hxxps://archive[.]org/details/ptu-collection

Analysis

user interaction
yes
max time kernel
1050s
max time network
1026s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://archive.org/details/ptu-collection
Sample260812-e2a34sydqf

Score

6^/10

persistence

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
118	discord.com
149	discord.com
160	discord.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\PTU Collection.rar:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
4700	POWERPNT.EXE
1236	WINWORD.EXE
1236	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2052	mspaint.exe
2052	mspaint.exe
304	mspaint.exe
304	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4700	POWERPNT.EXE

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	4356	firefox.exe
Token: SeDebugPrivilege	4356	firefox.exe
Token: SeDebugPrivilege	4356	firefox.exe
Token: SeDebugPrivilege	4356	firefox.exe
Token: SeDebugPrivilege	4356	firefox.exe
Token: SeDebugPrivilege	4356	firefox.exe
Token: SeDebugPrivilege	4356	firefox.exe
Token: SeDebugPrivilege	4356	firefox.exe
Token: SeDebugPrivilege	4356	firefox.exe
Token: SeDebugPrivilege	4356	firefox.exe
Token: 33	1980	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1980	AUDIODG.EXE
Token: SeDebugPrivilege	4356	firefox.exe
Token: SeDebugPrivilege	4356	firefox.exe
Token: SeDebugPrivilege	4356	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4356	firefox.exe
4356	firefox.exe
4356	firefox.exe
4356	firefox.exe
4356	firefox.exe
4356	firefox.exe
4356	firefox.exe
4356	firefox.exe

Suspicious use of SetWindowsHookEx 42 IoCs

pid	Process
4356	firefox.exe
4356	firefox.exe
4356	firefox.exe
4356	firefox.exe
4356	firefox.exe
4356	firefox.exe
4356	firefox.exe
4356	firefox.exe
4356	firefox.exe
4356	firefox.exe
4356	firefox.exe
4356	firefox.exe
4356	firefox.exe
2052	mspaint.exe
2052	mspaint.exe
2052	mspaint.exe
2052	mspaint.exe
4700	POWERPNT.EXE
4700	POWERPNT.EXE
4700	POWERPNT.EXE
4700	POWERPNT.EXE
1236	WINWORD.EXE
1236	WINWORD.EXE
1236	WINWORD.EXE
1236	WINWORD.EXE
1236	WINWORD.EXE
1236	WINWORD.EXE
1236	WINWORD.EXE
304	mspaint.exe
304	mspaint.exe
304	mspaint.exe
304	mspaint.exe
2548	PizzaUnited.exe
2548	PizzaUnited.exe
2392	PizzaUnited.exe
2392	PizzaUnited.exe
4612	PizzaUnited.exe
4612	PizzaUnited.exe
2080	PizzaUnited.exe
2080	PizzaUnited.exe
5960	PizzaUnited.exe
5960	PizzaUnited.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 6116 wrote to memory of 4356	6116	firefox.exe	87
PID 6116 wrote to memory of 4356	6116	firefox.exe	87
PID 4356 wrote to memory of 5344	4356	firefox.exe	89
PID 4356 wrote to memory of 5344	4356	firefox.exe	89
PID 4356 wrote to memory of 5344	4356	firefox.exe	89
PID 4356 wrote to memory of 2804	4356	firefox.exe	90
PID 4356 wrote to memory of 2804	4356	firefox.exe	90
PID 4356 wrote to memory of 2804	4356	firefox.exe	90
PID 4356 wrote to memory of 2804	4356	firefox.exe	90
PID 4356 wrote to memory of 2652	4356	firefox.exe	91
PID 4356 wrote to memory of 2652	4356	firefox.exe	91
PID 4356 wrote to memory of 2652	4356	firefox.exe	91
PID 4356 wrote to memory of 2652	4356	firefox.exe	91
PID 4356 wrote to memory of 1656	4356	firefox.exe	92
PID 4356 wrote to memory of 1656	4356	firefox.exe	92
PID 4356 wrote to memory of 1656	4356	firefox.exe	92
PID 4356 wrote to memory of 2832	4356	firefox.exe	93
PID 4356 wrote to memory of 2832	4356	firefox.exe	93
PID 4356 wrote to memory of 2832	4356	firefox.exe	93
PID 4356 wrote to memory of 2832	4356	firefox.exe	93
PID 4356 wrote to memory of 2840	4356	firefox.exe	94
PID 4356 wrote to memory of 2840	4356	firefox.exe	94
PID 4356 wrote to memory of 2840	4356	firefox.exe	94
PID 4356 wrote to memory of 2840	4356	firefox.exe	94
PID 4356 wrote to memory of 1136	4356	firefox.exe	95
PID 4356 wrote to memory of 1136	4356	firefox.exe	95
PID 4356 wrote to memory of 1136	4356	firefox.exe	95
PID 4356 wrote to memory of 1136	4356	firefox.exe	95
PID 4356 wrote to memory of 4708	4356	firefox.exe	96
PID 4356 wrote to memory of 4708	4356	firefox.exe	96
PID 4356 wrote to memory of 4708	4356	firefox.exe	96
PID 4356 wrote to memory of 4708	4356	firefox.exe	96
PID 4356 wrote to memory of 1156	4356	firefox.exe	97
PID 4356 wrote to memory of 1156	4356	firefox.exe	97
PID 4356 wrote to memory of 1156	4356	firefox.exe	97
PID 4356 wrote to memory of 1156	4356	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://archive.org/details/ptu-collection"
1⤵
- Suspicious use of WriteProcessMemory
PID:6116
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://archive.org/details/ptu-collection
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {37c103c5-4656-42d5-955e-1cbfd1364a27} -parentPid 4356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4356" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {dfe4ad67-c9fe-42f1-b922-58a96f69f2bd} -parentPid 4356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4356" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3728 -prefsLen 25164 -prefMapHandle 3732 -prefMapSize 270279 -jsInitHandle 3736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3744 -initialChannelId {fd50b89b-7428-4326-adae-bea396eef0b7} -parentPid 4356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4356" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3892 -prefsLen 27274 -prefMapHandle 3896 -prefMapSize 270279 -ipcHandle 3964 -initialChannelId {3e8362a4-8677-42f2-b9bf-bcb622472f0a} -parentPid 4356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4356" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4436 -prefsLen 34773 -prefMapHandle 4440 -prefMapSize 270279 -jsInitHandle 4444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4452 -initialChannelId {437b1430-a10c-470d-8f69-3bc66ed944c1} -parentPid 4356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4356" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5200 -prefsLen 35010 -prefMapHandle 5204 -prefMapSize 270279 -ipcHandle 920 -initialChannelId {11ecce3b-7ba2-4130-ba56-1149af0bf256} -parentPid 4356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4356" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5600 -prefsLen 32952 -prefMapHandle 5604 -prefMapSize 270279 -jsInitHandle 5608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5520 -initialChannelId {99daeb40-ab3a-480a-af02-6a3db1877ed3} -parentPid 4356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4356" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5624 -prefsLen 32952 -prefMapHandle 5628 -prefMapSize 270279 -jsInitHandle 5632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5640 -initialChannelId {42acdfd4-40cb-4fe7-9b94-e73752137853} -parentPid 4356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4356" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5956 -prefsLen 32952 -prefMapHandle 5960 -prefMapSize 270279 -jsInitHandle 5964 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5972 -initialChannelId {c0313d5e-4afc-4cfa-8b95-334ac919b135} -parentPid 4356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4356" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1156

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4564

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\CompressCheckpoint.emf"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:2644

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\Desktop\New Microsoft PowerPoint Presentation.pptx" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4940

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\New Microsoft Word Document.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1236

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:304

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\PTU Collection\Read Me.txt
1⤵
- Modifies registry class
PID:1536

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3744

C:\Users\Admin\Downloads\PTU Collection\COLLECTION RAR\PTU Collection\PTU_VacationBuild\PTU_VacationBuild\PizzaUnited.exe
"C:\Users\Admin\Downloads\PTU Collection\COLLECTION RAR\PTU Collection\PTU_VacationBuild\PTU_VacationBuild\PizzaUnited.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2548

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004F8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Users\Admin\Downloads\PTU Collection\COLLECTION RAR\PTU Collection\PTU_VacationBuild\PTU_VacationBuild\PizzaUnited.exe
"C:\Users\Admin\Downloads\PTU Collection\COLLECTION RAR\PTU Collection\PTU_VacationBuild\PTU_VacationBuild\PizzaUnited.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2392

C:\Users\Admin\Downloads\PTU Collection\COLLECTION RAR\PTU Collection\PTU_VacationBuild\PTU_VacationBuild\PizzaUnited.exe
"C:\Users\Admin\Downloads\PTU Collection\COLLECTION RAR\PTU Collection\PTU_VacationBuild\PTU_VacationBuild\PizzaUnited.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4612

C:\Users\Admin\Downloads\PTU Collection\COLLECTION RAR\PTU Collection\NewYearsUnited\NewYearsUnited\PizzaUnited.exe
"C:\Users\Admin\Downloads\PTU Collection\COLLECTION RAR\PTU Collection\NewYearsUnited\NewYearsUnited\PizzaUnited.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2080

C:\Users\Admin\Downloads\PTU Collection\COLLECTION RAR\PTU Collection\NewYearsUnited\NewYearsUnited\PizzaUnited.exe
"C:\Users\Admin\Downloads\PTU Collection\COLLECTION RAR\PTU Collection\NewYearsUnited\NewYearsUnited\PizzaUnited.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
Size 1KB
SHA256 74a192118e0572a586fbed7b840cba2a456e9220070528eb4eafd2a110693bc5
MD5 738d79eb39508099c37cc8052d42de01
SHA1 88c69cd480d021f3a0f7aaa50fd8bd647c9babdd
SHA512 8bec9dfee29cc7da6a9d5e3e85581e11cde45f4ca940ae853ef4f203b0e8e0b9096b4e2a5a50ac171a37406559554e34653c5fece637680813dd298a21dee0e2
TLSH
T1B3312B0682385AD12E98F90162C1D5033C76B7D0ED948C57891DC2682F9A7F6F73C90C
MD5 SHA1 SHA512 TLSH

Submit Download

EAD3A783B1286FF481A991FED81C6FE7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EAD3A783B1286FF481A991FED81C6FE7
Size 384B
SHA256 01739acb4c4aa62a5bd6787ff7b8f316d690e82bc0b374079f4f30d6fe72fc89
MD5 8cc959746a3d1149d1dd03388d514c56
SHA1 c34432a84dce26860355028963c94f145e0acda9
SHA512 7b7e7670e7b2186840f67e63ced46776bfee76de5451d3fc425c2c686f06d179f24ce39130bb07bf325770d7ffa99f4a0dc2de134892c789056d13688ba5b909
TLSH
T166E06155072D2B9411A5E655E844D4A32CFCC4C15BDA607517548B136045B9EF9327CD
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 47a6cd189f10737a241539b0de158c78752bd1230871d0c3f973a6a2c73a8487
MD5 e01daae1b324892fe84475dc06622b39
SHA1 d432dcba9e9a33f70bcaf43dadc693800ed5438e
SHA512 83d4b99be69f91f7e7bd962e1071b22120661805aca44a0e02382c67506b4712f9b680bd1ac4690865784bd423182b29398596e24421d63db057448fad6042ce
TLSH
T1A6C09B0437B54565F1304DBF1657631247FBE505CD9183541F70525BC65DB425CF5D07
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 1ae2a16110dc6b4096268a5af4faa73c104ed68cb08d1b0ef03daa4074ff6a0f
MD5 0014e7f5800677ad3734ee3880987e4d
SHA1 afaaadd0f32922c582f8f330bb1a5562a0525d17
SHA512 4e7c40d81cb6b97cc7e5b43cbb720feb4ccbac88c2f652e314fbdcb422a27917a31db08a55c9ef9bdc22ad54c355c2d2c17790d036c0294f9ce8e0ab7ec120f7
TLSH
T1B7C09B1473694719F10D217D79D5560517B68109F5D6C3045F7C5135D519A400871D06
MD5 SHA1 SHA512 TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
Size 426B
SHA256 b1b5cfc91bf0e8dfd52bf7873b68fa6b14c423f383e2c71a0e0d79779d147533
MD5 baf8301793c132a05afb5c190f0ab424
SHA1 028e7fd25918353051b7d2e2a1b91c61db5dd350
SHA512 ee683efef89aeecfae00941a2cdc592d22edf626a9772a5469a00da5aa908e3b159a7e4a1d79f6213db220b74da7504b19f554958d648afe708c6595263f22e2
TLSH
T157E0D89469FD506CE3326E7C4BD95A3E963EF263180467B8272041582656D960C22B32
MD5 SHA1 SHA512 TLSH

Submit Download

EAD3A783B1286FF481A991FED81C6FE7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EAD3A783B1286FF481A991FED81C6FE7
Size 192B
SHA256 c606a9806f1464b23302d6f440dd1a9c3ebd12db2edf7401ae5c33d92e937ed3
MD5 f36b41f82aef97fc984c41738401b649
SHA1 970551a4f7e39e4e2d961429c23b96667f59f88b
SHA512 3747ef42df0eb9cb33a552f930bac653f216479f95eb3adf5297ddc5ce1b6bd99582802cf7770e66acc2f7568bcfe59d353d7e2f6251755e85b809d805e2821c
TLSH
T11AC08C013B240211E07003FD8BE2AE260FFAD30CF14383041FB0022B8408A000E60E06
MD5 SHA1 SHA512 TLSH

Submit Download

mip_sdk.miplog

Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
Size 14KB
SHA256 b75bea84202528fdd87de1f4a4561e3e8faa0fb60fdafd29ba0d59e727d733b1
MD5 de93f5660de7f8f99dfaae05d895b70b
SHA1 8fda203164a59f028636d543af7734e72117ab06
SHA512 2b5333571662d864ad67e5b0a8b657f8e7a08cfc5daeb697820b00957e9849956e62bee259f373f15f31eaad33bbeea8c98f5cc58d577a2c336c5c6c6d6942ab
SSDEEP 192:LkjokGk91RE7hWLz7ZpKRxZrUd0Gs+j6+I+9XIqdRKJzd9LLmEZUs+Sx7HXjjXJ+:9ctA/IvbliI072l
TLSH
T1B86231A2965EC9FBA835BF0262DB37A18005755E27DB7009675C0389338BB058FFE725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\activity-stream.contile.json
Size 5KB
SHA256 aa4d731dabc28a026b23b1c10c8e38c4d5faa2961f1391f6ca6e30e8422d0f8f
MD5 bf739e95fcb24579080a458b60d3aa63
SHA1 4d0e4eaaaf429102de60f9912900776b8557835e
SHA512 114409bf6d795cc063c3196c258fd2e61a19d2ecaeb6f03069d47149609596ae57c51af19a6d6a65bf4e180f4d23d1d1729ba98cd131da34a56d8ef0952e1364
SSDEEP 96:kKYlLW4Yn/KR1p6Dd6toxLWzYneip53ImT1NhWz8kcMLWCYnvax7pY3ob:GL68pwASxLHei7CQkcML4vuq3ob
TLSH
T1A5B15D5FC9988AD353A375D13D0A2B4CD193728BD4ECED5DE389AC1041BE74A495E2A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 0fe194e0309c6005cd3b54c2636785c3d3670e250ef4625fcbcf64626d34770d
MD5 da399c15d93933d0bc7926b7c54227ad
SHA1 696d73625c1ea759508dda049fb8e4a50843d2bb
SHA512 610dc2cd132291b3675299349aa835a6bb348a568653e3757d02c2b0560f0563bb756576a4a0d73d3b96c75334a628b82c20ac8552bbbe707d8bda3558e09db4
SSDEEP 384:HXkRyiO024YFDL84KKDL849B7SOEAd9KVRaAcP+AWRMAb:3mZYFDL8lKDL8CB7S/AmVAf+hRMW
TLSH
T1C0727D3D5F003CAC25A7C0ECC5E982A94D18B7A7DEEA806D21183D0DC698969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 d6c355999df100c3eefb538dc763525fd94c96cee3cc5502d2dda5fd8cd23315
MD5 2dbe6d975097102523b7faff37a6e24f
SHA1 5c56edf0188b375ebabda7142bae4d100bc3bbc9
SHA512 e226d4eecc7348d73bc8f0830e7bd1bcd5b4d2029dc7cd6cb163d664b379dc524d31d30eec17d8f5ebeab6d0c516c134c663a2f67a129952b634b9a500cde16f
SSDEEP 3072:j3lcVHM7mrq6BXjGZzo+m+jlY+osQQoV2Du:pc0mrq6BzGZ8+tRosQQoV2Du
TLSH
T1DCA39FF6DBA2CD3D95FFC42C66C2C53EFD222444B3E32019CD636654A2C6B786679248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 387B
SHA256 4377223be6b5e1a0b4bcd9e24c4e324120690c9c3fe8ae59f3d9025b22a8f3e0
MD5 8e03f431b9654f05f75cf9a2e96d135e
SHA1 52c89eb5d87c89b5fcf14e52b699c9d136d61768
SHA512 d36d4181c2415ed37d350cc6a3d458f0c341f3c9aba55b2482853498b97cafb1e20bd7abb6026b4645526fb1def6a817b623fd66c864b2fb27e5de00e57b269c
TLSH
T1DAE0DF9B6331EFF247BD40E43E3C9CED26F1895ACAD6743239CC8D881D106432A6B488
MD5 SHA1 SHA512 TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 442B
SHA256 3d5774497b36eff4c2c9bf00be2777f85b12247424bfaefc008cc81eb04fb5b5
MD5 6f4bb4edcfc2cfb51b43302ccb7761d2
SHA1 4cfe27f8b69883222be7193e4818bc376a7e688a
SHA512 bcf4e2a0b96a4a068c8b64dbab38d6c9ebfb6bf0bd7fc6c27031c479d7499d2cc778ac9780ec10a31541b852143824d59e400fa78a43b8409fef8db770f5d7bf
TLSH
T108F0A083A760EBF1837E00A07D384CE92AF04987CA85A52235DCCD481C115831527988
MD5 SHA1 SHA512 TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

ExcludeDictionaryEN0409.lex

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

5JIZ0QY40QN7Y3ZPT6QM.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5JIZ0QY40QN7Y3ZPT6QM.temp
Size 13KB
SHA256 2a84719bb6c9007086acf07303919b2c51328b000e0ecc99b54b5b84143af4d4
MD5 39812d61b378fa5e34f787b2b3c4013a
SHA1 bb9e84d475be77ab43d93342e871eb2dbfcfca58
SHA512 e64c493937782ccbd81dd6be49f2e404f849d06f189ad6bdd896e4a46eb82238d7fc921f53be4ff875ee27fc4f28af001e95a29daa4b5af5f6027562b2c4fa52
SSDEEP 96:mwW1//D/KfzJHB8oipKBN2fa6o1vysfu/RvRoAXRvHnq4:/aT/Ezpy3K0a64yOmRp9XRC4
TLSH
T11452370117F70D55F2F38976BE7273179B36FD014B1A821E8182A24A49327944E6EFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 13KB
SHA256 11abb22c04c96fe080689a3c8cd7500efacd2be34a659124fe85b11dea6275de
MD5 12f5bf92348017d88301270337c9479e
SHA1 eed05668ac05e319d0748c9beaf06f45a17ce47b
SHA512 a04aa27a1b9d93d2aa35b4cd6f8162db6514db69854d22f7f6160b26fcaa4efe4a7d1be4f7ab2b05e4f88658444948e68b3d264238c3810185534b3da820dc79
SSDEEP 96:SX/O/xzJHB8oipKBNNa6o1vyru/RvRoAXRvHX4:SXm/xzpy3Kha64yrmRp9XRP4
TLSH
T1C252370117F71E65F2F38972BE7273169736FD014B1A821E8142A34A4A327944E6EFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d00655d2aa12ff6d.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d00655d2aa12ff6d.customDestinations-ms
Size 737B
SHA256 a67de37d2739f6fe90a9fdbca056b2a22a45ae7bd1d06a199e441baeab4170e4
MD5 4f71e9c796c4b652f508bc21e77e580d
SHA1 6418bcbcd100140d274379f64c2b66e25d5bb5b4
SHA512 078f694b2ae60496aa84155650ce67a69add01981ac5f5f789a76e5c3810ec3354d7f8b45e1ac467105c506b626ac55e74d16082cf17b27c7bb47afdfcbf61ef
TLSH
T15C0199026AAA1F11F0A1437BC87B270E827078029324D79EA590521A6A61840994CB3B
MD5 SHA1 SHA512 TLSH

Submit Download

d00655d2aa12ff6d.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d00655d2aa12ff6d.customDestinations-ms
Size 24B
SHA256 90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228
MD5 4fcb2a3ee025e4a10d21e1b154873fe2
SHA1 57658e2fa594b7d0b99d02e041d0f3418e58856b
SHA512 4e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 63KB
SHA256 4a21d25e26e7c85270ed415cee5f4eadbeb5cf29a5685c56bb5d1d191d5426cd
MD5 0ba79625aa823718147df0c20121ee5b
SHA1 9229ed244808e01a6133b201f52def073947d570
SHA512 40c9db0b42cb4de8b26f0519e57be6ddc340aaa7ee9fcddebf1e1492f914800c3d3f50765a78229611a74be70f0aeda791caf29ee29191189b4f66cf8ea044fb
SSDEEP 1536:NdqhFrrlO0uNsxsayAnP75Qa6BEl8+iyEPCUY1icXuB2:NdqvA0A419P7P56yWAIkus
TLSH
T1F0531045EB1A553FD82803BA9CE61B003F79F8895A1A2B67375C64382C873DC3D5E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 70KB
SHA256 9e8494a7642768d212a05f5e5c028087ef447657d9fc834eaaeb0b944bea9e7d
MD5 c961e4be87a6c54cbe30b80f014ca8aa
SHA1 4a97188e0491f392440785498c6dcb5e24112456
SHA512 6b1814ee05935d2c9cbf820ced14204a9dee9400b275ce6ed17340062bbcf09743733c9bf10b8d0a2e92c85bd26de2d9266670983f5ade7279a232250db1b964
SSDEEP 1536:841zUuMFo1qhMOP+R08umqnK+NMA8YaDWt0R4RnjKD/UtuDzhxQ:841XI3GOQ08fmnNqRSQ4BIsgvh+
TLSH
T1EA630F45EB1A553FD82802BA9CE61B003F79F8895A1A2B67371C64383D873DC3D5E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 2069b80b21b0f5a47a863ee98652851505c04558bcce9cd659d995f52565a285
MD5 03be2e0ccf86a46ba92f634b254b5b70
SHA1 dbdde1733c4c4f80733c2dc5abef35749d491045
SHA512 e1f674ee22fc7a5648464be71aa4cd182001fa81976f7429b85c6115f638f6fd17f5ad285ffc6c7fe36dfed08fdc29a180a3db5178843675d7113d199045f4c9
SSDEEP 192:fOv5zbo0bOQyjrxeCE1d66JoztdzgCl6mc0dz:Qbo0bOQyjOd66Joz/zgC1jd
TLSH
T191D11D28F629467FC848023BCCA51F100E76394BD85E3F1971DC241D2D9A2DEBA8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 d86d1d340ea044cc0efb43e073ac42f15a1e8693bed878a68d806b3a443c06fc
MD5 12974929fcac61b471210bfcc72e99ca
SHA1 935eb44d1ffb3f3c82e41a3067b03f9a2ebe1619
SHA512 df1c2d3ddbd82c6a7fb4e47ac74422de507a48b626075934412e412024c70285aa72f1bec7c3334bbcdf5e0150661d1f6a38e905e736f27db0a6a82e0e47ec8e
SSDEEP 192:ECE1d66JoztdzgCl6mc0d0Ov5zbo7RZOQyj73:Gd66Joz/zgC1jVboNZOQyj
TLSH
T194E12F68EA28467FC408027BCCA51F510F36398BD84E3F19759C641C2D5A2DE7B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 63KB
SHA256 3234507dfdcf9c0fa1061fc1863777314c117a8b7cf2307c1f8952a18996bcf3
MD5 4280cd0fb05b33b264377f1cec96bddd
SHA1 8e0fa082deee10a6ee357aa662392e2a875899a4
SHA512 b536d43cdb2290fc6ae985dcf1373b403c6d42cf3f718fbb9b876ec98fd48ce953b25992d52505d7f5f292edba13dd9a970dc5c000ca59ea12b8e0a82588c4e7
SSDEEP 1536:JdqhFrrlO0uNsxsayAnP75Qa6BEl8+iyEPCUY1icXuBC:JdqvA0A419P7P56yWAIku0
TLSH
T1F3531045EB1A553FD82803BA9CE61B003F79F8895A1A2B67375C64382C873DC3D5E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 56KB
SHA256 030499401f266b7fc7b185bb794e0673e68c8dd0ce3e5e0cd405731e788ddb72
MD5 f335f4e2124616f105ccc11affd2bbf2
SHA1 b0f7aa668b37cdf21c998f18d72fb429ae2772ca
SHA512 9541d08f40b9b3c35fb303ee2e73381b03ed5bad6139dc43c527bbabddee06bf4e3872fe4a4fd302f28f613bff07a2904afb19b321d44f88e1b4a9a44fc10f66
SSDEEP 1536:PFHhZEJAiJJwsQ9ayAnPQb1ddQpHUTIlDd4FYq204:PFHo3Jqrw9PQb9GUkvKF2t
TLSH
T1D1430044EB1A553FD82803BA9CD61B003F79F8899A1A2FA7375C54382D872DC3D5E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\events\events
Size 1KB
SHA256 f3bc0b0d8ff4666281416986e5712cae54eac07a7f3910c7f600f97373ce4586
MD5 6588bd0f2e62a1663168ba773d9246d4
SHA1 504573f832572b156639643c808ef09556b68f3b
SHA512 5b0508a02fa15598e975cd3bd67cb4b0a2229bacf34b7e64af26073a02b7db7ea8b4e1da60bf3523ae338cfb3d8396b6271d60cd38497bb710b092126af92661
TLSH
T160216D4C39B94D7A9C8BF29C7450628E97958E0B44471D534E02EFCDCDA1AED326A43E
MD5 SHA1 SHA512 TLSH

Submit Download

44d5f85e-3c86-404c-b8dc-66ca34010c35

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\44d5f85e-3c86-404c-b8dc-66ca34010c35
Size 2KB
SHA256 0886f4d87462d8d82bdca5013a9646a37133953c0b6c7632abe2fab17f1a8dac
MD5 aa0566a658b8fb5bc1207c3c569ee43c
SHA1 f7007d079d9fbbef0071aa7892700cd4f7fe3eb7
SHA512 0f504720a0d96573372ddb31c73c9d9c16aae81cae38d95d7582ca540c66692017118ad3e6e4eab54c69c7d35ecc4884fb97dfcba289250a285c1d4db875b8a6
TLSH
T10A41479C39749CBA9CC6E24D9491338E93A19A0340C31C836D81EF0CCDD569D676F52F
MD5 SHA1 SHA512 TLSH

Submit Download

9dbec8f1-06c2-4678-a5f3-1a273bfd05bc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\9dbec8f1-06c2-4678-a5f3-1a273bfd05bc
Size 883B
SHA256 d0d7e9ed0a9ca111c4baf691efa24cdcd18977ab2d65992dce8601fe2043b5ca
MD5 10ec66da7c949b3abf78c6b238d1a74e
SHA1 b8eb89e18a50e1616098cf2b9da702c9342e5ece
SHA512 2adfb2c1099d21e2eaa0537f24a166831a344633d6d7e99d884b1da950c56e69a5002d93ed4956c79db655d0f468f13e7bfae54917d8b16d3bbf621688493080
TLSH
T115110092993475F2CCBCD24F84A5370647E5BA1380D644143DA09E180FBE51AEBAB74B
MD5 SHA1 SHA512 TLSH

Submit Download

9f219d3c-143c-4ff1-90fa-a31835c378db

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\9f219d3c-143c-4ff1-90fa-a31835c378db
Size 235B
SHA256 6d7f14fc5051061e558880a28544c2106aa011caa668f4d24d23d0dac6c5a035
MD5 86f2c28c341ba932a5e467a752ea4d26
SHA1 7ce63cd02fc2c79b2f8bad2ee7cea117ddee6532
SHA512 2982e3a933f4eee2c1c43005602f9a35e0921218778f5c86317540a2fb3346da25a9ca072c22d0cb77639e86172392bceba2aac8a9c6843385838d5002a0ad03
TLSH
T172D097C528A82B7C08240F03B0A029E331E98C3314A1A810C5A00A389EFEAC4519192A
MD5 SHA1 SHA512 TLSH

Submit Download

a59f0a65-3082-48b8-b44b-b2a041e4bd5d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\a59f0a65-3082-48b8-b44b-b2a041e4bd5d
Size 235B
SHA256 4890adfd4aa46f374cdcff9fce3ca105fca38a25e27e4dbcc280bec9ca787dcb
MD5 dd953f166c965185a6cc391571a01dd0
SHA1 e76a57812ef065b7bb19e02336e5aba300fc755a
SHA512 170f8adcacb06b4ba413d56176d84eca5c5917d86678238a8314bd315e6c8e9cae9d820992c8c2e84643eae6ad684c32c15f674dfedc675ed2f30a88eeb1d4ca
TLSH
T14BD097C0149863AC08240F47F0A078C230848C3360B098108D60E378DDB89C9412181A
MD5 SHA1 SHA512 TLSH

Submit Download

c819f155-f636-468d-ad5c-a094a5af9405

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\c819f155-f636-468d-ad5c-a094a5af9405
Size 16KB
SHA256 30614c27797d1665f30381915d9af2eb3a16c4529eb625fdb5960feae5bae1a9
MD5 0324dad390601f0e54234d0d20bfd193
SHA1 cf43593a9b9c102472bdf4913379265677e6aff5
SHA512 3079fd4d253738f73ff482bfbfcc2423cfb2239ef9b92c950119a07b740943f1ba7a5dfa24937175f527744cf51b7aafd7b58aa7d9c0e86d6ed644654e56f10e
SSDEEP 192:b7uapxeccSX0THp27Rsap6oDallJxMCI3sauS5K/bzcRDhPi1XWYPiOu5w1pemyR:dUTprI8FS5K/b4RDhq1maumyHyA
TLSH
T1BB72B916686055BA8191E3A8D4BC7FC3E1F638CB4C419FCE8BE4BD085DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f295885a-11c4-44cd-ac6d-308046872e9e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\f295885a-11c4-44cd-ac6d-308046872e9e
Size 886B
SHA256 555093204ec2700e4617e7b3fa6e1b4f7553afa4429b236253dea6abef7f1a94
MD5 16153115758324a2cd6ffd1c107628e3
SHA1 ac41e2443b87cf992e143519007258a13009dc26
SHA512 66e0801e1b8070e41f6eac92a167cb07482d7e5f5998cbf48cf4b6951c73444c99ad978153f54143aa8d25b6913e318b217fec1efa20bb5403843c64d11efecf
TLSH
T12C1104918D6874F2CC6CD18B98E4774286D57623C0CA09147D915F1C0DFE51B979B707
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\extensions.json
Size 16KB
SHA256 6bbb215307c6a6db43864bf6c3d0dbd819edd39022b9a59fd271543c8884e55a
MD5 f37fab47e5645ceecf38ff32f53b4801
SHA1 18b1810ddfa1fc23b481b62e4d884444b8b63b0a
SHA512 c19aa7f659db681cf74746d8c8e0e1f598a7166a8dd134a53259535f0bd19cd8658af3b36c02462f4acfdae4cf665ff9ac20836cfcddc49c760d1d9fd1100a01
SSDEEP 384:fkI4v/Umldv+8dhWn94zc96o/AL4H4L4PmL4H4L4H+L4HsDU4hQu:sI4nRfzXa4c6wi464U464k4V4R
TLSH
T1D772421545049EB8294FA79AAA367E01C37D533B60885C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs-1.js
Size 7KB
SHA256 30ce76f89f2105cf927e84de77b86c887f83ce14e0dfec82759e4b4bd83c0e93
MD5 d1ef79f9be92c62059f0a65f9283bf1c
SHA1 8439a3bc76a44f784df06e971326578ccfee0a57
SHA512 0d349c68fd3ea13774526437bfdf83bf550884c013efc6c0b4e0fa96c35abaaa12a2abf13f398f99c87d69cf211f414a53575cf4599041770d3f4a026a8efd7a
SSDEEP 96:xHYVTUmWPqGqmfOBVObzS2NSSlvdv9jhnKH5OVAqvqa7Bw88S8L4cnZUs:2bWCRmfOBV0NSSs5Bkqa7Bw88l
TLSH
T144F11F789504CF7F74B6766CAC6888316AB2023BB7BF68C650BA44C4055CF3846F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs-1.js
Size 8KB
SHA256 7298c34a8614c58c3a7814401004f3c0e1c656589bea506c4c1d1ca535501af1
MD5 716a98340b45027bae7ed2eeb26435b6
SHA1 f63631e050b3acf9a825471482036c44f66a815c
SHA512 664a0e1a6c2fc6b2972e2733cd4d209c1deaad056ecd03f4e5b2af0801324d61a006fe0c83f5e4d4ef5ab720a674779bcb88fc89d757c029969e93baf2703041
SSDEEP 96:xHYVTUmWPqGqmfjBVObzS2NSSlvdv9jhnKWRS9OVAqvqayBw880su8L4cnZUs:2bWCRmfjBV0NSSZRwBkqayBw88t
TLSH
T13D02103C5004CF7F78B2726CAC688D7169A2023B76BF68D651B944C5055CF3842F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs-1.js
Size 12KB
SHA256 961a176732f2e4a328c3094bda1527cd0454ebf5a7adba0807286728ec1ca1cf
MD5 4ddbfeb77c4eff8340711b4625228332
SHA1 a6f65793778635dee68b192bd398ca01e9daa5af
SHA512 236415f765d0bcf9367890905fd255ec689be52d2665643f61d12587e03d8553a3bd28d1870ba72042cefe7423d97ba2be932dbd2d93355b7c48821bde3ae43b
SSDEEP 192:VbWCRHfjBV0rSSwLRwBkqadOBw88aiwMxW70:rDRefPwPQA
TLSH
T14E42CF3C5144CB3F28F2327D6C6889B119A1422776BFBCD206F994D2446CF2841E6AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs.js
Size 6KB
SHA256 9630453396bed442bdf66dd0106cd53649a4167e4737dc3b9a719b1ebf6ee8ec
MD5 0fcb70e8b77cbe24900a0dfa85cfc7b5
SHA1 3a1c254764e0b0df568eb29db64efc63496f6b50
SHA512 9ad721b143a93e0b9e444af4d41aa4a61092885c87a7684f0038f7f2305481033c35f0d3c4805971a8437f4b6e84ca5ca9ff5ced9869850f81c8c46e4bc84300
SSDEEP 96:xHYUTUmDqGqmfOCs1zS6SSlvdv9jHI/nKH5OVAqvqa7Bw88u8L4cnZFs:2WORmfOCsHSSes5Bkqa7Bw88W
TLSH
T14AE11E789508CF7F74B676ACAC6888316AB2013BBBBF28D650B55484055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs.js
Size 12KB
SHA256 557bb6c9a8d63d02e4d00a98d27cfd3daa73e1ed717baa8782a3a8240207e463
MD5 3253bae29e2af51a72386a2cd9fa1188
SHA1 555d31e53bd6f418d9406d6f2b2d704e31689189
SHA512 20a2a7cf60e3d9d33281f20f13a0454436324bc1776c69a28e5607b0a09e3120a335c1f9f41c2d9cd003c200bbb1de6b0012f65eafdcb886c86015362acb2612
SSDEEP 192:2bWCRHfjBV0NSSwLRwBkqa9OBw88aiwMxW70:8dRefbwPQA
TLSH
T15042B03C51448B3F28F2327D6C6989B159A1422776BFBCD206F994D2446CF2841E6AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs.js
Size 12KB
SHA256 441d756935a13ab8c3cb0361c1b0471166e7492c0b9237435558d23f0f32e278
MD5 ea9373cab7afb83ba146b6603070696b
SHA1 34eea50104c8ec6b3fb42b465a0db322be871a4e
SHA512 3177971df2a7964ed40f3bb3da3718ce7957e4302a58885f990d2b6c9fdd985709c1bea88e1afb59e99821871e56ba924eb52e5943ac484818569ac3f8551137
SSDEEP 192:VbWCRHfjBV0NSSwLRwBkqadOBw88aiwMxW70:rdRefPwPQA
TLSH
T10342CF3C5144CB3F28F2327D6C6889B119A1422776BFBCD206F994D2446CF2841E6AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 09c9b740cfe03a698ec2ff065dcc5c97122cb07a8aef2007c310c15b09d34471
MD5 f2fb586ef8819a8732848be2ab461721
SHA1 71b78c667882c26dd8b895a9376e069cd743af4b
SHA512 f48ac2447873f9bacc9515369e59b9292bbdad205544fe9188c27544b02193e8a74f29b1127fd795b7c6e9a960c4c1dc3d6cae70e30321287c47acaea4cbba7d
TLSH
T1B321C653292B3FF57E12C11A84465BB6CF553022897684F0C58E9A62159E11D738622F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 1f887e020aca4f88057cce87091a78655776084e8dfb5a54325eec82e0ecbf82
MD5 a917364842cc191265d53f1efd22cd8b
SHA1 accd4302138aea9b01321fdaea79fe22836bd6fc
SHA512 09879dbb6304ac2f4f8a58ea875f5d60209e6a6b0f26af84b09a2c6de730524d92ae694f8a2dd086042efc658a866c5612ed85d9fe028d1547d542035ad40ea9
SSDEEP 192:eOwHe9u8aLPi/wi4r/cz8VMG7yjs6vPYDOinwKCad78NZ:eYqLPIwi4QMMGOhsnZCadwP
TLSH
T1C402AD7339073DE1EE6EA645C2C00AC03A5964BB83FD50E054ADAE512CFB65E239D137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.jsonlz4
Size 6KB
SHA256 ad4a8a45b9cf64b05bbee5b433eff022ff9ccd9a0a6a48c091a5ec7f15b59cc2
MD5 b4f112286110c5895077e17e59594c20
SHA1 c2f637c192d4b68fb73f5f88c0d4d24afc62f5c8
SHA512 d29533976d9b946b1fee9f36b3da017e794c4605cc9ec44b9d63da9f5cd167beff6dc2598e6c65434827ec5316b9668a30b7695de3b6035eb3a5ceed960d2dd9
SSDEEP 192:uIOwHe9u8aLPi/2M0laIx+inwKCad78Nl:RYqLPIfsnZCadwj
TLSH
T1D4E17D93390B3DA1FD2AB60140D01AD47A5A147B87F944D450695D623CE6A4D1BEF13F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.2MB
SHA256 2fcc1a870fde921f17167880da0072cbff1338f2242788c8c23495ade44cd680
MD5 44975452cc3c92bc11312128d75901da
SHA1 57dcc1f63f713a013eb422af4ec910153a6db826
SHA512 4b7240dd9f492d8ef3fd2497741253e57d0f5fd1a65052d126db6ff7cfc034d8a114ac3105f08bb305a783bac2388f794b5de72b306a8a8413c1d24a149c4375
SSDEEP 49152:ZSxPTTinIKeq7malWy5YPRDNMWsdnv0kRc+pJ954d+59P/iFFMG4R5s+nHi6NwIT:ZeVsdvFRc+pJ954q1
TLSH
T14E767EE860E1D252F34644B3719993FB10EFC00C6036CE4457A496FAA9748EB8E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mods_B.ini

Path C:\Users\Admin\AppData\Roaming\UnitedTeam\PizzaTowerUnited\PTU_data\mods_B.ini
Size 439B
SHA256 d07d790803c5741246332713d2fb3cdfb5689960595eeaa3b3d307be81c6d36a
MD5 0db6034891a9a538c5c2cc5a5ca8640f
SHA1 fc1ea81907ef3ac274aadd979e2d578001f20861
SHA512 e6958c624efd4f6e2c066937ef9ce1d9d0d0afad4eaeced30b195d53ea2ea89c5b6fa13e764d07def3e08e9067faa51c8f4aef1825a1f7d820223d7f2b712f15
TLSH
T1BFF01AE676106C0AC8C16D63650675A570A4F34F9ED9E871FBF51B2F7582838870C6CD
MD5 SHA1 SHA512 TLSH

Submit Download

mods_G.ini

Path C:\Users\Admin\AppData\Roaming\UnitedTeam\PizzaTowerUnited\PTU_data\mods_G.ini
Size 439B
SHA256 40b5961f36fe7f07f1d4acd93a7ed089ce69da1d80740319804a529a7455c9ae
MD5 2c6aea124404394c8a45efd78182cdb8
SHA1 b2116f5182389f32880d4b5cdbf6e8b9540d3b8f
SHA512 cd59c2e80b6fbd141f3795f7f3c5923c24c8be95725bd73bae92d2a85ba6e6295e9aae1bebca403d1c4ef9623db024c1338e9af38fce813a09b1bd476cff1996
TLSH
T1E1F09AE676106C0AC8C16D23260635A570A4F30F9EC8E831FBF51B2F7182838870C6CC
MD5 SHA1 SHA512 TLSH

Submit Download

mods_M.ini

Path C:\Users\Admin\AppData\Roaming\UnitedTeam\PizzaTowerUnited\PTU_data\mods_M.ini
Size 439B
SHA256 cc7a79baa298cb46ea5249c8a37557cdd9fa04c63e2de53ba41685d9163b613f
MD5 327b7c5817b4a5c50795e23b066ae175
SHA1 f3f42be8b1961d74767bbe17558e4a3e71c4878d
SHA512 a25fafa5d59cb363dc753e8c6eb33785e3122e7488d0979a9911c722500d8b5d4fe176308ba4a6d9286eaffd3bdbb73a1d349458501c0320ce715022c4131cdb
TLSH
T1ABF01AE676506C0AC8C16D63650635A570A4F34F9EC9E871FBF51B2F7582838870C6CD
MD5 SHA1 SHA512 TLSH

Submit Download

mods_PZ.ini

Path C:\Users\Admin\AppData\Roaming\UnitedTeam\PizzaTowerUnited\PTU_data\mods_PZ.ini
Size 439B
SHA256 aa72f56b190d006f79425401255168068ed72b63b29e153e753a3cead91f2b12
MD5 7deeec75decb06db1f9c55ce8d10f0f7
SHA1 be9c7dd18076394eb3dffbeb821592fd27c9cdf9
SHA512 b234fe7fc8a39af8223dc2ecb79a16bea866da8450c277c4317f87ada381e4d75c13b280c98992008822b95bccaaff79c07ce0cf1c8437db44d6ee059f732712
TLSH
T191F09AE676105C0AC8C16D23660636A530A4F30F9EC8E831FBF51B2F7182878870C6CC
MD5 SHA1 SHA512 TLSH

Submit Download

mods_S.ini

Path C:\Users\Admin\AppData\Roaming\UnitedTeam\PizzaTowerUnited\PTU_data\mods_S.ini
Size 439B
SHA256 4f3551a6a9f0504fe7cf59cc1bf8a3c3dc7e381e332c74d4519c392352fa655f
MD5 d5bc2633943d5cafd18800b9aea65231
SHA1 a79f448ee0f48ab37b173767f390c01ef5cafa73
SHA512 8520b9c0da6a3e5445f61969ddcfc1f3705bf991f0f94a5e2883f6043a7d8888133f7a06e9a73c1fbe10ac1e472de4eb007522c3430e02de7261b8d685eb963d
TLSH
T187F09AE676109C0AC8C16D23260636A570A4F30F9EC8E831FBF51B2F7182878870C6CC
MD5 SHA1 SHA512 TLSH

Submit Download

mods_global.ini

Path C:\Users\Admin\AppData\Roaming\UnitedTeam\PizzaTowerUnited\PTU_data\mods_global.ini
Size 1016B
SHA256 ef0dacf3bd92d948eb91e192f36b78d27f3bec683b719b4712cf943018c3582b
MD5 0556fc8d5b26ac096fac4c1e6eb642a9
SHA1 3bd7ab47232999478d66779b190af796840d66c4
SHA512 1c65aa13818a1373f8688a697a5d6e32554036ed1a04e3cbd124b913f83c8cfcb1438183f187d4ded68babc7bd896a0faf34d8f7db35cc3716db9a2fad6a0a1a
TLSH
T1F711FBCE49509808C4E1ACEB421F7F05A0B0FF4FCDC4DAA9C2C1A73DB1869B0135A5A8
MD5 SHA1 SHA512 TLSH

Submit Download

network.ini

Path C:\Users\Admin\AppData\Roaming\UnitedTeam\PizzaTowerUnited\network.ini
Size 19B
SHA256 668be4e5e2824b8dd291422e06687d4fdc7e47cad66391dee238ffccb5a1907e
MD5 efb4f3b5649a4d1cd9bc971c110cf41f
SHA1 98a2a477c87c4545636cc0db5f9e878a9a946368
SHA512 b2b08367687c4be50a9636dfaaf5ee77fc1683582e3d032ac9826953afc9fe3ff37a5840bafa3c452696d0fd568568406912c8a47f95cec2e4b0a8767d96ce39
MD5 SHA1 SHA512

Submit Download

saveData.ini

Path C:\Users\Admin\AppData\Roaming\UnitedTeam\PizzaTowerUnited\saveData.ini
Size 72B
SHA256 1139f17ffb403789a41774257daf1a7735c44499cfe109a374d1e268a7fa8be9
MD5 9f635c1a9ef548d157cdea3af37ade29
SHA1 364a9a0dbcb8276ff9c2a07691a1880a612c512b
SHA512 a073ff1756d8c2290a3e3671585ebd7b3fb6bdb7b7fd302ff30680cf09b5976a845efad953a491b1a6f3764c3ebaa1ad33f8fed05e7501adc3820fd29a28f2ce
TLSH
T12FA001821441D009D8B1B89396697690A0E1B6089EC488AAA1EAAA19220B6A19619898
MD5 SHA1 SHA512 TLSH

Submit Download

saveData.ini

Path C:\Users\Admin\AppData\Roaming\UnitedTeam\PizzaTowerUnited\saveData.ini
Size 98B
SHA256 6dcca5add10ea31ac51f22db5d32cfb271989001841365cf5381b6eb9e4e933b
MD5 e21e1c577fec8c68a6b7c9ab9ff96390
SHA1 d09261d7c25fbe1441a91669f60a7e3408a65cf0
SHA512 cf963cde9d5609c6f7a065cdc1a27437ec4bc4789c9e8d1ced2cefef8b067b2615292fd7f7ca9c7c3402a94619e830e500f3ba8fad0e7cd7b0a23abde01bd5b5
TLSH
T156B012C31002C009C470FD43D318338060D0B20CCDC08456D0E55A1F13477F14318584
MD5 SHA1 SHA512 TLSH

Submit Download

saveData.ini

Path C:\Users\Admin\AppData\Roaming\UnitedTeam\PizzaTowerUnited\saveData.ini
Size 99B
SHA256 c6e273c337ea5ef608d446d2354e58fe6ad2740af374b26154357a9f1ae1cb37
MD5 4e92b0ed9b8c75e9eef7cee4728e5da4
SHA1 b001259ce2d6ce6eead31fddb385925d334917dd
SHA512 ca3779e3f3180f37e37ef744f2b021ac08ad1d41a04b77398205590cd30b9d022ce17a8f4dcc06b116d09bd9efccf7562da4859bce689f93a7efc67bc43969fe
TLSH
T1B9B012C31002C009C470FD43D318338060D0B20CCDC08456D0E55A2F13477F14328594
MD5 SHA1 SHA512 TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 11KB
SHA256 00732f10bb62d98aed7b65ab941500515fc9a66aa898446bd2013f9ec7148574
MD5 5bb01c4c8de7abf69441864d193028c1
SHA1 cc8a6611f8257bbb9e206eb054c1d6e9480763dc
SHA512 717548bfe58d8d8a3a080198cec1b9137002d2a0e97bb7047e4c2ce8dd448d16779ab74e5385c33b151f979d48eec3195f017acf15f917535fa3aa76237582c2
SSDEEP 192:0pSmxSOSrSwTS3RzoNRnS3RzoNRiS3RzoWRRS3RzoWRVS8vS8j1SsS8lhkqrMsLZ:0pSmxSOSrSwTSgS3ShSFS8vS8j1SsS8j
TLSH
T13C328759C9981AFEDBCB220EA71531DA0B9FF4E136E13422093FBF6858A915BC7D7440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1236-1204-0x00007FFAEE2C0000-0x00007FFAEE2D0000-memory.dmp

Download

memory/1236-1205-0x00007FFAEE2C0000-0x00007FFAEE2D0000-memory.dmp

Download

memory/1236-1203-0x00007FFAEE2C0000-0x00007FFAEE2D0000-memory.dmp

Download

memory/1236-1206-0x00007FFAEE2C0000-0x00007FFAEE2D0000-memory.dmp

Download

memory/1236-1149-0x00007FFAED480000-0x00007FFAED490000-memory.dmp

Download

memory/1236-1143-0x00007FFAEE2C0000-0x00007FFAEE2D0000-memory.dmp

Download

memory/1236-1144-0x00007FFAEE2C0000-0x00007FFAEE2D0000-memory.dmp

Download

memory/1236-1145-0x00007FFAEE2C0000-0x00007FFAEE2D0000-memory.dmp

Download

memory/1236-1146-0x00007FFAEE2C0000-0x00007FFAEE2D0000-memory.dmp

Download

memory/1236-1148-0x00007FFAED480000-0x00007FFAED490000-memory.dmp

Download

memory/1236-1147-0x00007FFAEE2C0000-0x00007FFAEE2D0000-memory.dmp

Download

memory/4700-1138-0x00007FFAEE2C0000-0x00007FFAEE2D0000-memory.dmp

Download

memory/4700-1139-0x00007FFAEE2C0000-0x00007FFAEE2D0000-memory.dmp

Download

memory/4700-1140-0x00007FFAEE2C0000-0x00007FFAEE2D0000-memory.dmp

Download

memory/4700-1141-0x00007FFAEE2C0000-0x00007FFAEE2D0000-memory.dmp

Download

memory/4700-1005-0x00007FFAEE2C0000-0x00007FFAEE2D0000-memory.dmp

Download

memory/4700-1006-0x00007FFAEE2C0000-0x00007FFAEE2D0000-memory.dmp

Download

memory/4700-1007-0x00007FFAEE2C0000-0x00007FFAEE2D0000-memory.dmp

Download

memory/4700-1009-0x00007FFAED480000-0x00007FFAED490000-memory.dmp

Download

memory/4700-1008-0x00007FFAED480000-0x00007FFAED490000-memory.dmp

Download

memory/4700-1003-0x00007FFAEE2C0000-0x00007FFAEE2D0000-memory.dmp

Download

memory/4700-1004-0x00007FFAEE2C0000-0x00007FFAEE2D0000-memory.dmp

Download