb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
848B

MD5
97a2afe81905a12cda0d2e1f1f446447

SHA1
61928634104098c6b82699d3548e7af6813afe83

SHA256
fef39c9ec9004dbf698765429b87b2d67e7406c06656260d185416262b92ac7f

SHA512
1fedebe4e847f5ec13177a661e61f68cdd9911f58d510145c434fce83ea70b8884f1e0a489a40ee785ff5ab60134d2b96cc59ce4ddd95126a6377c35adee632a

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.F05145FF13D07BFB9E1B67AE495DC794BE07CEE06480EBE59FBF61418D8EEAA5

Filesize
32KB

MD5
d34cbd35ca7ca70ad67cb06c33a2ea6c

SHA1
3f40ed8600ae219246646e17b3b6ff9ed363a91a

SHA256
ba6ba2247fbb2f85038ab0b3100f63a763fca33c41d215d8c6233b1dd1ad308f

SHA512
5597575788a6caa53d89d8ea9dbfdccfad58baf74b27132f47bc225ad9dc6ea8331bb8308167549997f65fa922939c12115b506a0fffb681cf490b199a257239

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\activity-stream.discovery_stream.json.tmp

Filesize
38KB

MD5
fe32b0380381150f940e5c6ccf4021a6

SHA1
6756ca6f6d73f7dedf600227f18e47823ce475f4

SHA256
28f0b8bc1114b23d3000aa52631a40d69f4194d3f07fbdf1bd925fd6fcf1c488

SHA512
4a3dda3397ad437b5f46f252484d32f42690a0a7a2bd934d57509ce0fcbf89b6401f8e78dfd618eb9d8083dfbd3e050db1ee93694123110d0b91884d3510edaa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\0A73C6E23F02820E5C7F05AD9890531BF91D87DB

Filesize
111KB

MD5
214065779aced05d96b01ef5d3e607a9

SHA1
8e8c53bab4fc2c3d792dc439c4147a6523995e78

SHA256
977fc1d599e859d933f3d3dd20018c79d59675458d5d816072d119a1974f2cb5

SHA512
d06dc3561e824dff48005a37b91af03ae9da39eb672ea4b08ac1278a2a5b8812a6663b82b32437bae7b27e3099ade077895bdaba9fcbe69d71b8ef95e8496882

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\2492994A253B970917AF5CDF605580B1C2DC16A0

Filesize
63KB

MD5
6a57c0c0b21b27074d809b74e7dac25e

SHA1
03ab307499348beedee14c0095aa299276fb453a

SHA256
38099d9899acbf19e68517536fe24a337336357d2d2aa499ad34e7b33464334f

SHA512
eb9689dd213b9c0af7c9acfbf51888acc976d048f89af346fa832fac12c4c94fbc0214167afa239ecdd553fe200ee9084919e1d619ad6a43f768437e33a06db3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\24CF4BB13D4731EEC801D333E1C7B2FAA6587ABD

Filesize
169KB

MD5
fb97ba0314fce5fbea943b99872761ea

SHA1
59642cc73bb0a6a1a14fbac53b09ae11466a93d0

SHA256
f34a8eae56088b1f145af8d65aae92984e98a0dcc4f1d45f31703cdc670ecaa1

SHA512
114cd7d15eb2634551a50ad3a28abd7ebfdc62f6c7361aa179a8a1928f63b1a6832ee253c18b531d73bef1662b09ba59c7f193b7511f6ad062a54af5cd137e83

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\27BAE15D31A1425FF794900F95060591C0E53EB8

Filesize
99KB

MD5
d455459b45f55cd4d102ab8fe9fc0989

SHA1
37baa208447f024983105b8931b4637559b8ac5e

SHA256
d9daf5fd2ad8f35ef263651549480247056f311839b40190b5054f225da8fa98

SHA512
b4582241480f09c233642719b932f6041fd77fe1ddd6f41a8d12a8bf6c071f7bd953efe644b821615f43192e111d8e6a2885efd882615ccb11378c8051944649

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\46C625DB4964C00323A8EF4C60828B52A454EBB4

Filesize
1.1MB

MD5
966186806af69fd844bfb9c095a82cf3

SHA1
243d46fd0472efdcde099828b8accd664c846889

SHA256
2c83e341209f372a87d364999010f8dd7b46af99e784cb1dbd50e079c466007f

SHA512
0fe0d9fff903ba3f54bd1dfac65485d8ce8658d5136af823d3a15099c2fdb49e39aae65e855657323e98600131d5474985fc0adebd84b5323b99284803e1a603

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\48A47EAC8EC8EE25810802BA64372470CA6C739F

Filesize
197KB

MD5
a217662de708eba1839904ef55d24084

SHA1
1279038295e70eae638a137044e370f44327e33e

SHA256
a4b5a820490275aacfbb26c2328a8e8d2d2727c95e96d75ade90f0f0eade964f

SHA512
d075c850a49923784fc1c576de441f11d57af63b5aea634be6fdc45e7ce71df1eb31b1d0a81ef355df57b7e15faeb933810f14c8f0d8bb57fe65bf481bf49760

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\4BCF7D608B2663D7D1515223C0F13E5D72484770

Filesize
14KB

MD5
3824f1083122a79fe48c89c9a40fd6dc

SHA1
5bdc2a4fcef3d170963bf3fab0c213138847a9c6

SHA256
74c0c3c866d91bfe99674f65877719a78ada6cce1c23d9991e386bc8043c4771

SHA512
c84cfb7a200d6b25d2efa970d65080e775f308d7ac23cc240b5d82297fe18fa5aa3c6ce3420db3f877f4313bafbe26b6c5b42d7b9ca61602b0ca3dbfd8882cde

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\53C8C46F04350B64D691DB4860BD34DEDDBDBB16

Filesize
97KB

MD5
e55f14b83b40b6d6ce774983b8aaf199

SHA1
5fd6a587eda3756f1d66344c3ea3617dc8ba6f80

SHA256
21c2e506b1e029464ac980295426a3769338defa95120c18776e90b4deaa062f

SHA512
e54df448402f243c43b09df804142318f1ea35a774abb7816eaa3514b936e0c2348ab07ef0c083c51b2d23543105323e3fa39053e16bfaca73073a30bd069637

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\6DA69A746F9687E1FF413119EDE7AAED2F9783B9

Filesize
147KB

MD5
b0798244e97b1c462c3c776d758759dd

SHA1
1d96897ced8fe25d854a1e746b36421a52e18140

SHA256
54e05767405ce95d5705f5bbf49089072985da81c4ade9886fbdf8abac1cadd1

SHA512
3f35dbf9dc7573977b7d84ea22334d8981e9c00c83bf9c36012e6bc9310f96c8832e989eadcf18f64c8b2b84cc813297f6a9f0da9b90f76212bbafbdd72428b1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\7F30F53457983F11F2D61636C9FB5706ED9AB60D

Filesize
16KB

MD5
2728b4a7cca7e72a50fa43d94eda81cd

SHA1
f1e0d61f191baaf61e014c757fb58d3074aec022

SHA256
656a0738064d998beddcde9c7f230145692f70c9097a12926c22e28900534ad7

SHA512
cc62bb4957959eb2ee0ee5715493fbe74798b1b2d503ddc15a9920195b34bc68c663dd811d85063b546eb4c9dac5a8752853a660f70b0e99173e9821f0e4f536

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\9695EF6C5E0CE18BF6742C5C0EE08F02BAE83E2C

Filesize
166KB

MD5
f5e8992f810763eed8dc84fa36b88f83

SHA1
c877f00c076a9ee7c99489a6904940832b33718e

SHA256
b7c858cb3916d6eb90290e92f655e477196d683bf8db9d21b5729e58890c8bd9

SHA512
c011b2e261493608118fc4915c8de012f05add8bc8470b1371be93d2d90e04a7de2b3e7ff93166cd2b4a32d320095af441acbc0f3a228203d19b8bc908bcf1ad

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\971254C7341460E85C93D0821B91E9985A0B32D6

Filesize
2.0MB

MD5
f2270688ddafd1fd248e402d3a5fe019

SHA1
889c3f56c9e83f6363834719d865e80674ecae92

SHA256
3e786aeefe5d81b9918f2c388a790f97d87666ab0d5970f1cf474287e225611f

SHA512
c08100714323cb6e57fabc866665f8b71a7361b227a2225e8ccd24da65ce843c185594136f8e8347720ece52e67972abe7e2abf46a34d83467e9a0e24f67cf3f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\98AF737DD946CA3B37F8CD63EC1E1756F57F2E19

Filesize
68KB

MD5
f0f62ba1e5ceedf7c5b5837f179873c9

SHA1
6b9cf1c15f8161b694a4f6fbad816e497dd69f1a

SHA256
f1b136304cac8a338e0b14df3b4cff89fcab74dab243cad3a17da1671fd70d95

SHA512
250e2cda344957c05646e7c831287bcdafc8ba2532983034e145b65709c2e059548d93a6fd7c89bf963d00c51c623eeb0eff85a5ec00111f43b542baf75b010e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\AC6959268E349C7B5497A3867D6DCDC4D543431E

Filesize
13KB

MD5
bc38523f0ab500c6a8e8fc9b6402cbec

SHA1
d0f39d77c47accd966a299655e5661c75069bfd5

SHA256
f02d4d54c0bfffe3ff21e61e623f6222042d9e2f46af8d9a6032797343a89e9b

SHA512
b5394abc1933ea7d9080ec2218e17ee409d2d89d3f76c4ce75be284ace9c494afbdc5625450bb766064012accd2bf3bbdad05e995d26299bb188ca822dfd011a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\AD8185C100979BEE2403BB5F3C0072BB1D314C2E

Filesize
70KB

MD5
e0fbd819250403840f86bbda5369fd47

SHA1
4b13e10a69a6328efe169163998de73fd77219a2

SHA256
89b2e12d7c06135a2eafc02666608456285be5127ac1856025ded6efa2d3e431

SHA512
bee1b5cc27953bee74fc1f2074434510542d6096b01689a4980f83804e9ab5eccf4fc93cb0ea6357612d213a4119776c81247ec08683991a329908ce90889bdd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\AF6E7B7DB9908D7B867517AC33D094ABD56E38F7

Filesize
14KB

MD5
1deceadbba8e2bd172742b2c3663dffe

SHA1
68da911df524ba97df6fea560f74358885acb212

SHA256
cc8b46ecd8c9d128a076bd0eb14b3e6c62f1de45334a4c9bbc85509a0fa3c649

SHA512
4316d63d241c6e8198cfad95eb2146a02527c8e72af9eb1017f2c69b43a0aa4ab13c2bb1c7d88344e142475f7adc225fb06a2d06cee8ef12d8da45d404b82374

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\F2E5EB143D82DFAC8777E8A98874B61B072FCA68

Filesize
71KB

MD5
c0748b8b2a4f4adba558b2c6cb0c034c

SHA1
4718928a793e881a59858bf0a49343049d5b6000

SHA256
bb8b2aa54abfdd9ddd730ca706f6ababd873782c91a6b153f3d6840638723e81

SHA512
86173012eed5101cfca0467d03c05295fbb83745121095e5e09a3b57401d2cc0f09589fd186244402615d4449ed93b9606cee17f1cf0afd75fdebfa620037e2a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\F5A1FBDEF4E6F115791D6C8EF1598942067B8080

Filesize
14KB

MD5
09a452db2326a87a23bf65ac27a19b41

SHA1
c26763a2e3074f4c95d772783b0cb1c372d667af

SHA256
6d8835195f810c7d42919185b775be0034dc995309d19e46e0b57c0ee9a3ad88

SHA512
1500afda0c12cee1e7ded666a02324ba3e1c60554e91f676643f9c11f2dd10963411f0d88fc19d8efcec1276e4e0dde24977e69ce75553d37644d95015af44a6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\FF405EA908A0CDBF948198368567C7EC073C7A02

Filesize
18KB

MD5
13fa6da1248afb8cfde0c3e4216f8477

SHA1
2849f1bd95c489e6d01b0981f4f347c2b3dd5019

SHA256
9a30d2ab8c88944baf791c7dd99da163ad1a49527191c416065d17746929a6e0

SHA512
ef6188d0ef8c31ea4084ea0cfd75ba5c7d6f95e56cb908de9278694c21a78f477887a30b1873dcfedcf5d9df601802a5069a58ee7512cc95fd7ab8789df5dfde

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

Filesize
233B

MD5
a3d55e252cb749e933d6f9efc46b727f

SHA1
8de94390cf7e0dd7ce585034deacca1baac0b3a0

SHA256
3b06f42b185ac90bbf25dd6ae8126fa8d41f5aa7af70b7eb62e218ec58dee7ea

SHA512
9d041c49fdc9506f41fccd7e3add91d816fe5ef1fd06ad6d9ba87aae94744e596d9caa74a20ecfbcd0466d04a9ca21c36fc5a0599994476ec4b7452f6223e6f9

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json

Filesize
2KB

MD5
404a3ec24e3ebf45be65e77f75990825

SHA1
1e05647cf0a74cedfdeabfa3e8ee33b919780a61

SHA256
cc45905af3aaa62601a69c748a06a2fa48eca3b28d44d8ec18764a7e8e4c3da2

SHA512
a55382b72267375821b0a229d3529ed54cef0f295f550d1e95661bafccec606aa1cd72e059d37d78e7d2927ae72e2919941251d233152f5eeb32ffdfc96023e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
8d71c67143b76b09eb2cd2ebd3cbf9bd

SHA1
f64cde384868997d998afa8cde3b235e7c7bb29a

SHA256
5652ac830ae15c19d84c9cd1c7e4530017122308b2aba7661aca03051dd4b0f2

SHA512
08bb130b2406acb2552bb18d70d2b58dd128e67019243b6f3f7acd6b610dd2fb0a5898bb7eaae6dbc1c2c3361a5d8817903d5b346e80a4d4e5380b0f65d1c622

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\10acbb06-8cb7-47df-9997-d348bc0d8a40

Filesize
10KB

MD5
8315a883a911552864d229b738bdd5b5

SHA1
709cdb63594d15258111fa30b295519aebb51990

SHA256
3a20c92690871519dfd72978a607bd9159aef0f42e555262688739634eaf6959

SHA512
91126b355e31d4b3ca05b85fae83bd41eae6cf2de772e6c18f017ce9a652685ebb654b3e3c7245c7843763900aa033fc7ef3b43a661a81e32e33bc0bbe38097d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\3a05ff5f-11a7-45ac-a2b7-393d6ff55861

Filesize
746B

MD5
85f7a16c31d3137eb6c3f82d4e9af616

SHA1
0484119303388e863f1c5ed3f158539a9adc4f5b

SHA256
c6b0950e2c50a7ea48aa7c7f9c72762bbd1321deb8ffe84e770464b747af97a2

SHA512
f6e3feaebbe5a734a9101db24bc782330d206a53e1a0d93e83f3b3615f29bee45b136eee27c9fd02d206ea8ea0f89610e03e56ba9543bc19d5745ec6031998f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js

Filesize
6KB

MD5
8569c5db4d62e6f31c0be416b8f1603e

SHA1
661503bbd162d26028dec657ba8a20d6ad196bcd

SHA256
888a2d3c2ce63186378222ac63f9f91904cf136167db1d8962c6b10e81934248

SHA512
d1544eba0a140099f9e6a09911353f9e84052647f25266731b20c0af4968e308dfa8eaa04174173a231d827245ca3f9754a4031f4e8de8f0bf5af34ad62032bb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js

Filesize
7KB

MD5
ca60dcc36c4671c62b281e87891bf809

SHA1
126c5992469bc8daabb06e353e8858073651ec44

SHA256
912d5a82f6276ad9a3bf1ba0bc86f09f1ff052da98e49c546b3fe398cdedcd88

SHA512
c033224514d57a3bf7344bfdff96f5967febf09a1333b49d44117198347f643390ce4b654759a34e023ed7716ebc6d45b21f239d4f224558154131ac2f514610

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js

Filesize
6KB

MD5
35a96684a6e0eab421efb394f4909f9a

SHA1
95220a4e98b83664757126b4af56dde263056790

SHA256
7574a6f73f7f006fbee26f437a9c8a132a7a3e262d20694ea2ec50a0a1f5947d

SHA512
e201b15e738e76e5d65d03d719d73565450398c3753aa70d5f2f6e790c0beae15fa9a166f3932239e23de26badea098072eea0e1a7704021ca0a3bdf120132f9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js

Filesize
6KB

MD5
2185e17a466e3f38d7cd3c537ecc4a20

SHA1
4f193eee355a6eb38668324312d773eac16c55cb

SHA256
819b4340c23734b275cd4721fefcd4dae8c67909b6f605ed88dafe2b1d8acba0

SHA512
501847600a09b8719a879535840bf8bf6d84ac36f30d7456e7424fe3b3079985f79fd81425833397c831a2f87d860e8507d158d286c349adf5a2c79c71db45fe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
7c8cfa419b05169ce39a3abc40e9e7e2

SHA1
545a59a39e8c032e59fe098e52496456dd4f1284

SHA256
bce4dd6ed4341994dee4bc128c54a452d350d0b86406368a8092eb01de82b67a

SHA512
936ab19bc601ac2df023748e45d401cfbe20b586b2992ae0612e7312471f265188041c4ac4173e27fc0271ad62448fc2623da8318944609a17fe4ac8d2b900b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
b9f292e32072a8c5a510078065473207

SHA1
03febeec953357a453f42622ea64cda8d6d99506

SHA256
c0f772fecbfb0794167aa3d8e040eaed0abf1cb888ec2cf5fcc0ab64d9cb966c

SHA512
391da9f470d836c9815247a372ccec352ed101bf8aa21d6249d42c8d92b62d2da3c1807e72aac7a6541cd426e8533c666408754c8fa348aa02a857e80d2d09c5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
aaf20639fa3c3c9502f8737b1dc36fb8

SHA1
0f8e9ae387a186a2a6fadc74ba0683d2765fd268

SHA256
3dc9de9ca334cf9f45d9a558075bc8b83a2c97965aa829fb68bc2db44962e82b

SHA512
c8528433d8cd073ff89fcdf4ad6157ad44e0a9ba94de47fe9f5629fcda43fbb777ce7dcac7431f1511bac7721752e85e17775bcdfb9312b8293a59724ac5a382

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
f3be8080e4dc1f1f5adacafc7f6a9770

SHA1
25620fc094e7e4a1afa8f45537b526c381d19c07

SHA256
ac319ba7695bc2a8cd264277134f5bcbce1d7ff088ab2a94816c99f831372feb

SHA512
d90d375f2a32d1b669493eb53a21447588c0c0059557a5836aff1ea4634f657fa9dda9043e0e64aba2ae1137512b2dba1d96f04934671308a84fc1d8d14e05d7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
2bbdb043c59e2d2e48d3ba8d99be9908

SHA1
b809e1c52b604f3b3f46877837c90f9c5756f70e

SHA256
ee7e85509a781e5219fb03c4099e4f628532b2f980850dc8a9be4b4bc54fc6a9

SHA512
9d0422a074388c9355952435db0e1aa19a811a6d6bd2bb756ab4b3ef1cb7f5a7e61b85d6e35e603faf3d4da1ca870cf64aa032895c3cbfb97c976148cdcbe785

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
160KB

MD5
5200e23e41c29de6a834cf1e23b572be

SHA1
acc8731ab6db73f0f03dc23e134aa6eec7287fee

SHA256
024e90ad2fb5645d2ff108af9bbee26844451a690299fef0ebd3e619a9486850

SHA512
bdc79ffbbfcdbbe1db0292507253663b377aa5ce85371ba0be8b5629fbde908102a5e8e2981c01dd94b338e3fde7e12827c77f015a0f3cc452213034c2d2286c

Download Submit
C:\Users\Admin\Downloads\ObPqqjKo.zip.part

Filesize
33KB

MD5
5569bfe4f06724dd750c2a4690b79ba0

SHA1
05414c7d5dacf43370ab451d28d4ac27bdcabf22

SHA256
cfa4daab47e6eb546323d4c976261aefba3947b4cce1a655dde9d9d6d725b527

SHA512
775bd600625dc5d293cfebb208d7dc9b506b08dd0da22124a7a69fb435756c2a309cbd3d813fc78543fd9bae7e9b286a5bd83a956859c05f5656daa96fcc2165

Download Submit
C:\Users\Admin\Downloads\Virus\[email protected]

Filesize
211KB

MD5
b805db8f6a84475ef76b795b0d1ed6ae

SHA1
7711cb4873e58b7adcf2a2b047b090e78d10c75b

SHA256
f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf

SHA512
62a2c329b43d186c4c602c5f63efc8d2657aa956f21184334263e4f6d0204d7c31f86bda6e85e65e3b99b891c1630d805b70997731c174f6081ecc367ccf9416

Download Submit
memory/5636-1247-0x00000000003E0000-0x000000000041C000-memory.dmp

Filesize
240KB

Download
memory/5636-1248-0x0000000004C70000-0x0000000004D0C000-memory.dmp

Filesize
624KB

Download
memory/5636-1249-0x0000000005210000-0x000000000570E000-memory.dmp

Filesize
5.0MB

Download
memory/5636-1250-0x0000000004DB0000-0x0000000004E42000-memory.dmp

Filesize
584KB

Download
memory/5636-1251-0x0000000004C40000-0x0000000004C4A000-memory.dmp

Filesize
40KB

Download
memory/5636-1252-0x0000000004F30000-0x0000000004F86000-memory.dmp

Filesize
344KB

Download
memory/5636-4355-0x0000000000AE0000-0x0000000000B46000-memory.dmp

Filesize
408KB

Download