badrabbit | ec33d8ee9c3881b8fcea18f9f862d5926d994553aec1b65081d925afd3e8b028

Resubmissions

31-12-2023 09:11

231231-k5vvksadc3 6

29-12-2023 08:53

231229-ktts5sgbh8 10

Analysis

max time kernel
1307s
max time network
1309s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 08:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AnyDesk.exe
Size

5.3MB
MD5

75eecc3a8b215c465f541643e9c4f484
SHA1

3ad1f800b63640128bfdcc8dbee909554465ee11
SHA256

ec33d8ee9c3881b8fcea18f9f862d5926d994553aec1b65081d925afd3e8b028
SHA512

b3a48230fc6f20038c938e5295b68a3f020b94e220ca2fab6a894d126dc41f6f1021c239613bf9d6de84370ad7df9d9a91baf716a87d43eb101ee3e48578e5ff
SSDEEP

98304:j5ObAu2pmits24nYhQCWQdaQQo/mJPv4KYZPKBhYI5RuN4OL2wIjcsJWNg3:IAnRu24nR5QcTvYdmPuWOL2TcQWe3

Score

10^/10

badrabbit evasion persistence ransomware trojan upx

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/4996-3865-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral3/memory/4996-3873-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral3/memory/4996-3872-0x0000000000400000-0x0000000000438000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\Downloads\\MalwareDatabase-master\\ransomwares\\Birele\\[email protected]"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Local\\system.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	AnyDesk.exe

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\Downloads\\MalwareDatabase-master\\ransomwares\\Birele\\[email protected]"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\system.exe"	reg.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\DB8E.tmp	rundll32.exe

Executes dropped EXE 5 IoCs

pid	Process
4696	[email protected]
2012	DB8E.tmp
3432	[email protected]
5160	system.exe
4996	[email protected]

Loads dropped DLL 1 IoCs

pid	Process
5476	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5048	SCHTASKS.exe
4408	schtasks.exe
3684	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3476	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\MalwareDatabase-master.zip:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1632	AnyDesk.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1380	AnyDesk.exe
1380	AnyDesk.exe
1380	AnyDesk.exe
1380	AnyDesk.exe
1380	AnyDesk.exe
1380	AnyDesk.exe
5476	rundll32.exe
5476	rundll32.exe
5476	rundll32.exe
5476	rundll32.exe
2012	DB8E.tmp
2012	DB8E.tmp
2012	DB8E.tmp
2012	DB8E.tmp
2012	DB8E.tmp
2012	DB8E.tmp
2012	DB8E.tmp

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	1380	AnyDesk.exe
Token: 33	5072	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5072	AUDIODG.EXE
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeRestorePrivilege	3184	7zG.exe
Token: 35	3184	7zG.exe
Token: SeSecurityPrivilege	3184	7zG.exe
Token: SeSecurityPrivilege	3184	7zG.exe
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeRestorePrivilege	212	7zG.exe
Token: 35	212	7zG.exe
Token: SeSecurityPrivilege	212	7zG.exe
Token: SeSecurityPrivilege	212	7zG.exe
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeRestorePrivilege	3892	7zG.exe
Token: 35	3892	7zG.exe
Token: SeSecurityPrivilege	3892	7zG.exe
Token: SeSecurityPrivilege	3892	7zG.exe
Token: SeShutdownPrivilege	5476	rundll32.exe
Token: SeDebugPrivilege	5476	rundll32.exe
Token: SeTcbPrivilege	5476	rundll32.exe
Token: SeDebugPrivilege	2012	DB8E.tmp
Token: SeDebugPrivilege	3476	taskkill.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
1632	AnyDesk.exe
1632	AnyDesk.exe
1632	AnyDesk.exe
1632	AnyDesk.exe
1632	AnyDesk.exe
1632	AnyDesk.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
3184	7zG.exe
212	7zG.exe
3892	7zG.exe
1632	AnyDesk.exe
1632	AnyDesk.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
1632	AnyDesk.exe
1632	AnyDesk.exe
1632	AnyDesk.exe
1632	AnyDesk.exe
1632	AnyDesk.exe
1632	AnyDesk.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2796	AnyDesk.exe
2796	AnyDesk.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 1380	3196	AnyDesk.exe	92
PID 3196 wrote to memory of 1380	3196	AnyDesk.exe	92
PID 3196 wrote to memory of 1380	3196	AnyDesk.exe	92
PID 3196 wrote to memory of 1632	3196	AnyDesk.exe	91
PID 3196 wrote to memory of 1632	3196	AnyDesk.exe	91
PID 3196 wrote to memory of 1632	3196	AnyDesk.exe	91
PID 3156 wrote to memory of 2448	3156	firefox.exe	126
PID 3156 wrote to memory of 2448	3156	firefox.exe	126
PID 3156 wrote to memory of 2448	3156	firefox.exe	126
PID 3156 wrote to memory of 2448	3156	firefox.exe	126
PID 3156 wrote to memory of 2448	3156	firefox.exe	126
PID 3156 wrote to memory of 2448	3156	firefox.exe	126
PID 3156 wrote to memory of 2448	3156	firefox.exe	126
PID 3156 wrote to memory of 2448	3156	firefox.exe	126
PID 3156 wrote to memory of 2448	3156	firefox.exe	126
PID 3156 wrote to memory of 2448	3156	firefox.exe	126
PID 3156 wrote to memory of 2448	3156	firefox.exe	126
PID 2448 wrote to memory of 2628	2448	firefox.exe	127
PID 2448 wrote to memory of 2628	2448	firefox.exe	127
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128
PID 2448 wrote to memory of 2452	2448	firefox.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1632
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1380
- - C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
    "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend
    3⤵
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:2796

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec 0x394
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2448.0.642775185\1883213042" -parentBuildID 20221007134813 -prefsHandle 1888 -prefMapHandle 1880 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {36b40fed-0b8c-4b5c-a055-091435f00592} 2448 "\\.\pipe\gecko-crash-server-pipe.2448" 1980 16a215ec358 gpu
    3⤵
    PID:2628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2448.1.799260800\1558341983" -parentBuildID 20221007134813 -prefsHandle 2368 -prefMapHandle 2364 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f375f5d-e5a5-4183-a97b-0b3c2651757d} 2448 "\\.\pipe\gecko-crash-server-pipe.2448" 2380 16a14d72b58 socket
    3⤵
    PID:2452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2448.2.1782829626\504254133" -childID 1 -isForBrowser -prefsHandle 3140 -prefMapHandle 3136 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f5138bc-68e2-4587-be7c-a01fe9ad9e35} 2448 "\\.\pipe\gecko-crash-server-pipe.2448" 3152 16a2569e758 tab
    3⤵
    PID:3508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2448.3.1430612679\1542983285" -childID 2 -isForBrowser -prefsHandle 3560 -prefMapHandle 3556 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ecfb695-e43b-445b-b0c0-4810cf35d0c1} 2448 "\\.\pipe\gecko-crash-server-pipe.2448" 3568 16a14d68a58 tab
    3⤵
    PID:2444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2448.4.858856539\1885972673" -childID 3 -isForBrowser -prefsHandle 4312 -prefMapHandle 4308 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e97c75d-faef-4819-b6b5-630ce9991983} 2448 "\\.\pipe\gecko-crash-server-pipe.2448" 4172 16a272a4e58 tab
    3⤵
    PID:628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2448.7.637747135\2021793594" -childID 6 -isForBrowser -prefsHandle 5532 -prefMapHandle 5536 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27fee524-a555-424c-b6f5-f4268f67ecbb} 2448 "\\.\pipe\gecko-crash-server-pipe.2448" 5524 16a27980b58 tab
    3⤵
    PID:2100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2448.6.2100304409\1687913353" -childID 5 -isForBrowser -prefsHandle 5308 -prefMapHandle 5312 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffed6e69-5687-42f8-baab-7baabf3d0f15} 2448 "\\.\pipe\gecko-crash-server-pipe.2448" 5392 16a27980558 tab
    3⤵
    PID:4656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2448.5.43061340\251620317" -childID 4 -isForBrowser -prefsHandle 5160 -prefMapHandle 5156 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {144c7a9f-a9a5-4b59-9a11-628f16aa29af} 2448 "\\.\pipe\gecko-crash-server-pipe.2448" 5172 16a14d2de58 tab
    3⤵
    PID:4536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2448.8.1438201074\560860719" -childID 7 -isForBrowser -prefsHandle 5944 -prefMapHandle 5928 -prefsLen 30016 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {caed179d-8268-4d47-b34f-dbb9268c1096} 2448 "\\.\pipe\gecko-crash-server-pipe.2448" 5948 16a2db39b58 tab
    3⤵
    PID:2212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2448.10.795028848\858682615" -childID 9 -isForBrowser -prefsHandle 5376 -prefMapHandle 5256 -prefsLen 30016 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fed6a56e-6c9b-4e1d-aab7-679ab0778efd} 2448 "\\.\pipe\gecko-crash-server-pipe.2448" 5928 16a2a4a4e58 tab
    3⤵
    PID:3520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2448.9.1145981014\1710917845" -childID 8 -isForBrowser -prefsHandle 4504 -prefMapHandle 5244 -prefsLen 30016 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d456330-4a9e-450e-a799-3a54244a48ca} 2448 "\\.\pipe\gecko-crash-server-pipe.2448" 5232 16a2a4a1b58 tab
    3⤵
    PID:1664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2448.11.1848058120\314273097" -parentBuildID 20221007134813 -prefsHandle 5312 -prefMapHandle 4792 -prefsLen 30016 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b03dc799-b205-4544-93b6-dee9aeebcb9f} 2448 "\\.\pipe\gecko-crash-server-pipe.2448" 5244 16a29fbab58 rdd
    3⤵
    PID:2196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2448.12.1305149671\170932641" -childID 10 -isForBrowser -prefsHandle 5480 -prefMapHandle 5392 -prefsLen 30016 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90d0eede-d78b-4aa0-a689-bf26db27fd94} 2448 "\\.\pipe\gecko-crash-server-pipe.2448" 6304 16a2e559258 tab
    3⤵
    PID:5936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5064

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MalwareDatabase-master\" -spe -an -ai#7zMap16853:106:7zEvent32195
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3184

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\*\" -spe -an -ai#7zMap14658:1392:7zEvent31754
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:212

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\*\" -spe -an -ai#7zMap29537:2380:7zEvent17427
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3892

C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\BadRabbit\[email protected]
"C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\BadRabbit\[email protected]"
1⤵
- Drops file in Windows directory
- Executes dropped EXE
PID:4696
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5476
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    PID:4556
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      PID:4820
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 100453126 && exit"
    3⤵
    PID:5684
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 100453126 && exit"
      4⤵
      Creates scheduled task(s)
      PID:4408
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 09:33:00
    3⤵
    PID:3012
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 09:33:00
      4⤵
      Creates scheduled task(s)
      PID:3684
- - C:\Windows\DB8E.tmp
    "C:\Windows\DB8E.tmp" \\.\pipe\{57842EAB-DAAD-44F8-AA06-F11092359672}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2012

C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\7ev3n\[email protected]
"C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\7ev3n\[email protected]"
1⤵
- Executes dropped EXE
PID:3432
- C:\Users\Admin\AppData\Local\system.exe
  "C:\Users\Admin\AppData\Local\system.exe"
  2⤵
  - Executes dropped EXE
  PID:5160
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\del.bat
    3⤵
    PID:4812
- - C:\Windows\SysWOW64\SCHTASKS.exe
    C:\Windows\System32\SCHTASKS.exe /create /SC ONLOGON /TN uac /TR "C:\Users\Admin\AppData\Local\bcd.bat" /RL HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:5048
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
    3⤵
    PID:3436
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
      4⤵
      Modifies WinLogon for persistence
      PID:3756
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:64
    3⤵
    PID:1808
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:64
      4⤵
      PID:2528
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:2652
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:64
      4⤵
      UAC bypass
      PID:3640
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:64
    3⤵
    PID:1828
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:64
      4⤵
      PID:4552
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
    3⤵
    PID:3140
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
      4⤵
      PID:844
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
    3⤵
    PID:5680
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
      4⤵
      Adds Run key to start application
      PID:2136

C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\Birele\[email protected]
"C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\Birele\[email protected]"
1⤵
- Adds Run key to start application
- Modifies WinLogon for persistence
- Executes dropped EXE
PID:4996
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g5azq69j.default-release\cache2\doomed\9622

Filesize
10KB

MD5
9093f9eb99272be8b929e5b8f9ef379b

SHA1
819ad02541c2525a458f0c3f308b0a3448cc7865

SHA256
186a53f96764ab7b98f64a9d5ee8c8f4a9201a590a15a4d347964b13d1171622

SHA512
5f2c32ce28301560fc025276259aefa85c30459fd02d0dc42048b7941d77e3c20ce307b8a67249c97a2b81a117462a9c988d72673a510db4c0ea405a45422156

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g5azq69j.default-release\cache2\entries\B573808F9B4F64D3E5F0B069BDAA48EF4086E712

Filesize
13KB

MD5
c2a1fd7c16701a6b3f3f550ee5cc741b

SHA1
96e70df430e1fd2e7b817e00b2e6bed62df48833

SHA256
6b6685175c5823f0bbf24cd2c85c1bf7ef90334a9b5168c2251061319baea52c

SHA512
5264c6be0c2078faed77a14c7fc94ceb03da234b94e2b98b20a7863761e5495c3d60c8c561c2e725073fb402059f701ebc7c1d6ba98bebeb46fc58ac2c452055

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
65KB

MD5
25f2cdb43ef812da7fffb5b25c51d2dc

SHA1
4fb64b7bdca695fb8681818cc7da934bcfd40d53

SHA256
5529b3f8e0b7483cfc95b82ebdc1ff3f999cd338ef8a68432957c0a41c0b4bf1

SHA512
4da335132907642c8e2a9a0d9b47aafd24b6858670552859d7fb208f79574d9c296629721542ac198cf31aa648a14b9aebc01be810825e9a1b4d68ce0d33b5dc

Download Submit
C:\Users\Admin\AppData\Local\system.exe

Filesize
48KB

MD5
136a3f41f3b09fc78598fe6258ad9fee

SHA1
6bacc7d4c7dea12773eb34a9e4e33885638ad03b

SHA256
5d40d2de7daed89e1723ca9c3ae9168a5a709cbf1ab8111b7b2d606129a2cad4

SHA512
cf71d94009b09581ff43299dcf6580d11ea61596bd84cb7e30fc4834814ae5a58901d6c65cb1ba2ee2aa3a6b1b6c920a58955ab51633b233c903037ca5ce0d15

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
9KB

MD5
ea9dc7c8914fd1e931eff64f76d54250

SHA1
8284437dc3d2cc81ebc1265f60eea0d4ac3e65bd

SHA256
fa56c0e5e708e0882cffa0cb0292083bfa1af9478636d85f4a316c8d83773370

SHA512
10183ba41f816839e8cf7d0a88500c93f40add1181dbf226da60854b3351aaee979dff14afe15efa509a1dc3c6976137a3174a7fffb8764e55d73bfcf4592423

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
35KB

MD5
3c210b4ce573af1f48dc8f505d7e1643

SHA1
478a361c816312856b3737b1a32e80e479eba990

SHA256
659b93a48e8a70d4c9ae31293af117ab236d9d7dce93af673e37afb5a50354f0

SHA512
d6391ab2c1b56a5bcfb5ce732fb275e779c543072e23dc4c040df4f7c24a6cdf0a73232b2b01f9a34048564a46802a2c4a2dd736fcf06fe32a1171cde1c643b1

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
b392fd9861a1076990e4288793d922c8

SHA1
d9946ca0bc90f99ee40a3ec0e0ad77bdadd1c418

SHA256
5ac992f857b3d7e93da66138daf97dff218aa5b7bdc6d388a93ae11879966b26

SHA512
6ef24d37725a7830fc45fc5fb62d5a79e4a1dd453f3464dd3fac0b484e2853ad3a8a0124782ea31754a7de2af3cb164922941b12006f70fdbc0b8355ead0fc8d

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
672de00e7f7956b0dbe09b81a8b79d04

SHA1
217140e69f86ed8b2102afc5d2de8d8d7f8c48b4

SHA256
f00486a2ba2665e8c8225e2cca65ac31dd78697fc5bc2b6c233075b035cea7e5

SHA512
d62316199b841c2b9f083dd2bbe31a6a93f6be51ef7c45aac1b53148e3f43f704c253c33bf24ca65564e052b9959ab294b528e19a4efadbdba24cfc918f93826

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
7KB

MD5
26686fe0a3b4b644f833525e0e044722

SHA1
dcd41667528b1c904778a636e61bf3c048498618

SHA256
e0e287acf05017e048d4e65c94caf7f9dcf873a5cffda3bbf36cd6168086f98f

SHA512
d99af617d705a6a020ecbec64111c1e4e377812dc552cbb4c326ad6a17d0abd9dc94393045b5e10ae3ed3f34c312360296f025638d4b34c9bf84f8bf4386d37b

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
7KB

MD5
d6f2bf88a671f86c5193bdc07ae9df39

SHA1
2b59e95660731b0073dc2635afad0e55e71bb326

SHA256
93dc7a66e6dfc7b3c59ba826cc492d885daa4c2ca597c05f035e06ce19b855f2

SHA512
1859647388dcdf81a44613241922ff555a97200249d093e1eed3f15e374f6ea4f4a3664503ad28973d411631b1f0dd4077131f904e0379ff8c1350cc3b271a6d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
5KB

MD5
064f689599534e675f370f6226f910c6

SHA1
bbfc510c026db5ee85f809c7c115df8c45fa14f1

SHA256
1747642f143db09baa45b626bea9ca2ba9185fa33c4b12913750e7e53db3591d

SHA512
6cce8e2e3e9527e495a106f62c7dc75b360ebabc535eac70aa077adb76c04280242312ee79ca747b98f8c485328987d941b1f7ebac58a75648f2ff3af0f8a71a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
b9f06cb6e1006aff149c3ab11f761ad1

SHA1
11d905621d2f1ee1ea7d81c5d4486ea815272a47

SHA256
ea89b680f7953c97fd180d2219063b2025b408d709445a44e2799afa33388248

SHA512
2f240b8ead9c29a194f00156420835e873b3de9bac91a21cafe6cfc282cd7739f93b38ac5c0067964f46196afcd76a60af1fc6e00582a9aa1209cf8127e16ec4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
7KB

MD5
ac1d6b865deffab776873cbe01830af3

SHA1
261f3239e63eb836ab67d999b7517590eaf3f95c

SHA256
f9c43c99f9d0901d1714a68c503b3ec56bd889997fbc8d85e398d602ae9f8165

SHA512
665b1e52e68ddfecfa29d009e11c4e8511c673cab99a9b7fed1272c18cecd7ccab78a381997faebeeee624c54f951418700f1f5446e457d2d8b65a15aa65ec69

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\SiteSecurityServiceState.txt

Filesize
372B

MD5
3e781cea3eaa29d31fec6cf1585f316c

SHA1
f87730f8aca7fdc8bac8ff04bc566a8ae5826eb8

SHA256
cb7e41e02f2a8ddc66aa4d62dd2d7a470a343ea6ba06655a90de57f42edea6d2

SHA512
288a4ca79ff8ea21cb2697c2526d74ad6e6399a8d49d64391d05f96c0fe003eeb449870368464f3cca3162842bbe5aa115c16d06c1de82d6bd44064ef2a1aa7d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\broadcast-listeners.json

Filesize
216B

MD5
72058f7ad0454b88c85108839897f15d

SHA1
4ec1af2c6a537b8e9e15ee41523dcef0a22d8e5f

SHA256
de097395f8f3e5294f6a33bc8e2123f9f3ae5311f2e060f71dc37743525fa9ce

SHA512
ebc74d70e2ff48a09ff26ccefe67a264f37791c3fb158bc9e077c2a17d91466428f1617bc415f7e444308ae57ea2990db4ed8c31ab6b327233a0f9442c05d5a9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
fca34afbb46e34de1c53193e2bef3ea7

SHA1
6414303942e9d957582d219e983402aabb0dcb88

SHA256
6fff46cc91477809a0f2be18b22ed9c8cb9da896794022c65ddfecde0d1b27b0

SHA512
87ca956966fc97401a358dc2e08f93b4de256862c44cb05e457b05145e33636d8fabf0d4c5b8f873e7441cf2b40ec45c7a6a7d4a72cdb318438b95f990907d1d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\datareporting\glean\pending_pings\274d1749-0b1f-494b-94b9-bbcb2815b5b5

Filesize
11KB

MD5
0765500b519c62c0ce743ba3d226e46e

SHA1
312ab063a95d53ee04fe655f1ba4fc1bd3e831fb

SHA256
0a061bcf96815543e44f4d3a712b1b9e6d30d93853b595cf11c0520d6f7f1f4a

SHA512
1bcbff80bf29b642b6057ce96cc8f7ee8de78d5825f177cf1307add673078a4e0330a5e26e406249c7bba394e1ad6509c20f5cde04cf3f824e288bedceb81c3a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\datareporting\glean\pending_pings\594dbfa7-65b8-4b82-befb-9eb1e717ad12

Filesize
746B

MD5
3d73d44aeea3c43e97bb3bc43131b47b

SHA1
641216d4323e6af65aceb2a9a549fa72b8620894

SHA256
5a5bf4a9606201ca28a53f86d8cf8a838f865f0de6eb9a17f68a1bb0b3093fb0

SHA512
fec183afcda277e2eb098d608a13a83094d76f5ca003bf56cef3a028b596f589a6800b49cbc68b702dcf0494721a46615e3a4d2b7de0f25fec30f31b89412438

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
137KB

MD5
cdc42cf4b5da9398898c6d6446da5a58

SHA1
384074e413336bbe12eb6ec67889dde743cb9e30

SHA256
2772832afad1de15bca2934ed531478832fa53ae2e2fe9ee2ae613115b82cab7

SHA512
5ecf0888b91e99db112259d157f6be2a72916769328cfb0865c72002ab9a43fc8122840c815bfb504da5e0238296648e49dbdb5120a619c3b79f821fc9b91dda

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\prefs-1.js

Filesize
10KB

MD5
68978d94adc8333a7147403a95b574f2

SHA1
e96549057293863b92cb7540f9124effed297335

SHA256
8418c5441010c4300f2162b656a9a4e3efadd98ce5b628e15fdcbf8c9fb12000

SHA512
c962156aecc0eb852112b9372ffa143ab3db5e0f9c3f769f84355dffffd14e7c76ec4e7d3f004d32c2109b91029f55833a066aef79927547eaf40e0dd5f315f0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\prefs-1.js

Filesize
10KB

MD5
67e2e62ac8ee166e80bf83674a1eb297

SHA1
1fc6825c797cc91f5543d687fce029e1d66f3112

SHA256
233153964b49e7d934ff7cb737536e17363c9af470cd75717da67f7fa97bd9b3

SHA512
93510cbd2dbad40ec6bcdfdc92bcb108fab8a6790738202ce260a01f29b516100c752a208afd529873a0aca863bfa86f205193ce88dd2b884a11b29280d16b9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\prefs-1.js

Filesize
9KB

MD5
82ea60bbc9ce77c55ca91e65e703f156

SHA1
7c8365d39c46c95a262db0f132a261cd0c4bb81e

SHA256
7d897d85465a54c6ba9896dad3a3c0b9beb65f92e44de81fa4dc09ca4f1c8604

SHA512
c946263f14155de5655641d713c0f32f84987df204d4727e80cc0ddbe345afa755a04a57b809d3703aaf33cfe302ce4ac61694a22bcc6b9afec8d721f6be8162

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\prefs-1.js

Filesize
10KB

MD5
bae2b8dfbebbf4ffcdbdf7fd3711e83d

SHA1
9b796192e531bba24360f917033975de29fef9ea

SHA256
21a09909d27d8848d14e131c31c173fa9884efcf2dcbd4f3e94d99d237ebeff1

SHA512
5257dfbc3fb11a09099658b219058d8fb5e3131e1a5a3652e31af0983ec4f2dbc4b39a14510421f65bb6fbaff9e605b533b492ad139528176545e7c07096ebae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\prefs-1.js

Filesize
7KB

MD5
80451d2c74044f58a0fbe53ab59b6749

SHA1
e162d55e534e3afbf6e3e2a27e343df2311a9059

SHA256
4717ceae121fc975e9900db82b118e77a870041ede790b64833c29de7b3f5889

SHA512
fcd3807b9656b1c4059d6a72ebd6dbcd2cd88fc68d108bd8ef9a5f839955c1a278d817550c364cc9a8e7c8c29f9760635549a6e7c4991be0d0b05d641841af74

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\prefs.js

Filesize
9KB

MD5
2e679e219c4854025d13206a74974a55

SHA1
58c7897c21c760673de8b186c4db37fdd80d6eee

SHA256
bbf3a5f63708dce63d5fe0051a1b54b1a8b176baf1c41d9344f33aff0d4e5172

SHA512
f6081b7a6c2cba24d928155629fbfb46e9e39a817673fe6d35a374c4f0681d792ae1e2f462234e8def28a928f8f80cdcefa1063ac52aafbd854158a16fbe3362

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\prefs.js

Filesize
10KB

MD5
d5648a8356836b50e1957cc0b2e05942

SHA1
03162a01098b45162608c5112ae7be3ac2f8a98f

SHA256
39769f559476caafd903ad1e491b20008f926b477b50f0bdc1537526022b53c9

SHA512
4ddd650fcc84dc5c340ea2c5d19be15c14a4745645bf08048cd91f7fa150e62e4195b907c2e979996816dfcf9b7ff9af9727c86b950b41500ad70477f7d76356

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
7bb05bc5de403bae5d4d273af459685e

SHA1
39a48bc449a868ed0370c474aacb991ba9adbda2

SHA256
924a1ccb52a901c53496ab444ee77bd566139134445f18c36246d182fea01240

SHA512
835f56fdd09802d49523561864ecd50868d5b1af89d67c9b3bda40b660caf753dd3ea93f9ac5560c9a2cc7832301bdc9af73cd21d18e9bfe1b5dd550e4ca19e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
0fd4e959ee6e4334817f2b1ada727346

SHA1
ece4365a3e4d7e111e44d24174daab53fb354fff

SHA256
d9158c12acc7262458cd5a535bca3e54259313485b3c05b49037be72af54e979

SHA512
e4ddd646dbc69d275f26d3c193cd1168fc20c47e8a48780c18cc5f6aebef989b5bf245c314a7256a78be1ad2f7dfea680ebdb9295814e20100f9faa251ca747e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
1faf8eb1fc1c853c0fc87a879153194e

SHA1
4af5162e78ed8a684a36589307659c990a921f52

SHA256
0ab4bb38d050758d5e2c56a751fa22d80b0e3c6b33bac734812e4e8bf703ecaf

SHA512
b1e03ad5d6a071d61a3236d45db9e329858819f139d256cfda9c4c41153d3c5561e2d897bae9e8bfffe1957dae637a50d31f81007c815fc0f91f593f34462e6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
0392c0d39ed8433031bed81eac3562f4

SHA1
568761ae9794eb190cd1c106bfcfb9d886b5e30c

SHA256
811847d5b0ab69c9566ec9655567f4b2d09cecabecc1a6e409de2e70579459c3

SHA512
0a0a58f2c31f35db9130386698f0aeb13b0987cadfd2c345f7a6e2f19cc7bb9817005e9f31f3754b285169217abfbad559d64397eb0176ec8679b0cbee0cd38b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
398608c9ac36500bb8e7809ddd441d67

SHA1
db81e480da75afe61e1b0effc003bfd15f5c34c2

SHA256
876ae63b31ce11ef042f04e6183631dd524a0ae442baca73236b7449f9af8604

SHA512
c4c5dd2bbb0537ddf80dcafb10857d7dbc28ddfa2489f2523a8c63b0c597f48299e9eb29dfdf6a7192024f3e0e9fc50ee06714c03c01ebf4f52270311df962be

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
574KB

MD5
93b18ed404745722e9344649284c0dcd

SHA1
b036a1a6c504d1e3f94b4aa46db38e995abcb19f

SHA256
1ef7ae8180ee607c50127ef1de781ce915e8daf02e585f037744c03f7bfa0ddb

SHA512
40afa0673ee90f87a8fa5f8200d86c7d1d0be8f006cafcdf2f880f632d1237618bd53c5c4dc23f950a4837f09f1f906d182483aa4989881afdf2023ec91ca5a9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.7MB

MD5
f4bba976aef33693a64812f9dcbae3d6

SHA1
cbe6365f6bd6b3503e055fc8f0e89a5693edd457

SHA256
33a774751837e0f8bf17a9cacd9a92d28756dcde7e793562f468b5ccd94952f5

SHA512
9fea8d3b1fcc55d2c7726234e96b4bce22ea7a45ccb5c901f790fc7c8e6f23eded547eda44bc9ea6a8482418645230bd92e40b2820497097b9b67d4b4788e869

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master.rq527ehj.zip.part

Filesize
1.1MB

MD5
865025716a6e0630b54b43abd2f4d347

SHA1
00eea33469a0970c65a41faa62dcc7f20bdd37b7

SHA256
32b538b75f224250370dc629e8364075706c035bd019a4ce16e47e00c882b4da

SHA512
7f15ab8d34b06f5dffab70c88664bf31c2190b86437c9264a5a8736d81097dd1428ff1409a90089f01327700cb386fc1d997fbc47fa4df0d24d24e0019dfc21b

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master.zip

Filesize
2.2MB

MD5
747b5ba358a3ed0b8ce976513ee9e8d6

SHA1
cd3449c22cf0d3aa6fb5681f40bf143dd9d2541b

SHA256
00ac5d53169e8f322977647a9bdb378d8b7ee0c6631aae0760e075ad114a2844

SHA512
063f84db5aaf0d3b2c859998baf9e7b396478cf6c55bd160ad920c8837ea0849913bb156c41f5d54152cbb2c5d80e139fa30ad4a36d0a51704da1e279a4fa381

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\7ev3n.zip

Filesize
139KB

MD5
c6f3d62c4fb57212172d358231e027bc

SHA1
11276d7a49093a51f04667975e718bb15bc1289b

SHA256
ea60123ec363610c8cfcd0ad5f0ab2832934af69a3c715020a09e6d907691d4c

SHA512
0f58acac541e6dece45949f4bee300e5bbb15ff1e60defe6b854ff4fb57579b18718b313bce425999d3f24319cfb3034cd05ebff0ecbd4c55ce42c7f59169b44

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\BadRabbit.zip

Filesize
393KB

MD5
61da9939db42e2c3007ece3f163e2d06

SHA1
4bd7e9098de61adecc1bdbd1a01490994d1905fb

SHA256
ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa

SHA512
14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\BadRabbit\[email protected]

Filesize
431KB

MD5
fbbdc39af1139aebba4da004475e8839

SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0

SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\Birele.zip

Filesize
113KB

MD5
6ca327b67f1a2b2a4fbb7f342e15e7bf

SHA1
aab4a7d8199e8416ad8649fede35b846fc96f082

SHA256
460a3e3a039c2d0bb2c76017b41403bf3e92727269f49b08778d33108278b58f

SHA512
b7a7574ca52885e531aca71ebe52f7832f8a2436cda047e7686936fe0337eae7c4ebcc57df27c26316871d4167ea4e6794beb933f7c13efb0addac0d400e4d9a

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\Cerber 5.zip

Filesize
181KB

MD5
10d74de972a374bb9b35944901556f5f

SHA1
593f11e2aa70a1508d5e58ea65bec0ae04b68d64

SHA256
ab9f6ac4a669e6cbd9cfb7f7a53f8d2393cd9753cc1b1f0953f8655d80a4a1df

SHA512
1755be2bd1e2c9894865492903f9bf03a460fb4c952f84b748268bf050c3ece4185b612c855804c7600549170742359f694750a46e5148e00b5604aca5020218

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\DeriaLock.zip

Filesize
210KB

MD5
016d1ca76d387ec75a64c6eb3dac9dd9

SHA1
b0a2b2d4d639c6bcc5b114b3fcbb56d7c7ddbcbe

SHA256
8037a333dfeca754a46e284b8c4b250127daef6d728834bf39497df03006e177

SHA512
f08653184d7caf48e971635699b17b9502addb33fb91cc6e0a563e6a000aeb57ac0a2edd5a9e21ef99a4770c0dbb65899150fa5842b0326976a299382f6be86e

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\Fantom.zip

Filesize
198KB

MD5
3500896b86e96031cf27527cb2bbce40

SHA1
77ad023a9ea211fa01413ecd3033773698168a9c

SHA256
7b8e6ac4d63a4d8515200807fbd3a2bd46ac77df64300e5f19508af0d54d2be6

SHA512
3aaeeb40471a639619a6022d8cfc308ee5898e7ce0646b36dd21c3946feb3476b51ed8dfdf92e836d77c8e8f7214129c3283ad05c3d868e1027cb8ce8aa01884

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\InfinityCrypt.zip

Filesize
33KB

MD5
5569bfe4f06724dd750c2a4690b79ba0

SHA1
05414c7d5dacf43370ab451d28d4ac27bdcabf22

SHA256
cfa4daab47e6eb546323d4c976261aefba3947b4cce1a655dde9d9d6d725b527

SHA512
775bd600625dc5d293cfebb208d7dc9b506b08dd0da22124a7a69fb435756c2a309cbd3d813fc78543fd9bae7e9b286a5bd83a956859c05f5656daa96fcc2165

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\Krotten.zip

Filesize
25KB

MD5
1aea5ad85df3b14e216cc0200c708673

SHA1
e3ee16e93ba7c3d7286dc9ebbaf940f0bcb6cad3

SHA256
8dfa496c93680adc10e77c0946c7927d3e58d79900013c95dfca3411d766bd16

SHA512
06faa190350e4558c6d4f1f201dc0698587495897593aaeac16f3ea3d8c1c7f81d65beea6bc7e730ca1df9bdfdf3cd2bcc84bf50f64787e0b1dbd21492796f36

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\NoMoreRansom.zip

Filesize
916KB

MD5
f315e49d46914e3989a160bbcfc5de85

SHA1
99654bfeaad090d95deef3a2e9d5d021d2dc5f63

SHA256
5cbb6442c47708558da29588e0d8ef0b34c4716be4a47e7c715ea844fbcf60d7

SHA512
224747b15d0713afcb2641f8f3aa1687516d42e045d456b3ed096a42757a6c10c6626672366c9b632349cf6ffe41011724e6f4b684837de9b719d0f351dfd22e

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\Petya.A.zip

Filesize
128KB

MD5
1559522c34054e5144fe68ee98c29e61

SHA1
ff80eeb6bcf4498c9ff38c252be2726e65c10c34

SHA256
e99651aa5c5dcf9128adc8da685f1295b959f640a173098d07018b030d529509

SHA512
6dab1f391ab1bea12b799fcfb56d70cfbdbde05ad350b53fcb782418495fad1c275fe1a40f9edd238473c3d532b4d87948bddd140e5912f14aff4293be6e4b4c

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\PolyRansom.zip

Filesize
130KB

MD5
7a5ab2552c085f01a4d3c5f9d7718b99

SHA1
e148ca4cce695c19585b7815936f8e05be22eb77

SHA256
ed8d4bb55444595fabb8172ee24fa2707ab401324f6f4d6b30a3cf04a51212d4

SHA512
33a0fe5830e669d9fafbc6dbe1c8d1bd13730552fba5798530eeb652bb37dcbc614555187e2cfd055f3520e5265fc4b1409de88dccd4ba9fe1e12d3c793ef632

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\PowerPoint.zip

Filesize
66KB

MD5
196611c89b3b180d8a638d11d50926ed

SHA1
aa98b312dc0e9d7e59bef85b704ad87dc6c582d5

SHA256
4c10d3ddeba414775ebb5af4da5b7bb17ae52a92831fe09244f63c36b2c77f34

SHA512
19d60abf83b4a4fe5701e38e0c84f9492232ceb95b267ae5859c049cea12fee2328a5d26ffd850e38307fb10cb3955b7e5e49d916856c929442d45b87071d724

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\ViraLock.zip

Filesize
132KB

MD5
6a47990541c573d44444f9ad5aa61774

SHA1
f230fff199a57a07a972e2ee7169bc074d9e0cd5

SHA256
b161c762c5894d820cc10d9027f2404a6fec3bc9f8fd84d23ff1daef98493115

SHA512
fe8a4fd268106817efc0222c94cb26ad4ae0a39f99aacaa86880b8a2caa83767ffe8a3dd5b0cdcc38b61f1b4d0196064856bd0191b9c2d7a8d8297c864a7716d

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\WannaCrypt0r.zip

Filesize
3.3MB

MD5
e58fdd8b0ce47bcb8ffd89f4499d186d

SHA1
b7e2334ac6e1ad75e3744661bb590a2d1da98b03

SHA256
283f40e9d550833bec101a24fd6fd6fbd9937ed32a51392e818ffff662a1d30a

SHA512
95b6567b373efa6aec6a9bfd7af70ded86f8c72d3e8ba75f756024817815b830f54d18143b0be6de335dd0ca0afe722f88a4684663be5a84946bd30343d43a8c

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\Winlocker.VB6.Blacksod.zip

Filesize
1.6MB

MD5
713f3673049a096ea23787a9bcb63329

SHA1
b6dad889f46dc19ae8a444b93b0a14248404c11d

SHA256
a62c54fefde2762426208c6e6c7f01ef2066fc837f94f5f36d11a36b3ecddd5f

SHA512
810bdf865a25bde85096e95c697ba7c1b79130b5e589c84ab93b21055b7341b5446d4e15905f7aa4cc242127d9ed1cf6f078b43fe452ad2e40695e5ab2bf8a18

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\Xyeta.zip

Filesize
75KB

MD5
213743564d240175e53f5c1feb800820

SHA1
5a64c9771d2e0a8faf569f1d0fb1a43d289e157c

SHA256
65f5d46ed07c5b5d44f1b96088226e1473f4a6341f7510495fe108fef2a74575

SHA512
8e6b1822b93df21dd87bf850cf97e1906a4416a20fc91039dd41fd96d97e3e61cefcd98eeef325adbd722d375c257a68f13c4fbcc511057922a37c688cb39d75

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\000.zip

Filesize
119KB

MD5
d113bd83e59586dd8f1843bdb9b98ee0

SHA1
6c203d91d5184dade63dbab8aecbdfaa8a5402ab

SHA256
9d3fe04d88c401178165f7fbdf307ac0fb690cc5fef8b70ee7f380307d4748f8

SHA512
0e763ff972068d2d9946a2659968e0f78945e9bf9a73090ec81f2a6f96ac9b43a240544455068d41afa327035b20b0509bb1ad79a28147b6375ed0c0cf3efec5

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\ColorBug.zip

Filesize
28KB

MD5
34071c621da9508f92696709d71bb30a

SHA1
5817a14b8da5da5aecd59f5016c2b02fbbe2f631

SHA256
ff2e6648e019087c2ec3c0f9eab548a761122b696caca171ab88e414ba5615cd

SHA512
eb4c3b5ce9a4d6e979565d44c1a1432272bd2b9d1b83ca6b03ddc9982a5a6c341126ba71bbfd0e8d443ffa93265b6d205c187f586ff0bcb708965d2db6c98b45

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\DesktopPuzzle.zip

Filesize
121KB

MD5
6ec216cae1f0e898635d296bbb1a7539

SHA1
8725949a62c581e4c55d7338dcf3f67997840278

SHA256
431b9b7321f734a3f11b23e638199ff1f0d9abe9374ec299484d9e47f20b4ee2

SHA512
b619a5e8ccc0473d99453108085b1678a75dc816bbeb1d5301cd265ff8aee18e214d4e7b877d0d5d13921238d45581cb89021c4dbfb9ba2f3bddb4d4f297ddfe

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\FakeActivation.zip

Filesize
275KB

MD5
6db8a7da4e8dc527d445b7a37d02d5d6

SHA1
4fcc7cff8b49a834858d8c6016c3c6f109c9c794

SHA256
7cc43d4259f9dbe6806e1c067ebd1784eaaf56a026047d9380be944b71e5b984

SHA512
b1b4269da8a0648747c4eee7a26619b29d8d1182fe12446c780091fef205a7b5e6fb93c9b74c710cca5d2e69600579b9d470e31a32689ecc570d0c4bbe4fe718

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\HMBlocker.zip

Filesize
38KB

MD5
5968e8a8caa61b46ba347f8c521c1f2e

SHA1
88f9a7ce6e77d191c9a57ecf238ef5e9e9ba6c7c

SHA256
a181f8925c8c66614be38de89e6dc38cf85715379a10de8d9f9d70b04891ca35

SHA512
6b0659ff7a5548cd1b752a72a70b147d1c9676dce14148430961a7b5204d4e3a42de5530d423ebb879f8e5c72785a45e5b20bd40cbf93cfaefe981534e96cbe3

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\Illerka.C.zip

Filesize
64KB

MD5
9f7249077b949c96bfa3fbafc38e4ee2

SHA1
1fec3d58de9f782dfaabc323222f89adea6b7d05

SHA256
519fb20d9caba12bac93c363bb64d8bade4971fad49e8bf489d1e512784c28c0

SHA512
088ce74aee633ae25ef764555f1a2686f32efde5b28cb1afebad9926ab69f574506e3dc68b7b2d8f966bc19b96b50f9cbbd28beed0afd70cdad6d77581e072f6

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\MEMZ.zip

Filesize
8KB

MD5
69977a5d1c648976d47b69ea3aa8fcaa

SHA1
4630cc15000c0d3149350b9ecda6cfc8f402938a

SHA256
61ca4d8dd992c763b47bebb9b5facb68a59ff0a594c2ff215aa4143b593ae9dc

SHA512
ba0671c72cd4209fabe0ee241b71e95bd9d8e78d77a893c94f87de5735fd10ea8b389cf4c48462910042c312ddff2f527999cd2f845d0c19a8673dbceda369fd

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\Spark.zip

Filesize
1.6MB

MD5
860168a14356be3e65650b8a3cf6c3a0

SHA1
ea99e29e119d88caf9d38fb6aac04a97e9c5ac63

SHA256
1ae2a53c8adc94b1566ea6b3aa63ce7fe2a2b2fcbe4cec3112f9ebe76e2e9bf9

SHA512
0637e4838beded9c829612f0961d981ee6c049f4390c3115fed9c4e919561ad3d0aa7110e32c1d62468a7e4cdc85d2f2e39a741939efd1aafae551de705aab61

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\TaskILL.zip

Filesize
14KB

MD5
f3f982622520af32cc86d3a22f352af0

SHA1
99b7c8a8afa3cfc7292893d7b2253a581249d9d4

SHA256
653b5c625dc6f24dcab5aaf33e77fd3c994f4783884c21d0a71b5c1fefbeb4e1

SHA512
27482f0293b88c1a31dd1132401b4df19d3636f1a31f2b607ccf9a28dde0165381d65d9d0c492ab6c300bd1da0aac9e8df8c7cb3394cea35c90ce1a544a0576e

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\YouAreAnIdiot.zip

Filesize
223KB

MD5
a7a51358ab9cdf1773b76bc2e25812d9

SHA1
9f3befe37f5fbe58bbb9476a811869c5410ee919

SHA256
817ae49d7329ea507f0a01bb8009b9698bbd2fbe5055c942536f73f4d1d2b612

SHA512
3adc88eec7f646e50be24d2322b146438350aad358b3939d6ec0cd700fa3e3c07f2b75c5cd5e0018721af8e2391b0f32138ab66369869aaaa055d9188b4aa38d

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/1380-13-0x0000000000CF0000-0x00000000024C0000-memory.dmp

Filesize
23.8MB

Download
memory/1380-31-0x0000000002960000-0x0000000002961000-memory.dmp

Filesize
4KB

Download
memory/1380-202-0x0000000000CF0000-0x00000000024C0000-memory.dmp

Filesize
23.8MB

Download
memory/1632-32-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Filesize
4KB

Download
memory/1632-203-0x0000000000CF0000-0x00000000024C0000-memory.dmp

Filesize
23.8MB

Download
memory/1632-12-0x0000000000CF0000-0x00000000024C0000-memory.dmp

Filesize
23.8MB

Download
memory/2796-261-0x0000000000CF0000-0x00000000024C0000-memory.dmp

Filesize
23.8MB

Download
memory/2796-289-0x00000000061F0000-0x00000000061F1000-memory.dmp

Filesize
4KB

Download
memory/2796-282-0x0000000006170000-0x0000000006171000-memory.dmp

Filesize
4KB

Download
memory/2796-286-0x00000000061C0000-0x00000000061C1000-memory.dmp

Filesize
4KB

Download
memory/2796-285-0x00000000061B0000-0x00000000061B1000-memory.dmp

Filesize
4KB

Download
memory/2796-287-0x00000000061D0000-0x00000000061D1000-memory.dmp

Filesize
4KB

Download
memory/2796-288-0x00000000061E0000-0x00000000061E1000-memory.dmp

Filesize
4KB

Download
memory/2796-262-0x0000000000CF0000-0x00000000024C0000-memory.dmp

Filesize
23.8MB

Download
memory/2796-290-0x0000000006200000-0x0000000006201000-memory.dmp

Filesize
4KB

Download
memory/2796-291-0x0000000006210000-0x0000000006211000-memory.dmp

Filesize
4KB

Download
memory/2796-293-0x0000000006130000-0x0000000006131000-memory.dmp

Filesize
4KB

Download
memory/2796-294-0x0000000006150000-0x0000000006151000-memory.dmp

Filesize
4KB

Download
memory/2796-280-0x0000000006140000-0x0000000006141000-memory.dmp

Filesize
4KB

Download
memory/2796-4046-0x0000000000CF0000-0x00000000024C0000-memory.dmp

Filesize
23.8MB

Download
memory/2796-295-0x00000000061A0000-0x00000000061A1000-memory.dmp

Filesize
4KB

Download
memory/2796-278-0x0000000006100000-0x0000000006101000-memory.dmp

Filesize
4KB

Download
memory/2796-277-0x00000000060F0000-0x00000000060F1000-memory.dmp

Filesize
4KB

Download
memory/2796-292-0x0000000006220000-0x0000000006221000-memory.dmp

Filesize
4KB

Download
memory/2796-275-0x00000000060C0000-0x00000000060C1000-memory.dmp

Filesize
4KB

Download
memory/2796-266-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/2796-279-0x0000000006110000-0x0000000006111000-memory.dmp

Filesize
4KB

Download
memory/2796-283-0x0000000006180000-0x0000000006181000-memory.dmp

Filesize
4KB

Download
memory/2796-284-0x0000000006190000-0x0000000006191000-memory.dmp

Filesize
4KB

Download
memory/2796-276-0x00000000060D0000-0x00000000060D1000-memory.dmp

Filesize
4KB

Download
memory/2796-272-0x0000000005EF0000-0x0000000005EF1000-memory.dmp

Filesize
4KB

Download
memory/2796-274-0x0000000005F30000-0x0000000005F31000-memory.dmp

Filesize
4KB

Download
memory/2796-281-0x0000000006160000-0x0000000006161000-memory.dmp

Filesize
4KB

Download
memory/2796-304-0x0000000000CF0000-0x00000000024C0000-memory.dmp

Filesize
23.8MB

Download
memory/2796-273-0x0000000005F10000-0x0000000005F11000-memory.dmp

Filesize
4KB

Download
memory/3196-201-0x0000000000CF0000-0x00000000024C0000-memory.dmp

Filesize
23.8MB

Download
memory/3196-87-0x0000000005E80000-0x0000000005E81000-memory.dmp

Filesize
4KB

Download
memory/3196-23-0x0000000005D90000-0x0000000005D91000-memory.dmp

Filesize
4KB

Download
memory/3196-92-0x0000000007610000-0x0000000007611000-memory.dmp

Filesize
4KB

Download
memory/3196-190-0x0000000007620000-0x0000000007621000-memory.dmp

Filesize
4KB

Download
memory/3196-27-0x0000000005D80000-0x0000000005D81000-memory.dmp

Filesize
4KB

Download
memory/3196-4-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/3196-1-0x0000000000CF0000-0x00000000024C0000-memory.dmp

Filesize
23.8MB

Download
memory/3196-0-0x0000000000CF0000-0x00000000024C0000-memory.dmp

Filesize
23.8MB

Download
memory/4996-3873-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4996-3866-0x0000000000550000-0x0000000000556000-memory.dmp

Filesize
24KB

Download
memory/4996-3865-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4996-3872-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download