infinitylock | hxxps://github[.]com/Endermanch/MalwareDatabase

Analysis

max time kernel
301s
max time network
305s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
27/01/2025, 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase

Score

10^/10

infinitylock discovery ransomware

Malware Config

Signatures

InfinityLock Ransomware
Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
ransomware infinitylock
Infinitylock family
infinitylock

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
165	raw.githubusercontent.com
166	raw.githubusercontent.com
167	raw.githubusercontent.com
168	raw.githubusercontent.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\ui-strings.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es\ui-strings.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ru_get.svg.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\ui-strings.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_fr.dll.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-default.svg.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-down_32.svg.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluEmptyStateCCFiles_280x192.svg.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_rename_18.svg.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sendforsignature_18.svg.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\ui-strings.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\organize_poster.jpg.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\example_icons.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\ActionsPane3.xsd.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-down.svg.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\ta.pak.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.MetaProvider.PowerShell.resources.dll.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\ui-strings.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_super.gif.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\selector.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\eu-es\ui-strings.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\line.cur.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\AdobeHunspellPlugin.dll.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2.gif.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\PlayStore_icon.svg.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\cloud_secured_lg.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-up.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\ui-strings.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ja_135x40.svg.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\ui-strings.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-cn\ui-strings.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\plugin.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\MSFT_PackageManagement.schema.mfl.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\ui-strings.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\css\main-selector.css.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\ui-strings.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\digsig_icons_2x.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_2x.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\ui-strings.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\bg_pattern_RHP.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ko_get.svg.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\EdgeUpdate.dat.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\el_get.svg.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\ui-strings.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\file_icons.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\PlayStore_icon.svg.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\hr-hr\ui-strings.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_ml.dll.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_listview.svg.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\ui-strings.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ui-strings.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_100_percent.pak.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\gl.pak.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\fillandsign.svg.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_reportabuse-default_18.svg.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\da-dk\ui-strings.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\mk.pak.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter-down_32.svg.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD	[email protected]

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	[email protected]
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	[email protected]
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2449540194-3226363261-2578591490-1000_Classes\Local Settings	firefox.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\InfinityCrypt.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\ViraLock.zip:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5284	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3552	firefox.exe
Token: SeDebugPrivilege	3552	firefox.exe
Token: SeDebugPrivilege	3552	firefox.exe
Token: SeDebugPrivilege	3552	firefox.exe
Token: SeDebugPrivilege	3552	firefox.exe
Token: SeDebugPrivilege	3552	firefox.exe
Token: SeDebugPrivilege	3552	firefox.exe
Token: SeDebugPrivilege	3552	firefox.exe
Token: SeDebugPrivilege	5496	[email protected]

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
3552	firefox.exe
5284	EXCEL.EXE
5284	EXCEL.EXE
5284	EXCEL.EXE
5284	EXCEL.EXE
5284	EXCEL.EXE
5284	EXCEL.EXE
5284	EXCEL.EXE
5284	EXCEL.EXE
5284	EXCEL.EXE
5284	EXCEL.EXE
5284	EXCEL.EXE
5284	EXCEL.EXE
5284	EXCEL.EXE
4604	SecHealthUI.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 3552	2604	firefox.exe	83
PID 2604 wrote to memory of 3552	2604	firefox.exe	83
PID 2604 wrote to memory of 3552	2604	firefox.exe	83
PID 2604 wrote to memory of 3552	2604	firefox.exe	83
PID 2604 wrote to memory of 3552	2604	firefox.exe	83
PID 2604 wrote to memory of 3552	2604	firefox.exe	83
PID 2604 wrote to memory of 3552	2604	firefox.exe	83
PID 2604 wrote to memory of 3552	2604	firefox.exe	83
PID 2604 wrote to memory of 3552	2604	firefox.exe	83
PID 2604 wrote to memory of 3552	2604	firefox.exe	83
PID 2604 wrote to memory of 3552	2604	firefox.exe	83
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 4048	3552	firefox.exe	84
PID 3552 wrote to memory of 1532	3552	firefox.exe	85
PID 3552 wrote to memory of 1532	3552	firefox.exe	85
PID 3552 wrote to memory of 1532	3552	firefox.exe	85
PID 3552 wrote to memory of 1532	3552	firefox.exe	85
PID 3552 wrote to memory of 1532	3552	firefox.exe	85
PID 3552 wrote to memory of 1532	3552	firefox.exe	85
PID 3552 wrote to memory of 1532	3552	firefox.exe	85
PID 3552 wrote to memory of 1532	3552	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/Endermanch/MalwareDatabase"
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/Endermanch/MalwareDatabase
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1872 -prefMapHandle 1864 -prefsLen 26929 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {78004f1c-2839-4cb3-8789-197bc5953cf5} 3552 "\\.\pipe\gecko-crash-server-pipe.3552" gpu
    3⤵
    PID:4048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2392 -parentBuildID 20240401114208 -prefsHandle 2384 -prefMapHandle 2380 -prefsLen 27849 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {edd815f2-9ef6-4ad8-a5fd-9bbf5ca9e6b7} 3552 "\\.\pipe\gecko-crash-server-pipe.3552" socket
    3⤵
    PID:1532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3092 -childID 1 -isForBrowser -prefsHandle 3084 -prefMapHandle 3080 -prefsLen 22746 -prefMapSize 244658 -jsInitHandle 1192 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf80e038-47ba-44b0-8c46-9cf3b31b57d6} 3552 "\\.\pipe\gecko-crash-server-pipe.3552" tab
    3⤵
    PID:3876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3716 -childID 2 -isForBrowser -prefsHandle 3708 -prefMapHandle 3036 -prefsLen 32339 -prefMapSize 244658 -jsInitHandle 1192 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3e64bda-7a97-4ec3-b79c-8f6fd68e7295} 3552 "\\.\pipe\gecko-crash-server-pipe.3552" tab
    3⤵
    PID:2700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4504 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4552 -prefMapHandle 4548 -prefsLen 32339 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef146d7b-e135-41d0-83f4-c2fca60330d9} 3552 "\\.\pipe\gecko-crash-server-pipe.3552" utility
    3⤵
    - Checks processor information in registry
    PID:1460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5500 -childID 3 -isForBrowser -prefsHandle 5564 -prefMapHandle 5560 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1192 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab52503d-a223-4acc-9a2a-f0c79ccbe588} 3552 "\\.\pipe\gecko-crash-server-pipe.3552" tab
    3⤵
    PID:3448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5704 -childID 4 -isForBrowser -prefsHandle 5724 -prefMapHandle 5712 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1192 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {737bef62-a25f-4f7e-b686-ee47ee3fd6bd} 3552 "\\.\pipe\gecko-crash-server-pipe.3552" tab
    3⤵
    PID:3792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5680 -childID 5 -isForBrowser -prefsHandle 5908 -prefMapHandle 5912 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1192 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07e5623f-2dd2-4587-a208-7972fb108963} 3552 "\\.\pipe\gecko-crash-server-pipe.3552" tab
    3⤵
    PID:3488

C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5284

C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4604

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:1164

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:3900

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:2488

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2652

C:\Users\Admin\Downloads\InfinityCrypt\[email protected]
"C:\Users\Admin\Downloads\InfinityCrypt\[email protected]"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
16B

MD5
b905ca541492c639fb0f0bcce0da4c2d

SHA1
35d4a19b9ddd1f89ba12293db7b6dea4819079bd

SHA256
a7df30f30873065cadfd24597c504e47e501a3440725f12537542b8ea1e8b372

SHA512
139492f3fc25f42cdbb059e97244535249e7ebefc013fd900220c8bb5d97c244d33b86bd47e722c86d1b34321724acf4666fd2d1193616045bf59c25ec3e4ff9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
720B

MD5
5385e1b521fe8101d18ba29fbf205efd

SHA1
3a6e58dc5b8e7662d41df8fcd0b141bac407db41

SHA256
11427d5335be228fd245b3f8711d1766d1ba4063e553b2b904d6a9947097a443

SHA512
880dbbc015944effd4285e108d9f90e35369cb947ae2221210fc50c424bc5922001f43e88aaa22e83d84599c1cf1baa424c19d9fb84003799d48512cd78d5c90

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
688B

MD5
2a891f2e44fea3a70fb8278d3b044546

SHA1
fed96654b5738edfa25966ddab8796d3e8420218

SHA256
618cebfbe3c9adfc6d1238baa277226ad9f098013979c1bc1b2e0e87ddf79dfe

SHA512
bb56c6385882887237d4857b59b2f8cca622226a2f4aac5ce9791e2983c286293247e96d9740f4a3265746d5bb02f5e9362945bf08a6d6a81258ed21040c7b63

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
1KB

MD5
bcf26309a605dbfb9f350b889cc29f85

SHA1
cadf0d0696f62cf310d08bdb2bfdb8f08963f50b

SHA256
e286756af13bf30fc6b0cfea1a679d5d922c89eb6b4f84b5e0ddec1f6752701b

SHA512
4d3f7eeec4e9e6e64d9a9508cd653f0781f5ffecd8c086515326bd9c7b53ebaf5971f2fdbebb056217b13f0afe5f5304402138d9fdb0cbfd2a96bf1e701e81e7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
448B

MD5
4a500033fae54ffd0f74144b75b268f3

SHA1
932d3a60a521c9aab36a5859ca99144dc61ba0dd

SHA256
fe70c4b6e6c3e86e28ae4165eb6794ce685a9938c347353f6cf99df9412aa29b

SHA512
66ff4ba5fc1a561728335509911558218ae78615a475b14066fb523e8edd7e22ea4cd2519724198727e8a292fec5d5b74967f2b106616eaa43c9e3188f516848

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
624B

MD5
9b568840a7f1475462fcf38366e8bf7d

SHA1
64db3f1c89d118d7a3970508581038e7a7bc4c32

SHA256
5be108a883cd5c385ec53caf5c242baf1d121c4c6b9fc81c59304a448e840574

SHA512
3cff8f8c0abe53940a7b23d376e5bc6058850048eda578ba4df0bb9f7215ec60a045343856c8754790cc01dca72162ddcaf51164373ce5f24d7569e29ccfdff2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
400B

MD5
4cc7d0a67f0f2ead686227086cd350a9

SHA1
7d1d66ced82fefb949b75b2dd6da54a31b2d1625

SHA256
64382f3560673fe08e838d057d315ac5bf85704c77000d180df130ae7382290d

SHA512
831d74ee438d03a42a62f5596d17bd7b93e09cf03983abe2710c7ae9a5654cfc19ec286fd89d828e1ee93d977863144a97554ab6a7c71afb5232879253fc0943

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
560B

MD5
ff79c67ce9ba2c832c6f7298f49f0bde

SHA1
6fcbfd87b00561f5260d0f70747a934ef6e760e8

SHA256
6a3a8a47299cfb0646f92b83a2c97da00aff136bde47d5ed25145fa7932c4b28

SHA512
3f68ef597d0422952d6f2d4363c6fa2babd3d4c95c6d8ec5efc78f021cdc8bf5e1352a24bed2853bbe9b0a908415d2bed4ead4ffaff6b8c196acd400a41e796f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
400B

MD5
ecbbb60a984e325b6e8987fa213f26db

SHA1
c95a43d68ba13d266aa6ea3e52cc697e79c37f27

SHA256
dce3ad8a1faae4373747408e372d9e5fbcb35cce9993750eb6b23fda643bdbf8

SHA512
cd4dc4da8f2c260636ba3ebbc196008deddd4168cef2e1413554677004762848636a915c449e32ab7fcc1bf1c5cd4a042ec9a5811b81fb6b9f9517db78c83941

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
560B

MD5
525d2827863aa790b8d894c9ff8736a4

SHA1
9e27bd6f3e8ea71065595290a0b918ccd096964c

SHA256
b26179a80fcd7be2d5ae42ada1e666a995510cd4ea121da9f8ac9e9824e9c653

SHA512
beebfe87af5a74ec305e19a17c118792ffa01db9dfe404b68eff55d9495217218176b76e9438007ade53c3d2399e11be94444f2a14b6654d4dd7913416e1770e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
400B

MD5
39d7d3ee658d659a1e25c3236d2d1970

SHA1
ae4f702079b4be182f71cf33a4f9da460d3acf21

SHA256
e411e8fc76480358d6fc03d0ab43ef7556b5752ed8fc0cf2cc36b77bea2caf54

SHA512
2b3f8c699993b402ca584ac661348e6baa2bce928150269c0c0f4def4c305699ccca870ef457a783f3abc26a1613a7f271e7814810708948aea12119ba84092b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
560B

MD5
8a2381af62dccc352e4a912ad663a52d

SHA1
dbdb4c8229b777e528f7c4fdb22476a449dcd158

SHA256
32d625d923ff9438d4bbdcd7ae99f5394157e9c9d5f415460b579a8fd57a75e1

SHA512
715048d798f4544a3a2ac8bde2358df3191159c65a2010d724188468ac9211339ca77e1bd0078045a294d0681f807cd9ad34d74de5ac14766da46c9b539015ce

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
7KB

MD5
84e350e02f39b1e1c478277858503651

SHA1
0c3a697e5330329ad1255a1b7a6316bfa2b462d5

SHA256
894f18fea32f0a76ad7d2ab6241eaacfa8bdccfedf3d5a6f24654077c8dadc0c

SHA512
76de12cc91de6e011a8138177ff5fd75f4734142439fd870215e15fade102366cf0ee26cfb5ab50eaf4d380c44e7013b91c373ab18cb53fc3460e3a44992d024

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
7KB

MD5
ac68f9ed24518ff7eef2024f42ccfe2d

SHA1
320a03c42992fafc4ea7f74e5403a78f53d1639f

SHA256
c681d1f4c688fa5b46c068837a75df5df4782cab8b8425db2d443a3647689ecf

SHA512
35b9fb18e8c8881dbbcbacb7a6394e8a82b72837d9e7b4dfe180d36e3f3e92911435330fb1f1e1f3a4840797dad68fc8e25c859983d73aa05db9fa0e43178b71

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
15KB

MD5
1513858264154f08b3564706db6f50bd

SHA1
45efa63189d8fdaa870d943869763c236a46253f

SHA256
b5d0ef9b0d5f28d83ac335d6ade824ddb93866bb253da5ae8df1ab8b5dc96d81

SHA512
e661f36e528ce61768dfbde47225e31a37a4763273e0a4e8908bdb489ebe5b4d35997dae91ffd73d3ee1ac872d867e93b9ecb2731e467bdbdc2de28054713b3e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
8KB

MD5
b0a570284125e2764a65976040a50ec0

SHA1
1d073feb4d95267220281f7bd70df7d53874329c

SHA256
6d49f6b1e9c4283466c67f111d3cb6de6f8c8c684bbc45740dcb6930e49b91de

SHA512
5098f21b275b2e133c53868c51114c59fbfc1cae436b58ef44980d2667d7e9e760505bdf526c98a23a250722c7f6065b6724cfe3dedaafe5190133cb128bc1a3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
17KB

MD5
57eff698b3f3f251c115df5d75fd8806

SHA1
34130e37fdff7dc09ca60a7c884770f239c46ebe

SHA256
79be1f359baabaeb73cd80a41a5b1f62f7d04da5d6072867e109ba682ef1129c

SHA512
7e3d5c9264d6451ffa5ec4e8c478b06509894498c6b807a0971b6ff8771ad4a085a7d908e869006a8e83d0f42ef08d1231373d8b63143482664e7f0aca496c08

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
192B

MD5
af76edf5426b70da525ea40e81a95f79

SHA1
c220b43ced5813c95efd17810d6078ea9b745358

SHA256
c2bd735ab6cdfa56a0e974144ef2a1c56cdc2c058749e2cb6f456a920f71dca7

SHA512
a3aa1a08322f7cce04b00b6c4e74fe6d5f55cd57a80c3a07a5dab56440efc58982bbd869d312c64f793007e019779fd9d1994a2db074c779cb7493b1aa49e3b0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
704B

MD5
5d2be6ec9bfd04d0faf20b195c816df4

SHA1
0e46a7893d844dd175b8a3d41613ef1d6ae80e9a

SHA256
fa7f9c887fcf74a3270b2cfe52b1cdb5d37d3f71852f72a6557a032aba2be434

SHA512
68f3e83d70057e4bf4e85965131ad7c6a1bbaebd811d971c564edca45e432379b663ec2f2467ee4b5b24c3ff0fe3eb63972bcdf5a07dbe78e1ce66133ed956a9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
8KB

MD5
be50e858611b171e92526925f9cf3ba4

SHA1
ca7b8f11e954bbb78b4a2809c09c89f38a30607e

SHA256
00fae31ef0f05fde05a3fe832d7f2fe7d6f952c8f8d85ebb1affa2f8467e409e

SHA512
95431b3fd46ddb04c7f7319c8c30f0c42f177a514b44897fe5349f9f18fe395921d38b76cb70ace60cecaaa733dc9b2d9874b11107e864f62ce7125e0d915ac5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
19KB

MD5
9b4eea1c86d98ca5a25e5cb438dd98a1

SHA1
5f0f7d9925a4539e464315eccd4ad784c862936a

SHA256
907da34b99a0a91b1c3a5e410c012dd687eb4a2d7729f3644d90aad80a1fe98b

SHA512
6df2bed74a12bff592cd8c51f147734f8935cb2df10c1272ba867c372c9cdfd59b04105f31dd982c22f906b1afdb31639efda62c2bc67e529ba7c0baca9a8b09

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
832B

MD5
4fba0bcc6f17c6b9a4f453fb067c2920

SHA1
9909a48ba48a6486ba412e26d1dc84218dcdc386

SHA256
90b81c080f01c27f6dbe4aa0f3cba1e800960064233069fa37bd784233d4c46e

SHA512
05ff0d484844bdea5e791bea7462bd5cfaacd1000d691cb477d5f110cdad07c3194e5121dd0c35ee5082f0b27cb1ce4ab21b99dd895cf3edbc55067d16d19cde

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
1KB

MD5
41cfa656861084285e016d3608443a09

SHA1
9a84f7566ba0a1f83aba7182b5b53e72dd4410d6

SHA256
6e7f8c214771100d9b28b5860bab1ac2a07138119295a13d1b5a377c5910cf23

SHA512
4543d6f74c6acff7cfdb2ca98902c464dfed51cae18b850700c16487619c470adb0b4e0495cecb85277a4c7c6316f6c6b811afd9ef93c0fc3d9bb5f6620ec820

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
1KB

MD5
9161b0c5fbfd65ba6fe98fd9485f3b3a

SHA1
95d47af20b96b4e526cef550742a83ab55520e9e

SHA256
111215d2686a9d05d1d68f6ed9e8633c521f806a903592c8260ab08cedd43ab9

SHA512
051a11a946abd7bd67e66270fbeb5bb707c18c733133d1b8c45aca9b67d8d780c3e26b29e87d4a2c24533ee9c8ec56b039c7a8db4e47a789040beeb341949fac

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main.css.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
816B

MD5
1110381031c54d3ab1888ec3b8fb93cc

SHA1
5f5a7a9de91d524e6c560a1e0b9dab07423780ab

SHA256
c21cc44b173d15408ae7a9e52a9b13855fb878c55bbaf9e449dd8b578d74cc8d

SHA512
fa6386c83e0950d0eb272d5886c6fd25e5a117c72ac16a604572776151607afdd7d739765dec8886dc1aeef20b57b92fc12f26243c545ab0787f462201161593

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
2KB

MD5
b2a1d5e3e662dda2bbcb244dca9ad4a7

SHA1
220f9f92d1dd17cdbc84ae8f7c2407d3febec2cb

SHA256
a4a9ba7740251c96b4350ad4b83fd85207997ec7f30b8d7febe048096df4b929

SHA512
f01a9792e25b1ec7dacbcbe546bf5b96ae928947e1dfed8aa8d04bf1a700fb3729ebfa41ec71676c7e97e12294f99e751a262f0cf254ae29676830de46af600b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
2KB

MD5
9d889ed47e11b8ebaaeb0acb11720c35

SHA1
f42def172fcdc504bdb8320c941870d519b138b6

SHA256
db2724106d388d34408cff8e04ba0de7652e421e4ba2c6287ba982c7b1c456d8

SHA512
f8fe26538e6ef0f5015fe7b3307accc5d0e12e4131c6c27bb2f9794632cf13014fd421c229496cf8ec9e0dbbd2eed2a1be31b80ec37d54bb1e13d8a0e2d11ae3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
4KB

MD5
2ecd9ccdd99a4c9647fdb5c063eb3d0d

SHA1
6d57382a568fcd98b037d25ec2e8e527bd1656a1

SHA256
61fd9a7c27f70a178e47e2ab3a468efb15d9aba4df7fd7dd7185092a2523c7a9

SHA512
ea883a18459b0633f56bc739d9cdb48b2f3b1c8bc611e133e5aa3b93b50c906df4ef79679e58c4bb8fdc6dfe1fc1176f1b7c77649ad6bd856005d65064fc14ca

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
304B

MD5
3bb1c64b3d952fb4b16394b4f244658c

SHA1
ea23d5045b79fed928ee99ec10ad9a8456981db4

SHA256
e531da4a75fb02e017c3b189bd113b4562c01c8ea5e3694188327a48ce284700

SHA512
4bc1a65e12b8ee9a9dd8c5e67d297136d396f32e5d5ffa8af8ac58ca0d7c72ea17abf68be2245795a86220a7632792e019e4f96debb0c8f81a28b6d346f97361

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
400B

MD5
584f3ef6d8736d4537199abdab5e89ff

SHA1
decd32338224f10a990439a66b70048a64c719d7

SHA256
f0e64fee578aba91091fa96a21f54ad24288ddee8b30f4019e5412e0cdabd0ed

SHA512
a16c6fab559e9477b76e5faf7a254502387d3a28427fcbb7019113434f89295c3f4c1376f6e437e141cf74955cab41ee4416925d4eac45f3db035be00754a8a7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
1008B

MD5
a5afcc977c90284700d3d5772e5758f0

SHA1
a70374ab86c66f6c639fda521d6c385259f64df0

SHA256
76d1478ea5437dc4cfdaa46cde6d96ab2dba67e2301f174a889119888c581c80

SHA512
960926d4f949e612e3c60c4fb05f97aede36e47273bd820114b65a206a515404c4c1e8f6765df5ac1c8ecb53eb2d90fd1257175448f43394926923b2e53a2059

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
1KB

MD5
70b5a331d31b870c7433fa193d7d4de6

SHA1
2003336dc21af52693bc616b2345757dd5d8010b

SHA256
7fdb87f2793225abbd8f2ae6ecef7f44f7eec8248d8c134836bf7eb6e006451f

SHA512
d625f3d36b943348c469da74dc36f1be37d07f38f8130823b548895f44880f7a97eb4c08a4c97d06714d769d22d54d53356d24dc2c32eef3f6f2c5a801faad0c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
2KB

MD5
20044fe631bc9c9e19656a0b224ff8a5

SHA1
437c38fdd756170df10fbfe25e54c451f8d8347a

SHA256
fc34fba897501b013c52a5d7e3a8fe0b4164b224a80526dc563441ddfa2635fb

SHA512
32bd3d9ee504162bc8ebd2f9ed0eeb57f6308e179f144614a70c496540a46d250b94466f268d2c01e5b8ba0969de2072083c29bd4771a12103a3eadca51d8bcc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
848B

MD5
7beeee5d0612be3b7da4098779b09fc1

SHA1
f8a614ebee8e65e804a67e5f8c3c4ecc308c2004

SHA256
d9ef8eac9670ffc17d2b7a7430900e95fd3123855d519dc56a1ee8cef7750171

SHA512
1386157dfb2bfbe979f87fd202367dc3ddd2a1ea14756deda9b16420e884af6aebf0f8bd7698a04695d4b523affe2612e8c8d866a95373abdb7ba3d7c4104750

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.0252956D83D09E2DE81BF297062EB1A7D9F21F6A1AA73D2F609609407B109BCD

Filesize
32KB

MD5
43d5acbee80014a756f38461eb8d7520

SHA1
de2e201e66ed712427fbd36647fc19a230e6af46

SHA256
b9646db910a56698f2a7673818d14b9ec9782efe777bf1894ecacecd37405efb

SHA512
66699956c6d468ddf0423b2d4d063882ec7bb580432aa9869f7eb17d807695c902f821e730cd51cf41b9f2ed305caa5029de84d1e3dedaaee26160d231d7c838

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lojadwsr.default-release\activity-stream.discovery_stream.json

Filesize
21KB

MD5
5fc06838110ef2e2cdb04fa53a4ac345

SHA1
bbdb8d808617ff178253514f92066088430e4f33

SHA256
e961bf4b55ae02cac7d0d22f3d6ef3200dbb09041100d2ae75bf10791908369f

SHA512
926ea8271e5c7dc0f423008b51b19bdf1503babdbc37dd22b0b4c2749ec83586bdc2753eec64ac714b8e8f039e2141b6ba2c97af949c123cda7943e16880c102

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lojadwsr.default-release\cache2\entries\06AE02E19CFBD939DBE0AA3D436105938223B523

Filesize
34KB

MD5
45d3404f02b7b983de27c46cac5baa3b

SHA1
2876db47e0e7b4db1426d742a1ccb9a02048e2cb

SHA256
19b13fa6865254a98f8541797f0f669fe66572dff7a928ae1af653a8025230a8

SHA512
7b18f5410a1fb3ec730ed3033b021d22c4cada46db8a47f0ba14f8a3903ec06d2f73855d390b90cdd2e57a020fcb431890c42b0dcccb3b4587230c7cda930575

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lojadwsr.default-release\cache2\entries\40A8F58CFC1A23A6BAE836E45F467F9B93975806

Filesize
41KB

MD5
546684e5d645910cde8e636ecad18b30

SHA1
570adc5af295bd8df87cefc1ca896dc987185c2e

SHA256
dc27e017f8bd90cef561a33d2c018e73bee4b39b7cd7a345a856bf2bd472ccab

SHA512
fda809d93c31e7d60f532627ec313f0f0745cce66d628a09b3cc66e26c58a364776c6278125564bb33232d99e36a0c6621bdb14c5d85304cd228e4977a59407e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lojadwsr.default-release\cache2\entries\50F1259662CD4DF41A8A92EC0A96A572A1381D1A

Filesize
46KB

MD5
14406471fafe07ebdb052422be29696b

SHA1
d8fcf707b28711891b4856fdd524309b5ea3612d

SHA256
b7453b140354605a9f876def9655dffc7e0ad139a749fb986f47b33975cb0804

SHA512
8ee7fd58876828ed618236b6d8a4d32e5e586888c2c89538d0ddefc9c82a4c047c23fd8db55cd6aa704fffb03a27edcf7e2b9d8e86d6469cfeaa74f5249361c1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lojadwsr.default-release\cache2\entries\DD6D5E0884B994D28229649EDDE60F441288861E

Filesize
44KB

MD5
2cf7560e11af81a4e2128f8a8ce63afd

SHA1
6aa6895cf1fd8f8726c8fd3b1e8f7517c0cc125e

SHA256
2db51c25b500eeb9b08671e9a8fd57913fbb522e8faa734f30614a2c6c9093e6

SHA512
a7869d046d66868e46f852d8ccaefaacf44e12a93f8c238f8a1114fd9d01218d8130663ce5872628868fb0420f2501923d01d22c288b16e0199c74959ff185cf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lojadwsr.default-release\jumpListCache\bvS4LlqaSuIUNzL+mqunchqrkjKgI+LfstVDCtCyBu4=.ico

Filesize
25KB

MD5
6b120367fa9e50d6f91f30601ee58bb3

SHA1
9a32726e2496f78ef54f91954836b31b9a0faa50

SHA256
92c62d192e956e966fd01a0c1f721d241b9b6f256b308a2be06187a7b925f9e0

SHA512
c8d55a2c10a2ef484dedded911b8f3c2f5ecb996be6f6f425c5bd4b4f53eb620a2baccd48bac1915a81da9a792971d95ff36c3f216075d93e5fd7a462ecd784f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6XWVOT3DYD6J1FEFPP25.temp

Filesize
16KB

MD5
6a9c57c5122a975f67710bda6d4a6230

SHA1
05aa2b8accb16334833c06d3466d3feae6624208

SHA256
cd0597d8bff614e4dc6070feafb8b4454e849c366f7e8e2556797aacbb4f1463

SHA512
6ba2e509af0582390a20b4ea807705cc8f77b37340e1efbc8c7329f28b08bbb469a735c52e412de313e65bf328605a3e3e210e66bb4c0998b8faaeb7844faad4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lojadwsr.default-release\AlternateServices.bin

Filesize
8KB

MD5
18577ebc9b27c60598af6e16158a23c2

SHA1
be9fa0d562b553314c3231d81e08c820f432c05f

SHA256
45204df80cfcc2877ab746c3839494937f508ba0c3ef597ea76bf30e989137b0

SHA512
f03545e2aadde8b301167fad29b59316133c2f3fd5985d4d5f3cdf096377eb0076c569446ac27a38f162e80d7880ee6a39b2b427ff3236983a0096ecb5faf635

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lojadwsr.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
beb3a4daee5c5be350d41b0b818b73fd

SHA1
078ac8521214593631b495dac3cef9aaeb645616

SHA256
bce0c437f67d4ed667025e73903b241ebf51a107ea1f510a89e7ede901bb4748

SHA512
c9a43dcc132362bb582299d709d2d5885fbe4bed8fa62a665b1d81a1e3c44e671d8a7a618600906df45d52a6d1f4f5898d1b3e290d68ef0b381ada5a26650d75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lojadwsr.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
ee675e0efb84c17d405154eff402a3a0

SHA1
1ba1c971a5795635b97e19bbc008c439c86c2de0

SHA256
5354c8714d7f8d65bbe723d1eea08212543862d627ebac16657455d39d2cb17f

SHA512
54078d2f180b3c805dfd851ae05f8f8d2ec9688065d6959f928c27da0866eff03034da03db84e148469d12119f32b758d7c146d3621080f3cd36c750448ab9c3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lojadwsr.default-release\datareporting\glean\db\data.safe.tmp

Filesize
40KB

MD5
bd7a22261a6ec086dc130d8a3b3fbd2e

SHA1
8905b5b3bec172e2e01dc8c810eac42528a2374d

SHA256
9ede5a1b88816af74cbc1f2818adcbbfa9dd1c05862d9b9db547eda45cf5849b

SHA512
c2aefa265f44b26bc2be07aa029a5d0ac71b6cf9b62b963f0479f0a5e355f75e37f92cce075a05bc44eff71e15a58c986356303097aa933ea908e764f57d3e7b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lojadwsr.default-release\datareporting\glean\pending_pings\06a5ff85-5ed3-4419-b4b6-014495e2a55f

Filesize
982B

MD5
e1d007430344801a114f86ccce9dfbc3

SHA1
428bf3ae2d3bd16369a98f7c1965aa718f67f15f

SHA256
a0c0ff8a27a2c56d5c5235e3fea1b459403d0601bb4ec90970d9769e24f98e55

SHA512
fa4ffbd579991cd31e88e3f51509fe1086c8ba7a0f536873f904aaa7d1a818a8b64614fbd1ea656440a2218c604cd4a8da614e421ecae22793dc8cda1c98e18f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lojadwsr.default-release\datareporting\glean\pending_pings\1e50fd23-a4f7-4dd5-aa6b-6c15c0e1957b

Filesize
671B

MD5
21edd67bf34e34747a38472e788cc559

SHA1
a8469b9ac6a9632ac1f446407f74b6bd71d9f3d0

SHA256
22927d358b090ee1948767e11eca5f92c12ed88547dde33b1e8580f4beeee349

SHA512
d8cec4ae97418d044d35f5342ace6f0b9d101467b0afadfa5c0dc2459a9dae56c626ebea914f2e2460ebb2be0cdac3a734d4868a82358264172635ee34b85eea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lojadwsr.default-release\datareporting\glean\pending_pings\3d46202d-0be1-49b8-9b02-65bcbd357374

Filesize
27KB

MD5
6f8dd39f387fdcb663bc2e193b8d1af0

SHA1
676ecd7125d0078a1de12c574f47285eca890621

SHA256
a972ec64369d1bab78d0c325bf2bff94653bc28704a00ae7bd46d1b57bfd639f

SHA512
58c588c7dd8dd75ec9b7fc542d0c6a94f0176f22b4097f00eb3ea68b6557086af0f84a460a9a36ecab9cb6be7c23968e0dfba33273e66494f009e89ca9e6a157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lojadwsr.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lojadwsr.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lojadwsr.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lojadwsr.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lojadwsr.default-release\prefs-1.js

Filesize
10KB

MD5
5577c2986887165978f110abce598d61

SHA1
c845b012998964c0d1e4f87821b8afb6e6621287

SHA256
828450294c14bf93207629f4bd975a9c0c88c59b008d46dd0101653b3db69aa5

SHA512
d71b6ba3665293fcbf8b65d5c93d4c42264ad64975145343939ff743e5e798affeb6ef87a6bfe2a59b93436bc4dfbae4d7ac46a4a34cc1d5b325f7c7c3f79467

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lojadwsr.default-release\prefs.js

Filesize
9KB

MD5
9a225a72c281ae79c8d238e7e5c58afb

SHA1
f4dbee097af3ce56a92c3a4da1fbde42152e3671

SHA256
06fee3dd0eaa27b3a1e34f61cca357a10ec292813862d7368e5aff6cd3d9dfcd

SHA512
cd27faebfe4f171c41bfa0c27a6c9ba506b4048745c92915685553f676bd2d1a43146077c5aaa5a9117d4767e3d8960f4919f6b02d7b720222f8e504f80c7d86

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lojadwsr.default-release\prefs.js

Filesize
9KB

MD5
225be5927c3c9d2a354592021e8bd402

SHA1
2cc1c8301f66c3196a5a712fc1ef3a27c7bf7a8a

SHA256
8c02b95f990c5220d8645021084836551af224e9d157acbaaac48dd7faecbf90

SHA512
4bb76e51b33b3b37cc34f8a8f779cecbf489c35e9ffaab0a27ee90a09007369db2988e8f2218f0060355a93073944590a6cf4aaef0ed8f739134432d100bb54e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lojadwsr.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
e3911ebd6ad343d728f065862508bd5a

SHA1
8b24017d016d8617ad2a53bd3e35b95122c5a4ad

SHA256
9f2b986c576881797ade92fe331067ef8880b9fdd3bd55d32ad010cd38eab0ac

SHA512
eb109ce5bf01fddb4cd4500108c88f307baee12271602bcb3da717477de3a0974241610e498ff94bee7652c184fd8d5805d424600162ccb194ccee027ba400d0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lojadwsr.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
623356a66204ca8023408bac33cc6730

SHA1
c6213793d566078fd1a46aecc514bff4f7b5d645

SHA256
8d0aace9f7d4e8f6afc1850bd177a6a9e810780a50567a442266457097a2c2c6

SHA512
96e729782a83ed24d74e484253c05d3b04ef3298e69e30bfea9afb5ca92bddfe60e42efc9d008d870ce1d65ee2e2da12cb353dcbe98642149455088262cfaf1c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lojadwsr.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
246c3b4bdb1e2e8cc1bff20de61a0221

SHA1
c4fd7735c2cc8c6ec3496304f2aafcd2727ab555

SHA256
5df2c621b81eb4d16a9dc90878851f7414effc313f52975f094371754ef5c5fa

SHA512
4bb8f7f608d2b474741d7094dcd109c6361bcc51af40e77c17d027a5173603a8cef793b9570ba3046842db56eab3df4be9cb85438c9445eb065f297764cb231f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lojadwsr.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
1f83db2580edb6e2f8302d6dd47f7f89

SHA1
b04925b7d5cae369c25618d83a2b376bf0510a97

SHA256
41357629fee388b8bb82f432e66964744f3bc82bb3e1f068a6251cb9c1968978

SHA512
d0b62914fe4e0b7925edef868fe1c7766fbd84d809efe3e0eb180de9eae6dfc2e9c3f0750882569d299548483d141e824003eb81d9baae8142ad4cd163548517

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lojadwsr.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
0bd2822824eb0d2edaaa73ee325c8128

SHA1
7a66b9f9adc358cf77c7209ad208764902648cac

SHA256
e6d25e6042a551219a55c9ca9b823a68366ed4e5e971cc0f814247f184ccde39

SHA512
d46aa4c6cc1188111c95978b8a61b052157a918621906c23ea0ba70adc2edbaf853099fc7700a9b1d427fa6ec13bc4553ca2e9233a8252cfe6e5f975194e2d0b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lojadwsr.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
52e804b584d9c371182d7f15a93ff3bc

SHA1
70e0ddbb9447c7e9f975430894257a5b4f765738

SHA256
82757350e186bb2d9eb8e97576f82926563689487912d2fdf681271ad9e299d4

SHA512
cc5f09207afadda8701e377e48920e5e8933c397ada9ecd3add012d80cd0e8875866f52b0597b559d33e5f7e4b1a854419b1158b046347f002b2e0a647f943cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lojadwsr.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
ee4f1879c11ee8792f2fee5000e621a9

SHA1
689c640fd43b0ee730c31872675b018bfca2be03

SHA256
6126ff1847f626c9f30c58923f4ba0d976215d6c68da70ab67c074d7802125bf

SHA512
bffb87749317811834fa0025f8624ada8dc7aa0f7e0c823dc7a7e2682b30cc390819d497e92fdfee856a164127a1eb2e99c05c966c01e3d8eb1bbca8e07215dc

Download Submit
C:\Users\Admin\Downloads\M6jiEL5n.zip.part

Filesize
33KB

MD5
5569bfe4f06724dd750c2a4690b79ba0

SHA1
05414c7d5dacf43370ab451d28d4ac27bdcabf22

SHA256
cfa4daab47e6eb546323d4c976261aefba3947b4cce1a655dde9d9d6d725b527

SHA512
775bd600625dc5d293cfebb208d7dc9b506b08dd0da22124a7a69fb435756c2a309cbd3d813fc78543fd9bae7e9b286a5bd83a956859c05f5656daa96fcc2165

Download Submit
C:\Users\Admin\Downloads\V8Q-xC8A.zip.part

Filesize
132KB

MD5
6a47990541c573d44444f9ad5aa61774

SHA1
f230fff199a57a07a972e2ee7169bc074d9e0cd5

SHA256
b161c762c5894d820cc10d9027f2404a6fec3bc9f8fd84d23ff1daef98493115

SHA512
fe8a4fd268106817efc0222c94cb26ad4ae0a39f99aacaa86880b8a2caa83767ffe8a3dd5b0cdcc38b61f1b4d0196064856bd0191b9c2d7a8d8297c864a7716d

Download Submit
memory/5284-451-0x00007FF888D10000-0x00007FF888D20000-memory.dmp

Filesize
64KB

Download
memory/5284-457-0x00007FF8CAD30000-0x00007FF8CAF28000-memory.dmp

Filesize
2.0MB

Download
memory/5284-460-0x00007FF888D10000-0x00007FF888D20000-memory.dmp

Filesize
64KB

Download
memory/5284-442-0x00007FF88ADB0000-0x00007FF88ADC0000-memory.dmp

Filesize
64KB

Download
memory/5284-441-0x00007FF88ADB0000-0x00007FF88ADC0000-memory.dmp

Filesize
64KB

Download
memory/5284-444-0x00007FF88ADB0000-0x00007FF88ADC0000-memory.dmp

Filesize
64KB

Download
memory/5284-508-0x00007FF88ADB0000-0x00007FF88ADC0000-memory.dmp

Filesize
64KB

Download
memory/5284-510-0x00007FF88ADB0000-0x00007FF88ADC0000-memory.dmp

Filesize
64KB

Download
memory/5284-512-0x00007FF8CAD30000-0x00007FF8CAF28000-memory.dmp

Filesize
2.0MB

Download
memory/5284-511-0x00007FF88ADB0000-0x00007FF88ADC0000-memory.dmp

Filesize
64KB

Download
memory/5284-509-0x00007FF88ADB0000-0x00007FF88ADC0000-memory.dmp

Filesize
64KB

Download
memory/5284-496-0x00007FF8CAD30000-0x00007FF8CAF28000-memory.dmp

Filesize
2.0MB

Download
memory/5284-495-0x00007FF8CADCD000-0x00007FF8CADCE000-memory.dmp

Filesize
4KB

Download
memory/5284-439-0x00007FF8CADCD000-0x00007FF8CADCE000-memory.dmp

Filesize
4KB

Download
memory/5284-440-0x00007FF88ADB0000-0x00007FF88ADC0000-memory.dmp

Filesize
64KB

Download
memory/5284-443-0x00007FF88ADB0000-0x00007FF88ADC0000-memory.dmp

Filesize
64KB

Download
memory/5284-445-0x00007FF8CAD30000-0x00007FF8CAF28000-memory.dmp

Filesize
2.0MB

Download
memory/5284-446-0x00007FF8CAD30000-0x00007FF8CAF28000-memory.dmp

Filesize
2.0MB

Download
memory/5284-447-0x00007FF8CAD30000-0x00007FF8CAF28000-memory.dmp

Filesize
2.0MB

Download
memory/5284-448-0x00007FF8CAD30000-0x00007FF8CAF28000-memory.dmp

Filesize
2.0MB

Download
memory/5284-450-0x00007FF8CAD30000-0x00007FF8CAF28000-memory.dmp

Filesize
2.0MB

Download
memory/5284-455-0x00007FF8CAD30000-0x00007FF8CAF28000-memory.dmp

Filesize
2.0MB

Download
memory/5284-449-0x00007FF8CAD30000-0x00007FF8CAF28000-memory.dmp

Filesize
2.0MB

Download
memory/5284-461-0x00007FF8CAD30000-0x00007FF8CAF28000-memory.dmp

Filesize
2.0MB

Download
memory/5284-465-0x00007FF8CAD30000-0x00007FF8CAF28000-memory.dmp

Filesize
2.0MB

Download
memory/5284-466-0x00007FF8CAD30000-0x00007FF8CAF28000-memory.dmp

Filesize
2.0MB

Download
memory/5284-463-0x00007FF8CAD30000-0x00007FF8CAF28000-memory.dmp

Filesize
2.0MB

Download
memory/5284-464-0x00007FF8CAD30000-0x00007FF8CAF28000-memory.dmp

Filesize
2.0MB

Download
memory/5284-462-0x00007FF8CAD30000-0x00007FF8CAF28000-memory.dmp

Filesize
2.0MB

Download
memory/5284-458-0x00007FF8CAD30000-0x00007FF8CAF28000-memory.dmp

Filesize
2.0MB

Download
memory/5284-459-0x00007FF8CAD30000-0x00007FF8CAF28000-memory.dmp

Filesize
2.0MB

Download
memory/5284-456-0x00007FF8CAD30000-0x00007FF8CAF28000-memory.dmp

Filesize
2.0MB

Download
memory/5284-454-0x00007FF8CAD30000-0x00007FF8CAF28000-memory.dmp

Filesize
2.0MB

Download
memory/5284-453-0x00007FF8CAD30000-0x00007FF8CAF28000-memory.dmp

Filesize
2.0MB

Download
memory/5284-452-0x00007FF8CAD30000-0x00007FF8CAF28000-memory.dmp

Filesize
2.0MB

Download
memory/5496-842-0x00000000056C0000-0x0000000005716000-memory.dmp

Filesize
344KB

Download
memory/5496-841-0x0000000005520000-0x000000000552A000-memory.dmp

Filesize
40KB

Download
memory/5496-837-0x0000000000A70000-0x0000000000AAC000-memory.dmp

Filesize
240KB

Download
memory/5496-838-0x0000000005450000-0x00000000054EC000-memory.dmp

Filesize
624KB

Download
memory/5496-839-0x0000000005B30000-0x00000000060D6000-memory.dmp

Filesize
5.6MB

Download
memory/5496-4307-0x0000000007380000-0x00000000073E6000-memory.dmp

Filesize
408KB

Download
memory/5496-840-0x0000000005620000-0x00000000056B2000-memory.dmp

Filesize
584KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads