Overview

overview

10

Static

static

3

ee1f66c363...18.exe

windows10-1703-x64

10

Resubmissions

20-09-2024 18:03

240920-wmzxcszdrk 10

20-09-2024 18:02

240920-wmjkdazdpr 10

20-09-2024 17:57

240920-wjrrkszcql 10

20-09-2024 17:50

240920-wexf9szbkj 10

Analysis

  • max time kernel
    378s
  • max time network
    941s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    20-09-2024 18:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe

  • Size

    323KB

  • MD5

    ee1f66c363ea75c297724f7657991525

  • SHA1

    687de3509051640d8e66b8c6499c8697fd0624d6

  • SHA256

    7c65662229d65bd5b6c32a07fe74ab59bb6f45cdd5cc2cb195f9172527f37cc3

  • SHA512

    b864282f1dc555313918df597d343837813d29dc91912f5b64b09add4be0f0951ae5e2eab115e103e5349c28489540485bd998839b052d4d16eaf68569b164aa

  • SSDEEP

    6144:DBxeN/Tdx8YzL+4eBDgelLBL9C53TV5n+yNXavM:DBxe9dx8Yz6nhtL9C53TV5n+4av

Score
10/10
discoveryevasionpersistenceransomwaretrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • UAC bypass 3 TTPs 6 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 12 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 12 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Executes dropped EXE 10 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 12 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 47 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 45 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 48 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • UAC bypass
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Event Triggered Execution: Image File Execution Options Injection
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:204
    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
      C:\Windows\system32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • UAC bypass
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3012
      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        C:\Windows\system32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4848
      • C:\Windows\SysWOW64\Kantuk.exe
        C:\Windows\system32\Kantuk.exe
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • UAC bypass
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Enumerates connected drives
        • Drops autorun.inf file
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:4292
      • C:\Windows\SysWOW64\4K51K4.exe
        C:\Windows\system32\4K51K4.exe
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • UAC bypass
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2744
      • C:\Windows\SysWOW64\K0L4B0R451.exe
        C:\Windows\system32\K0L4B0R451.exe
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • UAC bypass
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2344
      • C:\Windows\SysWOW64\GoldenGhost.exe
        C:\Windows\system32\GoldenGhost.exe
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • UAC bypass
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:4664
    • C:\Windows\SysWOW64\Kantuk.exe
      C:\Windows\system32\Kantuk.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2956
    • C:\Windows\SysWOW64\4K51K4.exe
      C:\Windows\system32\4K51K4.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4380
    • C:\Windows\SysWOW64\K0L4B0R451.exe
      C:\Windows\system32\K0L4B0R451.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2036
    • C:\Windows\SysWOW64\GoldenGhost.exe
      C:\Windows\system32\GoldenGhost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1884
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4316
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4112
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Program Files\Mozilla Firefox\firefox.exe"
        3⤵
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4624
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4624.0.1699757402\930370435" -parentBuildID 20221007134813 -prefsHandle 1700 -prefMapHandle 1692 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {522a7a39-b278-48ff-964e-cc79e68aa94f} 4624 "\\.\pipe\gecko-crash-server-pipe.4624" 1780 24cfdfd5758 gpu
          4⤵
            PID:2176
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4624.1.1621799394\2071249696" -parentBuildID 20221007134813 -prefsHandle 2144 -prefMapHandle 2140 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3385452-8860-406c-8aef-9ffada451952} 4624 "\\.\pipe\gecko-crash-server-pipe.4624" 2156 24cebc72f58 socket
            4⤵
              PID:4796
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4624.2.1067682590\251120210" -childID 1 -isForBrowser -prefsHandle 2800 -prefMapHandle 2816 -prefsLen 21711 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed0c2227-1aa3-433a-9a11-8ffe4006f142} 4624 "\\.\pipe\gecko-crash-server-pipe.4624" 3016 24c820ef558 tab
              4⤵
                PID:4768
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4624.3.690115584\441616293" -childID 2 -isForBrowser -prefsHandle 1020 -prefMapHandle 988 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a843715f-45b2-4982-9440-25685911a47a} 4624 "\\.\pipe\gecko-crash-server-pipe.4624" 3504 24c83125058 tab
                4⤵
                  PID:60
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4624.4.595339402\1865550368" -childID 3 -isForBrowser -prefsHandle 5296 -prefMapHandle 5292 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4e1362d-da4c-485d-80a0-48ad557f76fb} 4624 "\\.\pipe\gecko-crash-server-pipe.4624" 5304 24c85216658 tab
                  4⤵
                    PID:2536
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4624.5.1590853588\1969480442" -childID 4 -isForBrowser -prefsHandle 5420 -prefMapHandle 5424 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6eeb6d71-098c-494f-bbd4-0a2466337156} 4624 "\\.\pipe\gecko-crash-server-pipe.4624" 5412 24c85285b58 tab
                    4⤵
                      PID:2540
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4624.6.1883128811\340098649" -childID 5 -isForBrowser -prefsHandle 5612 -prefMapHandle 5616 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {09722a33-7659-415a-b1c8-21623dc13a3e} 4624 "\\.\pipe\gecko-crash-server-pipe.4624" 5604 24c85e20558 tab
                      4⤵
                        PID:972
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4624.7.699923355\1357370818" -childID 6 -isForBrowser -prefsHandle 2752 -prefMapHandle 2648 -prefsLen 26543 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b1525c5-61b8-439c-aa74-8c5af080f3bb} 4624 "\\.\pipe\gecko-crash-server-pipe.4624" 2780 24c85284f58 tab
                        4⤵
                          PID:4388
                  • C:\Windows\system32\OpenWith.exe
                    C:\Windows\system32\OpenWith.exe -Embedding
                    1⤵
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of SetWindowsHookEx
                    PID:1008
                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Program Files\Mozilla Firefox\firefox.exe"
                      2⤵
                      • System Location Discovery: System Language Discovery
                      • Checks processor information in registry
                      • Modifies Internet Explorer settings
                      • Suspicious use of SetWindowsHookEx
                      PID:4168
                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:5092
                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=87168D661F5B76344950F8367611A92C --mojo-platform-channel-handle=1612 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:2188
                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=500F65FAD27360DEA47129FEA47084C7 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=500F65FAD27360DEA47129FEA47084C7 --renderer-client-id=2 --mojo-platform-channel-handle=1624 --allow-no-sandbox-job /prefetch:1
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:4344
                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E145BC9348111FDC71D693FAC1CDE9F3 --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:1320
                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1BA6E3C540F7EB10EDDD07450C3DCC2B --mojo-platform-channel-handle=1720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:1188
                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2C368C287010F9EA26851A50C370408B --mojo-platform-channel-handle=2392 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:2956

                  Network

                  MITRE ATT&CK Enterprise v15

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Replication Through Removable Media

                  1
                  T1091

                  Execution

                  Persistence

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Winlogon Helper DLL

                  1
                  T1547.004

                  Event Triggered Execution

                  2
                  T1546

                  Change Default File Association

                  1
                  T1546.001

                  Image File Execution Options Injection

                  1
                  T1546.012

                  Privilege Escalation

                  Abuse Elevation Control Mechanism

                  1
                  T1548

                  Bypass User Account Control

                  1
                  T1548.002

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Winlogon Helper DLL

                  1
                  T1547.004

                  Event Triggered Execution

                  2
                  T1546

                  Change Default File Association

                  1
                  T1546.001

                  Image File Execution Options Injection

                  1
                  T1546.012

                  Defense Evasion

                  Abuse Elevation Control Mechanism

                  1
                  T1548

                  Bypass User Account Control

                  1
                  T1548.002

                  Hide Artifacts

                  1
                  T1564

                  Hidden Files and Directories

                  1
                  T1564.001

                  Impair Defenses

                  1
                  T1562

                  Disable or Modify Tools

                  1
                  T1562.001

                  Modify Registry

                  8
                  T1112

                  Credential Access

                  Discovery

                  Peripheral Device Discovery

                  1
                  T1120

                  Query Registry

                  3
                  T1012

                  System Information Discovery

                  4
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  Lateral Movement

                  Replication Through Removable Media

                  1
                  T1091

                  Collection

                  Command and Control

                  Exfiltration

                  Impact

                  Defacement

                  1
                  T1491

                  Inhibit System Recovery

                  1
                  T1490

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Aut0exec.bat.tmp
                    Filesize

                    323KB

                    MD5

                    d93937449b79f23aa95cff51797b4163

                    SHA1

                    1fd1ec7616c76b63900778222587c59401202f50

                    SHA256

                    45954975cf423a1ef11750c93fa5b0649d8b7d21d8c1cdf034e41b3e826de194

                    SHA512

                    f3cb526ec0c5cbff54fc5c7d62e249906679b8c956a53ef0bb28710ac1fb26cf4d8c8e81cff81b9a2fee22750f871285158c7b440edaedb87b548d37230ba3a2

                    Download Submit

                  • C:\Aut0exec.bat.tmp
                    Filesize

                    323KB

                    MD5

                    2fa4a3c220c28f1ad92e450714822c4f

                    SHA1

                    fe7dbe7e6e5439127161fc188be0ac74ab41ec26

                    SHA256

                    5c41d89eb050ad4ee51b40e48a08f02ec3724d9b4138340d49171dbdafeaa492

                    SHA512

                    95360a327ddc65f74ffed021eb75b8f50820e097818ab9016e573d6996e6f6aa82a76e9a833b8bc75f59150f8f786130172630b3811821d92444bd6262e07384

                    Download Submit

                  • C:\Aut0exec.bat.tmp
                    Filesize

                    323KB

                    MD5

                    787ba4a644620e5f0bca84b8ec83a135

                    SHA1

                    7e20b2a8c633a6776cf2693fdcdc1301f4b5aa36

                    SHA256

                    54e9a65bdf7956b74f7cb725e1f7c0ee12e37218edbd616fc793eb8f1f13ebc3

                    SHA512

                    9375f3f85eda364aa1a86e8c6505fe3f9f91204f7273d076d0bfb2c2a3f9426a20a96d7dea89902d0a34e76d8d6ba0ef3fbfbce795e798ba999358cfeed2f421

                    Download Submit

                  • C:\JPG.ico
                    Filesize

                    2KB

                    MD5

                    62b7610403ea3ac4776df9eb93bf4ba4

                    SHA1

                    b4a6cd17516f8fba679f15eda654928dc44dc502

                    SHA256

                    b0fd7ffb4c8f0e4566658a7284ca0652961648aaab44a53c5b9713664b122c29

                    SHA512

                    fa1995a21ffe073a15fa00a3a8717492b0a67f3615abe4c7e6bce054bb23cf545e10e21cfe3625b665c8bb199577815dbeccc7c6107cdb49f673b8d53f23888d

                    Download Submit

                  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Empty.pif.tmp
                    Filesize

                    323KB

                    MD5

                    f6f6e2d38dfbe01ffc9f4e23fc50c633

                    SHA1

                    43742038f3cc65f0cd2914fd64ab79f2ca93ff20

                    SHA256

                    aca9af3d2713886e48527e59d98c220b661ad2f22fca025187649159f5d39db6

                    SHA512

                    cf90fa1db225820764bd6bf5b9a97a0a6844bf778acc34eb424b48298807be7ff65da371e32e172d3235a3d69186769c0763c0c7218b500c2194b5289c1a3d5e

                    Download Submit

                  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Empty.pif.tmp
                    Filesize

                    323KB

                    MD5

                    343526d7d403eb0f97b60ec27dcebc2a

                    SHA1

                    4d36f7b8947b921b6d93d1b5864f0b23f6ada54e

                    SHA256

                    693353c5f77d5c8aaeb80f79cdbde49a123a4ed5f8c6cb79ab06390daf42c588

                    SHA512

                    0d5cddcc9b4103c0e668f29486f2890f1630c9fa4b1fddaae7e77a157d9779ccde35deab01fdacdedebfbdfe4d1438e24c46788d97dd7071bdfe841ce3a2ebcc

                    Download Submit

                  • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
                    Filesize

                    64KB

                    MD5

                    84c3a55a6a2a51990733aa7a074e2769

                    SHA1

                    7a25f89c056fc612a689669f82b4f12c7e89d154

                    SHA256

                    0362648863ab5673f19ed3d7ae3338829f7615b3fd8fe69298912397b85994a3

                    SHA512

                    50beb0a0b2ba519dc93b05495f6c4c9445cae42f8be36d3340da3b2ea04fca33ebe260f1191624a47435a1d28d9f8e011b56d47688fa75c5582667011662f000

                    Download Submit

                  • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
                    Filesize

                    64KB

                    MD5

                    ec758cd2ddc19a0ccab73533c66b76d1

                    SHA1

                    58443ad2a7975d4b729dcb8bd641ef611e46c135

                    SHA256

                    5eabab6f261856bb3e5499ece2f0cb3e199f10e169b32844fa3560448b412b78

                    SHA512

                    1f31dcb0c45fa1fb8fe68a7f9752e70a91799ec113eb66a4cf0c34e9e81b0062d9c18a2637f9fd2da285d4dce259df4e2d5cbcb48aa7a4dfe78bc5528fb3353e

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                    Filesize

                    14KB

                    MD5

                    8e41c80570135f4e9a2f4ff5378ba987

                    SHA1

                    5efcf58da955803591c6cceca0253bbb0725a1ce

                    SHA256

                    4bf10661eba1292dda223c829e80c0c10ed35de9e5c23fad0a7ab5ea9eb47ab0

                    SHA512

                    bc5707a0a79a364a3ba5b3ae483a83ab5d106163a4522b16e8b1d9a0313906904b6df80ccdb64b76168258a69fb72cd917501479c7af52697f38dd38f6aa9b80

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
                    Filesize

                    15KB

                    MD5

                    48fa96ca3f04cb42ea67c5fbe1316b74

                    SHA1

                    23cb1deb63736653cc654cdc726f58373e107d07

                    SHA256

                    4ab2b39f40b796f0a3e23c16c03edf46f5e8c74630826eef4af7cbe4b3fd281f

                    SHA512

                    94fd5695180004d8705cbed5dd214a7227555442261b8bd5640d520bfab69878ed9cf912a66f254e4fbf0942461d68a502da76f2139decc21f4390ceca1a2c98

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Windows_3D.scr.tmp
                    Filesize

                    323KB

                    MD5

                    101c8b8479f4eb586a4ac999a66f42fb

                    SHA1

                    48b3e92897056031cd568547624a759a3916eaad

                    SHA256

                    b29e22d1e1f5de9a84e509525ec12740961c2215892e517e129f53ec997f00da

                    SHA512

                    b4028d99e314ad1b29349ad09ab6d0f5bdc1297033bac9fee2a08b7cbcec692ff5cce0211d7a74544aa41394c7be0a5983238f2166f09780390d9e3219f868c9

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Windows_3D.scr.tmp
                    Filesize

                    323KB

                    MD5

                    a83ce85d9977b577075b877489cebb85

                    SHA1

                    a01283daca5d1e2b7ff47fc8ff02090403ae4ac5

                    SHA256

                    3d7c8e312f2393d9a77c54dcb3f8f515134792568694a7c058b9fc0f5c5501e9

                    SHA512

                    642cd6484b9f7f040df25de97d176c2da22805769789093c34ec0457835e19a7aa9a6d0b8409797e89da353b225763b4d310e8d23590a525fa92b0698b27daad

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                    Filesize

                    442KB

                    MD5

                    85430baed3398695717b0263807cf97c

                    SHA1

                    fffbee923cea216f50fce5d54219a188a5100f41

                    SHA256

                    a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                    SHA512

                    06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                    Filesize

                    8.0MB

                    MD5

                    a01c5ecd6108350ae23d2cddf0e77c17

                    SHA1

                    c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                    SHA256

                    345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                    SHA512

                    b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                    Filesize

                    9KB

                    MD5

                    8989c0446ea1ead54b2c659559433fd9

                    SHA1

                    4747d267ccc36d1436011dc0e11621461fb09293

                    SHA256

                    9e9f3f91f2eb5a113e19a89757aebc17c77ba645df244e32c71c0362c98e5cfa

                    SHA512

                    ddf958870bd56f2e543eb91251993254e7926f0b3a0260a8f4ba0e77ff34dbea9164ee638da2702a04494cc6e295f738e5b36f6dd765dd21a7937c6f6c464751

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\bookmarkbackups\bookmarks-2024-09-20_11_MaaMR8mhAQTbCgvsLumwIQ==.jsonlz4
                    Filesize

                    945B

                    MD5

                    838d93fe7f64f4f752cc6aa88379ef54

                    SHA1

                    55f0a2bd40fd96e3a319f886a58891fd9d416c0b

                    SHA256

                    1b13e0ebb1dab164edd26588e55ea99c9909f18c56c9a3478937d96719d9a54d

                    SHA512

                    8a4fddabc8792bc2fdc4868e1873f415614c3dc08bbb50272b64fbab124b4516ab0e3be04f31cfb8e02e7b653bff231053208d1638dcf0372439dcec71d33f00

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\broadcast-listeners.json
                    Filesize

                    204B

                    MD5

                    72c95709e1a3b27919e13d28bbe8e8a2

                    SHA1

                    00892decbee63d627057730bfc0c6a4f13099ee4

                    SHA256

                    9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

                    SHA512

                    613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\db\data.safe.bin
                    Filesize

                    2KB

                    MD5

                    bdc88a064d9aca9cc2d8712ca94f3a7e

                    SHA1

                    aa54ca5f7b8588dfd1f3dd2d514b04c887704a3e

                    SHA256

                    9cd238c458656753db5a7899e286ab80d2dc5911c64abcb48b0faeb3995c4086

                    SHA512

                    3bc87cb4029ef18f47bccc0893d866df3ff8e9185d282206c73aead091c639097d129aa5f0f241257c6bff676a374d450f407a885fa51d254ede1f2b6a87c761

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\8ed390e0-2f65-4b0c-b304-3cea550011cd
                    Filesize

                    746B

                    MD5

                    26b4e37b32c63f804c334e9441cb3743

                    SHA1

                    b352deee34c59463ebb6f87007024fc1180eb1f9

                    SHA256

                    7b0d16003635974df151cbaa7a3cdf1be4503b9180205fa731fc08b9d66cd5b2

                    SHA512

                    4a65c6a882f65951877ee429e76723312f856927b8246adceebefaf4787cafac98ce696a01b5d8b161a3ec05f4ea8c96cabb92c46839bacd068eafbed79774a7

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\ed7843fe-d938-42d3-b0b9-eaae5b402f42
                    Filesize

                    10KB

                    MD5

                    1dcae7aba41a5693dbdb72ba4ffd1d02

                    SHA1

                    fdeb8ad32f9912bc3ee38771acf06f1ebf38b575

                    SHA256

                    8ce36f4a4efa988bca1f30cc75d6825e647b62fbaa5859b0582b7584558064f3

                    SHA512

                    4dd57551c1264981f78bb157222cedbb79e68704c5a95e3c5d6d40c701e3ad7dd39f2c9bced797434542c29136f4c73b881d5e86b4f5342a76cd283067e8ab9c

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
                    Filesize

                    997KB

                    MD5

                    fe3355639648c417e8307c6d051e3e37

                    SHA1

                    f54602d4b4778da21bc97c7238fc66aa68c8ee34

                    SHA256

                    1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                    SHA512

                    8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
                    Filesize

                    116B

                    MD5

                    3d33cdc0b3d281e67dd52e14435dd04f

                    SHA1

                    4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                    SHA256

                    f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                    SHA512

                    a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
                    Filesize

                    479B

                    MD5

                    49ddb419d96dceb9069018535fb2e2fc

                    SHA1

                    62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                    SHA256

                    2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                    SHA512

                    48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
                    Filesize

                    372B

                    MD5

                    8be33af717bb1b67fbd61c3f4b807e9e

                    SHA1

                    7cf17656d174d951957ff36810e874a134dd49e0

                    SHA256

                    e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                    SHA512

                    6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
                    Filesize

                    11.8MB

                    MD5

                    33bf7b0439480effb9fb212efce87b13

                    SHA1

                    cee50f2745edc6dc291887b6075ca64d716f495a

                    SHA256

                    8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                    SHA512

                    d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
                    Filesize

                    1KB

                    MD5

                    688bed3676d2104e7f17ae1cd2c59404

                    SHA1

                    952b2cdf783ac72fcb98338723e9afd38d47ad8e

                    SHA256

                    33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                    SHA512

                    7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
                    Filesize

                    1KB

                    MD5

                    937326fead5fd401f6cca9118bd9ade9

                    SHA1

                    4526a57d4ae14ed29b37632c72aef3c408189d91

                    SHA256

                    68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                    SHA512

                    b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\handlers.json
                    Filesize

                    482B

                    MD5

                    a05b88afe0f580716961977259e4a2fc

                    SHA1

                    ac81d5415d3b7526119ab59ee77e126134c36398

                    SHA256

                    3e73a81463cbb269538acd90911213513895f9f8a4388ad0a78f0e07c7731d0f

                    SHA512

                    a4884d9c6930d69ae8efc0808f3bb97a4c42629e849d2110fb5337bbc5206b7b2940a4af7671e92c6a069d9f0fef6c7b190d8b4bd383ed7cbc4971e9e914f42a

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs-1.js
                    Filesize

                    6KB

                    MD5

                    b97762f9e5def7cb1bf2f5ca30b94819

                    SHA1

                    e916f039b79165e9629503f80b07019fa3fb215b

                    SHA256

                    d3f25c32e13d11336d8a0b3101474f697829058a590b7c0c139376cc1cc2677c

                    SHA512

                    fa9f9728f05173736db54cacaf69a2deaacdd7bbf5357f5a46a5418cacf0ce8ff6348cfddf839310a37a98013a6dae48a00e6ec3f779ca6bc20b720f7c39438f

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs-1.js
                    Filesize

                    7KB

                    MD5

                    a4aede86ec218914cb2751fdec8bd566

                    SHA1

                    6f2491ff88277d410c37e0f32081b88ac06b2273

                    SHA256

                    189b86e0a74c26d07df4128d3de2cc9262c1b778aadae9e773fa080af0f91c45

                    SHA512

                    016bf63ca912ac1bd3572f626106e1fa7d51eafca3e0aef8ca8310c098a0830cb89bb752a1af711718c76d932bf9fd0cc24ea66416fd436e9ce24a8585c116a2

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs-1.js
                    Filesize

                    6KB

                    MD5

                    24132fe3ade2f61648eb0215af443951

                    SHA1

                    5bbfd3e95920c5d35bd087f28c1eddea190d65b5

                    SHA256

                    2c5f356edd9dbdf0403b2e0e6b82f3466503de028566e2b8a7ee07ee9c4d597d

                    SHA512

                    dd9b33a9f974fe57e2e83312ee5879dca945923ac6dca8f30724beeb5b64da161846ddd3b3282ed6882fc3c63ca80268ed22352b619ed8e5d34ddd214cb5ac27

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs-1.js
                    Filesize

                    7KB

                    MD5

                    f59a3f97d9be7db6615116371508ba87

                    SHA1

                    d7349d8e315ad5092abca12ba0702416c7c9c4ec

                    SHA256

                    1bdfac0b0650444be36e54ab643b5bf11f47497a24ce9c5dc77c6a0dac326171

                    SHA512

                    ec36bba1dd6819ca2b9d56c217d7d9fed2ab72f908271f7a446e199160f925e53bbf5f7ff7e3f438900ce145fa9708e3540f9fd95d95ef8e49a13ec144d35d62

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs.js
                    Filesize

                    6KB

                    MD5

                    a7b2d51840976f8c1ce0eaff6f2011cc

                    SHA1

                    b52c7294935b1da16af06d202f2d4d2112fb09e5

                    SHA256

                    199a5535f7b4296e320227f0f393cb63b85845b8f6d9a93b7c39cd0cb2a72fe4

                    SHA512

                    17deeb937b5bba4aa3c4be7ce603841ec66967b0965035223293dcd7eb58f7ac9862959a84656e06358f9df517ce96473715d6d8e621b96dd5a017b0922e23d9

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs.js
                    Filesize

                    6KB

                    MD5

                    2f9fe79bc4f11ce4009c76857e067f13

                    SHA1

                    f33a0991bf7556b52c86f2b344f14fd2a4fe7140

                    SHA256

                    6a5c952e16aa35ae838e1677693ebe85c3e2d85d100a198eaee4774fab03d437

                    SHA512

                    7c0cec0a643177afd2807b7ca6e04fadf676e9397be30ad4869b8d51e2ac48b71de7b5cb76fcd8b39b13e33fae23c767116fdcfdda21fac510b8c0b04c9ef8bd

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionCheckpoints.json
                    Filesize

                    90B

                    MD5

                    c4ab2ee59ca41b6d6a6ea911f35bdc00

                    SHA1

                    5942cd6505fc8a9daba403b082067e1cdefdfbc4

                    SHA256

                    00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

                    SHA512

                    71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
                    Filesize

                    4KB

                    MD5

                    bfa101fcc152b4eb40a7173906a41fed

                    SHA1

                    100875d30c56f195d71ce6151b59f7b8fb3941ca

                    SHA256

                    8f8e9841ba81b6cf8f911c9560ed06dfddb800c2535d077ed014c0d4a84ef223

                    SHA512

                    31881e2a04e0f7a63908e8eca694079641157756acce8b5049847ce58e58f09a5a6fbff8496e05239a430960268b7a3363134e3163a855ad05e7ded36b9fdf0a

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
                    Filesize

                    4KB

                    MD5

                    f1ddc667f76cec8eddb103ee638659be

                    SHA1

                    7450d99ba094d7d82377ae0498b6a7af7fa336b3

                    SHA256

                    0759e4644276f14c7ccb164e8db702f45133804e73b79060e1ee4cd1d7866541

                    SHA512

                    ebb80f9d4aabcfa0819c3032d4e7896f0c35d3602a472bd364c932bd8a94a621242932ed816d30a7ac11467472140bee15dab02d3aadf7c8ee2ed41eab0396f9

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
                    Filesize

                    4KB

                    MD5

                    0f8cdc452205df376c58d4e6fb61aa73

                    SHA1

                    3e9902d41494a73c1f4660c757ca507985d9ac4e

                    SHA256

                    01b12202f96ac143d2f48fd8c2d54c14a089cc4a8c50424fe437f066e4bb5905

                    SHA512

                    df064d50a80a8e29bc9dbc6b9d2eb7b75c0f5f1c13681954111254dad2ecbe2fa0ca5e8a119776d4d80d9b2150c277fd7ae3141d53f6b53848dd2db2e1bd97a7

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
                    Filesize

                    4KB

                    MD5

                    ffb3371c34ea6c6b03f714477c73a104

                    SHA1

                    e6eb42f15e8b44a9cd0c2223d34ecc53c6dc7027

                    SHA256

                    6d5117796bd98bf01d67e1d3996493291c4d6126969d796fdfa7c8a701109a9b

                    SHA512

                    e225cb27d10dec8c89a4c90abaa1dd342586e86f7f0ddcfea2510a6934e40f74d53d16ddf7d52b9cf19464fba7034f5f4bffd820d936b785c13cf01ed93acc47

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
                    Filesize

                    1KB

                    MD5

                    77dfe2bd74272ec72299652a3cb26405

                    SHA1

                    42245e483764245f3c0d8c309df74783f352d871

                    SHA256

                    a667580cb889a616e6dda57e2e8da9785620fb345e252cea2508db269f30e456

                    SHA512

                    70e172cd1a6aa53a975991925929a848047084d4294975848ba18f86342038b7d15e7c9e6ded7acb6d8126d79b2f5d8d739c51a103e3e27b54ef928370e52c2d

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
                    Filesize

                    4KB

                    MD5

                    8943c3b394bf98b19e39a376faec701a

                    SHA1

                    c8d47e0aeed83ff2c875abda70388dfd4bb668be

                    SHA256

                    df02610f3fb032957842479188c4cb7a1a1d22ddfc796e4cf10e4e7b8a42deb7

                    SHA512

                    bdffc4cd603b9d0105bc10b3886c73b6a66188185b1b834692cb0eedd5a36bf1535db8d29352e1f72382b902ea23b91f64472f21593965ef6fa4615cc94f95c8

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
                    Filesize

                    4KB

                    MD5

                    044e58f27ab24a9cd4d14a9e8997afc8

                    SHA1

                    bd9e199f5e769606554e6247eb6f9e51a0051c69

                    SHA256

                    b6cbb04ff04e02c0d1f56124149a1ad35eca26ff094ca071530d5262f457f413

                    SHA512

                    1bbd01668b92888316491c49a798371e4f4eae05270838be3cb72bf0798428761236350444dacb1846a8dc19844fbb40a3443e58d6a0526f65ffda8c7b728f77

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
                    Filesize

                    4KB

                    MD5

                    855a943f215c1e792e3c513577c7410d

                    SHA1

                    cf5c97b1f4f3656de55b1e7dc0a9fd43e54a6853

                    SHA256

                    6458cdf7e3b356774799054a884e263074ba052933592ce70385a047f1f2fcc8

                    SHA512

                    d75816c617e9b6039f9063e71af1090ea839bfdf8b5705fa4b81288be84667358dcdd2e392d12e22239145b3570daa6457cfd5425a840f47cc72904217a4d0b3

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                    Filesize

                    184KB

                    MD5

                    731c0e733fe1e3123d366af7c8e578ae

                    SHA1

                    9756304ea773dd9cd96e5996dc79de2ed6a9ae9c

                    SHA256

                    8f426b4be5e3440fa14d37480f018b7dc3d1a547b0e91c2fbfc6e31d9054a359

                    SHA512

                    d29e0f2356a3226f64692b390c122d4d70f09f677d9f5d086f2babaeba6574d670171edb24ff52f928871ec489680f57910e21fac1ca8ec08783a07d21b1f427

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                    Filesize

                    192KB

                    MD5

                    f6fca7f49bb357ec59d51cca28763e2d

                    SHA1

                    eaf4cc14f9635fc94101e33f5a196b15151fa592

                    SHA256

                    a76477f9df670d9b81259b88f14910b3f3a0b70b286fe6d134a3774dcf04bc85

                    SHA512

                    bb41a6acd20ee391a3f942f54a4f58cb726db349ae2cdb4e416be726dd8c98daff18e41e80196ae98708fca5e78424dbea1f37dd7c7ca5c890e7ab1801ff80d4

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\targeting.snapshot.json
                    Filesize

                    3KB

                    MD5

                    acef3c8075c4da43ff82658f3167a8cb

                    SHA1

                    419f834ab5da6ab80a77b05ca8684ffcaa621fc6

                    SHA256

                    b58f06abdb82073fb88cb739b6e3e9ccaba72efb9c9eac9d1f7b36340585d939

                    SHA512

                    97c2340b19414ea0a3e4557f3704bd918361051b0238d656916e53def8361c3d4f44e93bdbe53f0cc407c5bcc729e75fca64ed8552856566e252ce6d941cbccd

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\xulstore.json
                    Filesize

                    141B

                    MD5

                    1995825c748914809df775643764920f

                    SHA1

                    55c55d77bb712d2d831996344f0a1b3e0b7ff98a

                    SHA256

                    87835b1bd7d0934f997ef51c977349809551d47e32c3c9224899359ae0fce776

                    SHA512

                    c311970610d836550a07feb47bd0774fd728130d0660cbada2d2d68f2fcfbe84e85404d7f5b8ab0f71a6c947561dcffa95df2782a712f4dcb7230ea8ba01c34c

                    Download Submit

                  • C:\Users\Admin\Downloads\firefox.exe
                    Filesize

                    654KB

                    MD5

                    1fd347ee17287e9c9532c46a49c4abc4

                    SHA1

                    ad5d9599030bfbcc828c4321fffd7b9066369393

                    SHA256

                    912373af6f3c176b7e0a71c986d6288f76f5be80de7c9a580b110690271e9237

                    SHA512

                    9e52622077e805fcff2c6fe510524bf9ca7246da9ef42843041e82ced28b59163a2729335139df9e2d2a4c748ed56471bb053f337655a77d2d0976370f07acf4

                    Download Submit

                  • C:\Windows\SysWOW64\4K51K4.exe
                    Filesize

                    323KB

                    MD5

                    31358329870df4364b2a8bb624fe471c

                    SHA1

                    ec181b5b6da2e1ce9c3d633375c7dd1e701cab21

                    SHA256

                    cfaf4d81374b70b0b0867c297481564362f69395402e8e6f64a8c8b6c0fa7724

                    SHA512

                    528443e77ec2b812a805a9bc1a1aa93db463ce4f413d7575d1f40da0cc65efdc680276d6b86ee11204ed6b228c7baedc70a5201c493126f9f289434ea8e92edd

                    Download Submit

                  • C:\Windows\SysWOW64\4K51K4.exe
                    Filesize

                    323KB

                    MD5

                    7cd20502be3c39de2a63ad8e1a448c02

                    SHA1

                    fffcc6b1df8a97dd63c13f86723829e9131d2648

                    SHA256

                    d84c1559ad75808d3e7f7755cd172e8afd591925c413a71ad2ca88a0d5cb06b3

                    SHA512

                    98c790369ae4ab3fc52d24fd18c8340f4d4a45ac8419978ed42dd5f8d7f9f6b47370ae1a28e6d6b563635b4d9753d19eebb2c5fba4c258314b0ff3ccb2633bf4

                    Download Submit

                  • C:\Windows\SysWOW64\4K51K4.exe.tmp
                    Filesize

                    323KB

                    MD5

                    6498921a0e5c83dca7b5fd8bf0823177

                    SHA1

                    062d3632c62f284a61c355a3e189a17fa34cecc8

                    SHA256

                    2e52b4e5e82524f4ec5554e8bf570f3ab43641030004f2afb1a7643cf0e17220

                    SHA512

                    20dd61661d8ab8e77f00c7904e7a52fc23511faeb1bf7e49f7b33a0d3c94c61683d6f82c7018cd659c4e874dd1032c9408f4eef576d9348a34b8e9d82ae260c6

                    Download Submit

                  • C:\Windows\SysWOW64\4K51K4.exe.tmp
                    Filesize

                    323KB

                    MD5

                    b1c6fa1f16356f20f6c1f6a0cc60321e

                    SHA1

                    0b634553707f0f8ac74c6aa8a33167378cb491d4

                    SHA256

                    64c902de8fc73a6199ae2cb48739050dc726eccae33c9147886c1ae663472531

                    SHA512

                    36d9456661436691a46df31c03a47d84bd87108a4d4e52dce74d31c065f6e7786daa07c8c312d2b944ee2dd8b1e2d6383e629d81934cc46fb08c2681c6334b14

                    Download Submit

                  • C:\Windows\SysWOW64\Folder.ico
                    Filesize

                    7KB

                    MD5

                    d7f9d9553c172cba8825fa161e8e9851

                    SHA1

                    e45bdc6609d9d719e1cefa846f17d3d66332a3a0

                    SHA256

                    cd2e513851d519098acef16d191188ac2586d2174dfd1a84f4db7f41a6970086

                    SHA512

                    a03a806d9db86c0c4f6f8efc4b40008aa51f1625fc1c703a929bfa57a5caf962119b3c76044775af607d4ee1a8a671e1d0a2be66d19ee551717398f9ddc8ad24

                    Download Submit

                  • C:\Windows\SysWOW64\GoldenGhost.exe
                    Filesize

                    323KB

                    MD5

                    43f53054b479c93b95c1ea6f116957e4

                    SHA1

                    be38bd9e80280d8a69f8fdd8c918c426a2c7f5c2

                    SHA256

                    005bb916a3b66e0991a4a6dcb5fe979b79001e88e8cc686aea4edd22c26f430f

                    SHA512

                    6a6e62f9850274197b117e17ebdfd0801cc1d7995906b211bf7432dcd113bc9eed80dc54b5b351a4725fa773fd9de5ea47b44ebdf0500976d4c66e7d199e2e31

                    Download Submit

                  • C:\Windows\SysWOW64\GoldenGhost.exe
                    Filesize

                    323KB

                    MD5

                    ee1f66c363ea75c297724f7657991525

                    SHA1

                    687de3509051640d8e66b8c6499c8697fd0624d6

                    SHA256

                    7c65662229d65bd5b6c32a07fe74ab59bb6f45cdd5cc2cb195f9172527f37cc3

                    SHA512

                    b864282f1dc555313918df597d343837813d29dc91912f5b64b09add4be0f0951ae5e2eab115e103e5349c28489540485bd998839b052d4d16eaf68569b164aa

                    Download Submit

                  • C:\Windows\SysWOW64\GoldenGhost.exe.tmp
                    Filesize

                    323KB

                    MD5

                    1c6a0e0cb00a7e5caacc09b83410e149

                    SHA1

                    a8d3aa2065c151bee5917169169c20d71eb2cc51

                    SHA256

                    847ae91585a319ffec27b9edc2439f55e04ec5c7f4e33529261bdc3a09668cb6

                    SHA512

                    042f63b35a919c9b51594a2a5b3443bd578fbeee1e73d8e8c6bcc73b222ab32edfb47c708738c656ecf4ad7166b5850c0ab4b14ea06b99cd8d9ace010110d1ce

                    Download Submit

                  • C:\Windows\SysWOW64\GoldenGhost.exe.tmp
                    Filesize

                    323KB

                    MD5

                    0d40a24bba207abde0053e39c1223d18

                    SHA1

                    4d6bd7ebafeea1b905d2bafa774b878c8287f338

                    SHA256

                    c85176c0f2896aa08a24dbc7d1c167aeb3738ae869884a0e4e32166175b30028

                    SHA512

                    f7387d4207625392ddf3505abdcccd5edcbedcdf550c0595ae091bf760233460ff8e0fc13dbc9972d7480ad269913df30e5d8839f69d98c1ff56e9bb76e2e71f

                    Download Submit

                  • C:\Windows\SysWOW64\K0L4B0R451.exe.tmp
                    Filesize

                    323KB

                    MD5

                    ec9cccdc9412119375f16d5749562025

                    SHA1

                    0a10f355e8de1e8d8f50cc575d557df7ff996a6e

                    SHA256

                    e32d1bc355222ae366cfd8f7f44793e0111177dda75ee4a9dbebee7cc186b50e

                    SHA512

                    5d652cc38956ef9528d73fa51c4849768649e6d52058933b2c4acce07c413cf97154f716c957aa1542869aace5372ed0e0490f1bc4cd809e42b858fc5b918c4c

                    Download Submit

                  • C:\Windows\SysWOW64\K0L4B0R451.exe.tmp
                    Filesize

                    323KB

                    MD5

                    fa10e9d70d5fa8e41a6ee9634544fcee

                    SHA1

                    6fe5f960aedabd795a2826a136fd0c91ec649dba

                    SHA256

                    ce5994dd6226301a560da0197ffae18fc1a4e0f0320d0810b0090a17729ee3e2

                    SHA512

                    38a010167d129181149970d51d071eda7ef7ee08cccb707cf77e62e07f361a3430922f66d84f6f07da3f9ce491072c3fbc4591cf2d8762d75a89ea049bac4c32

                    Download Submit

                  • C:\Windows\SysWOW64\Kantuk.exe
                    Filesize

                    323KB

                    MD5

                    f628909dd9eb271b7f519e839c5648de

                    SHA1

                    7b8f4fac00e62458390a8141a34c545e8d713b4d

                    SHA256

                    f778e7a82f2e8b939f7be207eb3dcb716cef2807a9f152e683933c65fe1d9812

                    SHA512

                    acda791b822526573d5438d65eef18d19970565f9674952f83fd984ad077d85bf0ede7ac321fa7c8d7575b2221a0961a8a256fa6eb98972bf05aad56c7c6d7e1

                    Download Submit

                  • C:\Windows\SysWOW64\Kantuk.exe
                    Filesize

                    323KB

                    MD5

                    9d0f9181ee599222834e09a0208c9b1c

                    SHA1

                    958144cb86312f3d0603076417e9a4afa285e104

                    SHA256

                    554542dad56eed50a11fab6fd5532dd1e88611b302783bb07a6489f94fac1ba6

                    SHA512

                    a31f11395cd85817e7aa0fb5984261f3c4a5efcdba7856ea876741d201d336626319866e6602d6d1ea942a928fcf724808b878394398d499ae63c0aabd1dcd12

                    Download Submit

                  • C:\Windows\SysWOW64\Kantuk.exe
                    Filesize

                    323KB

                    MD5

                    ff81cb44dc72dc4fff542da3724d98d1

                    SHA1

                    c80a5155a2cdc66b7458463bce49050a7e0a041f

                    SHA256

                    da389ae8e8411557da8debb746fd95384f86b9b0c1b66ff67a34043164e4429a

                    SHA512

                    1040f55547d25756d4337911205e838f1d300dafb8971154a54cede1498925dbee96a44efa9efb5056a899430630abd3a26d7bffbe1d32319aa9e9312da57d0f

                    Download Submit

                  • C:\Windows\SysWOW64\Kantuk.exe.tmp
                    Filesize

                    323KB

                    MD5

                    e8261b1ec5de9e86268dd9a989a91d8b

                    SHA1

                    39e15808a658e420a70b2eff5c527260da6c8758

                    SHA256

                    3a2f90791a08b95946d98aa6195ac7b7671a01ea1c8663889f87e536ccee8948

                    SHA512

                    fd75eecf2ae842839fb1c9fc6ea5a3dd5e92c8e396f78b9aab147df7531c47dd12fd4cc9034ce35cd00aa414afb4ae8f862e6e8a7fd92eda18b2ed8ef8718063

                    Download Submit

                  • C:\Windows\SysWOW64\Kantuk.exe.tmp
                    Filesize

                    323KB

                    MD5

                    896af7e839e50d1503ee942d00a03358

                    SHA1

                    ebe3a6b61b3e2474b72cf24e7bfad310708f1d13

                    SHA256

                    841a0bc4a2650533bf0ed5c8c943cb208a187daf97ec7bb15417caa7c09ca1ed

                    SHA512

                    bbeba701552f34236d2b7234b14b0bdf7d2ed0ea335ddfeb27965099c3aa208d98c86d4162789b6bbcdb1618cf1dc9114292c6c1565baa25241f46cf7d6eb548

                    Download Submit

                  • C:\Windows\SysWOW64\Player.ico
                    Filesize

                    2KB

                    MD5

                    43be35d4fb3ebc6ca0970f05365440e3

                    SHA1

                    87bc28e5d9a6ab0c79a07118ca578726ce61b1bc

                    SHA256

                    5a15c1aab77f132e7ce5928996919ed66564c6082a7f94d0a42229c480113fc5

                    SHA512

                    b2e24ff3702805d2ff8ecf3ddde8a8e6258965f992f37104c2ed9b763e1448ab32c7609a607e1d90cfba281e7add1e839855656d6453433a42c0d6c8923c9395

                    Download Submit

                  • C:\Windows\SysWOW64\Shell32.com.tmp
                    Filesize

                    323KB

                    MD5

                    282ff002814d7c51187a2d9d27e64636

                    SHA1

                    53c9e23155080aaa6fecde1d2ce3fc2b48cfdf61

                    SHA256

                    dde602d69860c6a0818b8eee56e0499e05c81e55dcef944004cbedc4cf5a59f6

                    SHA512

                    ee6baa196e91b2d9caa0238bb8c5607f3dc8d0a796210ae5276895e4434b34fc6c6412bc4bec70faedd88dfae1e82fc70f0790da8602fba157b77fcf079d1685

                    Download Submit

                  • C:\Windows\SysWOW64\Shell32.com.tmp
                    Filesize

                    323KB

                    MD5

                    b0fe05d5c4f017cb3150da1e3ec15140

                    SHA1

                    4b6e2d5139b48c1e990e9d8080aacd98cb655831

                    SHA256

                    bb35c4c2ddbf29742e4a06fc8d4a4901b4d39d7ede3267ab208f34bd52fff76b

                    SHA512

                    06f30c051554c43af1ee388bcf9b7338bdc5c1e09f5f92e30628e36b7e8f330207afc8e38fb9f0611ccefb8277e0ee940b49fa9002e4380e578eab258c13c657

                    Download Submit

                  • C:\Windows\SysWOW64\Word.ico
                    Filesize

                    3KB

                    MD5

                    8482935ff2fab6025b44b5a23c750480

                    SHA1

                    d770c46d210c0fd302fa035a6054f5ac19f3bd13

                    SHA256

                    dcbcdce04483e9d2d8a5d7779b18b7f64cfc06e758b07f671493e38dfb9ab33c

                    SHA512

                    00c711d815815a88fc15f73c8cba6a81b2bfc505baff2cc67b456545151fe896029f11127e447c9bbc5a2d5dc561a06a52be9a9f9c0d28e98ea4e174cdd54398

                    Download Submit

                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                    Filesize

                    323KB

                    MD5

                    b51fd23168cea171af1b613a95cdfcc2

                    SHA1

                    c6791f575c5cc57f3b11491fa9fc187c3e2ad271

                    SHA256

                    c373446ae4c98154f52a1c364950773da910cdab94443db2ff1c2bc49576fed7

                    SHA512

                    ba89abf0f10c47d277fb2ed800e77dea834ffb0888f80f2664f71a4a5f801c649271972265246c9d61e5fa82c2eb4a76f0ca80d343545226eb4ee4a1dfbd6abd

                    Download Submit

                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe.tmp
                    Filesize

                    323KB

                    MD5

                    1ea9db9377033bf9732659990c0ce4a1

                    SHA1

                    9fadb703d8dcc8dacdd23f1b59bb4bf3a5a5bfad

                    SHA256

                    2c182719c9e5e6f56c4a68c63633caddbd4fb2dbc2342c76d6e9bbec52140583

                    SHA512

                    b3a1791a295409869893a59eb1dceeaeff1d6a6daca4f54ca16c7286bf1170d8da01bf3821ebfc8866a999305d24073ea83df4ed3f6a089e4b9ef5e35bc13332

                    Download Submit

                  • memory/204-0-0x0000000000400000-0x0000000000451000-memory.dmp

                    Filesize

                    324KB

                    Download

                  • memory/2344-290-0x0000000000400000-0x0000000000451000-memory.dmp

                    Filesize

                    324KB

                    Download

                  • memory/2744-286-0x0000000000400000-0x0000000000451000-memory.dmp

                    Filesize

                    324KB

                    Download

                  • memory/3012-162-0x0000000000400000-0x0000000000451000-memory.dmp

                    Filesize

                    324KB

                    Download

                  • memory/4292-267-0x0000000000400000-0x0000000000451000-memory.dmp

                    Filesize

                    324KB

                    Download

                  • memory/4664-296-0x0000000000400000-0x0000000000451000-memory.dmp

                    Filesize

                    324KB

                    Download