986eb45b5d5c04fee9e2bfcbbc15b968870e40feda870eb949ef10c2b7b73c1e

max time kernel
440s
max time network
460s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2024 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wave.png
Size

10KB
MD5

57bd5782b784673f8e3ebd06f95bdf38
SHA1

1f55e36180024eb5c8fc066a855287898e6b077a
SHA256

986eb45b5d5c04fee9e2bfcbbc15b968870e40feda870eb949ef10c2b7b73c1e
SHA512

9f807db1571b942467f61b2d9a7ef11882036f64a6e1347ede55523deb9da193ec8255be0819e16cac65595f67f05bbf80320c9d46c4e1bf944b34dd000ffe51
SSDEEP

192:sD2HxgUkULWcH4F4/XZ/g4t688FPhzBfZIYeLhl+1/RNqeyFgbCBQJGSz/2Niq:sDXEicYF4/XZ/HT8FPhzMHNQdql0CBQ2

Score

10^/10

discovery evasion exploit persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "empty"	WormLocker2.0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "empty"	WormLocker2.0.exe

Disables Task Manager via registry modification
evasion

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
2032	icacls.exe
4812	takeown.exe
740	icacls.exe
4740	takeown.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	WormLocker2.0.exe

Executes dropped EXE 2 IoCs

pid	Process
2168	WormLocker2.0.exe
3196	WormLocker2.0.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4812	takeown.exe
740	icacls.exe
4740	takeown.exe
2032	icacls.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
189	camo.githubusercontent.com
190	camo.githubusercontent.com
191	camo.githubusercontent.com
192	camo.githubusercontent.com

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\LogonUIinf.exe	Automatic_converter_rff_to_mp4.exe
File opened for modification	C:\Windows\System32\WormLocker2.0.exe	Automatic_converter_rff_to_mp4.exe
File opened for modification	C:\Windows\System32\WormLocker2.0.exe	Automatic_converter_rff_to_mp4.exe
File opened for modification	C:\Windows\System32\ransom_voice.vbs	Automatic_converter_rff_to_mp4.exe
File created	C:\Windows\System32\LogonUItrue.exe	Automatic_converter_rff_to_mp4.exe
File opened for modification	C:\Windows\System32\LogonUItrue.exe	Automatic_converter_rff_to_mp4.exe
File created	C:\Windows\System32\LogonUI.exe	Automatic_converter_rff_to_mp4.exe
File opened for modification	C:\Windows\System32\LogonUIinf.exe	Automatic_converter_rff_to_mp4.exe
File opened for modification	C:\Windows\System32\ransom_voice.vbs	Automatic_converter_rff_to_mp4.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\System32\README.txt	DCQPKX.exe
File created	C:\Program Files\System32\Ransomware2.0.exe	DCQPKX.exe
File opened for modification	C:\Program Files\System32\README.txt	DCQPKX.exe
File created	C:\Program Files\System32\Ransomware2.0.exe	DCQPKX.exe
File opened for modification	C:\Program Files\System32\README.txt	DCQPKX.exe
File created	C:\Program Files\System32\Ransomware2.0.exe	DCQPKX.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings	WormLocker2.0.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Ransomware2.0_by_clutter_tech-master.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Worm-Locker2.0-main.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3480	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2168	WormLocker2.0.exe
2168	WormLocker2.0.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	3256	firefox.exe
Token: SeDebugPrivilege	3256	firefox.exe
Token: SeDebugPrivilege	3256	firefox.exe
Token: SeDebugPrivilege	3256	firefox.exe
Token: SeDebugPrivilege	3256	firefox.exe
Token: SeDebugPrivilege	3256	firefox.exe
Token: SeDebugPrivilege	3256	firefox.exe
Token: SeDebugPrivilege	3496	DCQPKX.exe
Token: SeDebugPrivilege	3384	DCQPKX.exe
Token: SeDebugPrivilege	3040	DCQPKX.exe
Token: SeDebugPrivilege	3256	firefox.exe
Token: SeDebugPrivilege	3256	firefox.exe
Token: SeTakeOwnershipPrivilege	4812	takeown.exe
Token: SeDebugPrivilege	2168	WormLocker2.0.exe
Token: 33	3592	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3592	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3256	firefox.exe
3256	firefox.exe
3256	firefox.exe
3256	firefox.exe
3256	firefox.exe
3256	firefox.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
3256	firefox.exe
3256	firefox.exe
3256	firefox.exe
3256	firefox.exe
3256	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3256	firefox.exe
3256	firefox.exe
3256	firefox.exe
3256	firefox.exe
3256	firefox.exe
3256	firefox.exe
3256	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 5060	3256	firefox.exe	88
PID 3256 wrote to memory of 5060	3256	firefox.exe	88
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 3200	3256	firefox.exe	89
PID 3256 wrote to memory of 4892	3256	firefox.exe	90
PID 3256 wrote to memory of 4892	3256	firefox.exe	90
PID 3256 wrote to memory of 4892	3256	firefox.exe	90
PID 3256 wrote to memory of 4892	3256	firefox.exe	90
PID 3256 wrote to memory of 4892	3256	firefox.exe	90
PID 3256 wrote to memory of 4892	3256	firefox.exe	90
PID 3256 wrote to memory of 4892	3256	firefox.exe	90
PID 3256 wrote to memory of 4892	3256	firefox.exe	90
PID 3256 wrote to memory of 4892	3256	firefox.exe	90
PID 3256 wrote to memory of 4892	3256	firefox.exe	90
PID 3256 wrote to memory of 4892	3256	firefox.exe	90
PID 3256 wrote to memory of 4892	3256	firefox.exe	90
PID 3256 wrote to memory of 4892	3256	firefox.exe	90
PID 3256 wrote to memory of 4892	3256	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\wave.png
1⤵
PID:1728

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3256.0.998825891\2018587257" -parentBuildID 20221007134813 -prefsHandle 1844 -prefMapHandle 1836 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a6e946d-f148-4ab7-a2b9-456b385acb9e} 3256 "\\.\pipe\gecko-crash-server-pipe.3256" 1936 1cf0a2db458 gpu
  2⤵
  PID:5060
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3256.1.2020556298\1651023797" -parentBuildID 20221007134813 -prefsHandle 2364 -prefMapHandle 2360 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a656ad9e-40ac-4a18-82a6-0ab9fbceece8} 3256 "\\.\pipe\gecko-crash-server-pipe.3256" 2376 1cf09fe3558 socket
  2⤵
  PID:3200
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3256.2.153904211\1139866600" -childID 1 -isForBrowser -prefsHandle 3100 -prefMapHandle 3096 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1176 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3aaf5562-7f58-43b5-9890-6a00422857e2} 3256 "\\.\pipe\gecko-crash-server-pipe.3256" 3068 1cf0e2e0258 tab
  2⤵
  PID:4892
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3256.3.266416417\616750033" -childID 2 -isForBrowser -prefsHandle 3596 -prefMapHandle 3592 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1176 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59d985ed-4ff8-488a-87cd-78df9414125b} 3256 "\\.\pipe\gecko-crash-server-pipe.3256" 3604 1cf0f0e4258 tab
  2⤵
  PID:3152
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3256.4.599460096\1886957830" -childID 3 -isForBrowser -prefsHandle 3896 -prefMapHandle 3612 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1176 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f6a930a-a93a-4ea5-9f3c-b8099e2bf3ed} 3256 "\\.\pipe\gecko-crash-server-pipe.3256" 4016 1cf0f0e4e58 tab
  2⤵
  PID:4104
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3256.6.622852382\1308616067" -childID 5 -isForBrowser -prefsHandle 4948 -prefMapHandle 5016 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1176 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {070b54d4-3d42-445d-804f-f71d072ecfe5} 3256 "\\.\pipe\gecko-crash-server-pipe.3256" 5100 1cf10531258 tab
  2⤵
  PID:5048
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3256.5.1087413614\118924827" -childID 4 -isForBrowser -prefsHandle 5028 -prefMapHandle 5020 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1176 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94256fc5-62f7-4f97-b47d-067b2fb9205d} 3256 "\\.\pipe\gecko-crash-server-pipe.3256" 5052 1cf10530358 tab
  2⤵
  PID:2036
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3256.7.188313828\1873494656" -childID 6 -isForBrowser -prefsHandle 5496 -prefMapHandle 5336 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1176 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3dd3f826-9ea5-4403-92fe-5bf0c7be31f8} 3256 "\\.\pipe\gecko-crash-server-pipe.3256" 5456 1cf09fe5f58 tab
  2⤵
  PID:3632
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3256.8.1301656542\8576237" -childID 7 -isForBrowser -prefsHandle 5872 -prefMapHandle 5868 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1176 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7175ac3a-3bcb-4063-b251-b676529c973f} 3256 "\\.\pipe\gecko-crash-server-pipe.3256" 5884 1cf11badf58 tab
  2⤵
  PID:3232
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3256.9.1351022901\1938045310" -parentBuildID 20221007134813 -prefsHandle 5224 -prefMapHandle 4868 -prefsLen 27346 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dee3bd62-c117-44ec-8a9a-022eb2a4e7a4} 3256 "\\.\pipe\gecko-crash-server-pipe.3256" 5352 1cf0c617258 rdd
  2⤵
  PID:4632
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3256.10.39313105\145449314" -childID 8 -isForBrowser -prefsHandle 6252 -prefMapHandle 5224 -prefsLen 27346 -prefMapSize 233444 -jsInitHandle 1176 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad63daa0-b828-43aa-9eef-02ba0d3d807f} 3256 "\\.\pipe\gecko-crash-server-pipe.3256" 6260 1cf0c674a58 tab
  2⤵
  PID:2264
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3256.11.146772424\484114526" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 2848 -prefMapHandle 5108 -prefsLen 27346 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbd510a2-c6b3-491d-93e3-1b7226a61204} 3256 "\\.\pipe\gecko-crash-server-pipe.3256" 5052 1cf0f570d58 utility
  2⤵
  PID:5100

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4864

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Ransomware2.0_by_clutter_tech-master\Ransomware2.0_by_clutter_tech-master\Ransomware2.0\REAMD ME!!!.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3480

C:\Users\Admin\Downloads\Ransomware2.0_by_clutter_tech-master\Ransomware2.0_by_clutter_tech-master\Ransomware2.0\DCQPKX.exe
"C:\Users\Admin\Downloads\Ransomware2.0_by_clutter_tech-master\Ransomware2.0_by_clutter_tech-master\Ransomware2.0\DCQPKX.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3496

C:\Users\Admin\Downloads\Ransomware2.0_by_clutter_tech-master\Ransomware2.0_by_clutter_tech-master\Ransomware2.0\DCQPKX.exe
"C:\Users\Admin\Downloads\Ransomware2.0_by_clutter_tech-master\Ransomware2.0_by_clutter_tech-master\Ransomware2.0\DCQPKX.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3384

C:\Users\Admin\Downloads\Ransomware2.0_by_clutter_tech-master\Ransomware2.0_by_clutter_tech-master\Ransomware2.0\DCQPKX.exe
"C:\Users\Admin\Downloads\Ransomware2.0_by_clutter_tech-master\Ransomware2.0_by_clutter_tech-master\Ransomware2.0\DCQPKX.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3040

C:\Users\Admin\Downloads\Worm-Locker2.0-main\Worm-Locker2.0-main\Worm Locker2.0(ransomware)\Automatic_converter_rff_to_mp4.exe
"C:\Users\Admin\Downloads\Worm-Locker2.0-main\Worm-Locker2.0-main\Worm Locker2.0(ransomware)\Automatic_converter_rff_to_mp4.exe"
1⤵
- Drops file in System32 directory
PID:3384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F"
  2⤵
  PID:3588
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4812
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32 /grant "Admin:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:740
- C:\Windows\System32\WormLocker2.0.exe
  "C:\Windows\System32\WormLocker2.0.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\System32\ransom_voice.vbs"
    3⤵
    PID:3804

C:\Users\Admin\Downloads\Worm-Locker2.0-main\Worm-Locker2.0-main\Worm Locker2.0(ransomware)\Automatic_converter_rff_to_mp4.exe
"C:\Users\Admin\Downloads\Worm-Locker2.0-main\Worm-Locker2.0-main\Worm Locker2.0(ransomware)\Automatic_converter_rff_to_mp4.exe"
1⤵
- Drops file in System32 directory
PID:1104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F"
  2⤵
  PID:3248
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4740
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32 /grant "Admin:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2032
- C:\Windows\System32\WormLocker2.0.exe
  "C:\Windows\System32\WormLocker2.0.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  PID:3196
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\System32\ransom_voice.vbs"
    3⤵
    PID:4952

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Worm-Locker2.0-main\Worm-Locker2.0-main\Worm Locker2.0(ransomware)\README.txt
1⤵
PID:1552

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a8 0x504
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\System32\README.txt

Filesize
43B

MD5
abd3a90c6f6420abc00e36f207ce01ee

SHA1
5082b5bac5f9da9e8caa75da95bdd880e2dde2d9

SHA256
7f3a1ef4bd62101beabc0e3e00ede9072b72b4c531a5393ab9be72948ce06238

SHA512
70ab9272024482dabc8bba672e2bc1d17456788cdcceb0d2347786094608330d14a9ca7e4ba6760375849ed2e60c89406ec689b824baf7ecfe208ce03ae22de2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DCQPKX.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\doomed\12903

Filesize
10KB

MD5
ff074aea4938a7470d404bd09af76b06

SHA1
c7f8802ddac5f03f65d79aad04bde6f346a2f729

SHA256
c535afe8ee8d0491674d405a126919ef6c797448e03fa160a851b416fcb7aaa8

SHA512
56684654a8b9d10667e25dc26c1d7357a8c6cd3f6e464e7a40c25b74d3e6e313d43b9ec21e869ad1d0b54fccfba0d942be42b1d3eed695a9611a5516137fccf7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\doomed\12952

Filesize
52KB

MD5
1c12123d84c5a343737356d4d0215c68

SHA1
6c142463388bdcc4c5effd33872eb840d94ed5b1

SHA256
ffa9bb01fce1c8471938d10517043391e58e429598ff82da9ec4809ccd343bd2

SHA512
0e61cfd102f691823b661d05f3b58fd3a8f6c092bdfc9772eb90cee44f7d72ba61b4946a7f2aaa63a4696734d0ed14a49d4ec4c403c8f228b7740980ee553a69

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\doomed\26570

Filesize
52KB

MD5
c10cce0ae37039ef2f81b08cf64315a1

SHA1
be641f52cb69d557b7fdd4440085b2d9da23cd69

SHA256
5a9cb58608b787cb6aaa0b69152ec23c1772df750ed4cdc0234ff6a9f3b21672

SHA512
c42fec1f31e7802fa0be2e8d2d925985f2cbc892636c6cfd8e699cb2c958c0074bc47b91b9cef916c2f410cc3bbe8971b46fd4aa907cd0dab94176dc8b0cf84e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\doomed\26902

Filesize
30KB

MD5
66a348d93b7b5a3453f00e647b57c85c

SHA1
0c18a721a520a4c616c6821f77a2dda1aee6d1ef

SHA256
2ebb341f325ba857eeb3a3df002a02abe83922588a8135375dc93d3b56320f11

SHA512
b771937a4e486f11e10dc182da4aeadf25c30a9ddde648850fd4d5b25bd341e390e0a5bbe7579522255cce1df4e9224073882e344d6bcee95ef621502f7edcb5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\doomed\30753

Filesize
13KB

MD5
0aa6e3829e92fb5ed03c8e01bff25590

SHA1
5d246281eb3d6ce0fb85e97bf11b3c373a325463

SHA256
8a7e738ad6382993b181b4a825b3a9e2933e322307aa75d079ea709242526025

SHA512
5c6eefcbc5c0a2c096bb6449f8c79bfcdb10727786fd9d7fe5a8f6061578b42b8e629a708b307aa778a9397bb0252ff10932e0d009a181164946cd5eab4d1edb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\doomed\3718

Filesize
30KB

MD5
5b81c480a995199eee398d6c01d76958

SHA1
0c68714672869918539b07689acf863f82b6c944

SHA256
ae9f4e2c88fe835120c7907e9424a3a774d7f0643b57e94aaac2e239c1a9d3da

SHA512
66258099c054d4b9b8fdda42c3257ba4b8275837c6240f02d67fe0e2350cb7ca538a800ab1b19518503f493ad4ef390eab3ac66f18a3272e1b0bd08c92e66fd0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\01E7348AEFD115549BF05069070ACAA006B73600

Filesize
77KB

MD5
16124b3e08eb189b014f830084b199cf

SHA1
0807142cbb36b98c0e2d08269ecef5171277031c

SHA256
966d6bc64cceddae239c68ff0239ccd30e690154b7e8a9718152c7ffd4ad8ca4

SHA512
824cc3f424412f4e6904279c982c08859654a9f616040ca58d90889052242576f79aa45659dd400c9e9031229e611f7a83be9040570ea686f6d897491f99a386

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\09EDBE0C0AE5CE04868F06A4BC625F286116BA02

Filesize
33KB

MD5
3c09ef41ad71aecd1a9bf29a298856aa

SHA1
3b3579be0959973031af8190c4a3e806e25bdd1c

SHA256
aa8e6578067d6b9171e2a0ce6b189cec0751847575b1c3b57a1fb020014c0ad5

SHA512
344d5121e76feed71d481ff9cb4e49e1273ccad77df994a36c251b62dd7e03212c510c294bafe4666afb871e63e9f0553c9b1de069fa64c39d3f557dea322131

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\150018585F0060009D7FEBDE8A6151C9AE8C13B9

Filesize
429KB

MD5
0f296bcd3451534e316a3b291860ba0d

SHA1
45724f99ba63873ef14d93dd1d88d617423439b1

SHA256
cb53e9ed0a4b1e116030e74e252c2964537844397e42ef264602fcc0f3817ce5

SHA512
8fc8284e7262d351ee91ede1be7b87c7f53d17f1a4b9479222457781ed209a48686e47ff1dc60d229dac53a501e2b0ea2baa6ca5ff95b78720fa23b8e089ce60

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\1DFA70FECEBDCEB4D132E70225EB3030CFF65FA3

Filesize
133KB

MD5
7ab5487ac8488c47623b7bc96d94d2e5

SHA1
5238b40995c842a779de3d4ddbae4622d6d9adf7

SHA256
9e0c648b2996dff92be4aae0979dcb0a8d3788c0962a59684ff214f7bbe253eb

SHA512
f53a4ed279eb3957c0dcdfaeba6b4cda6c783a759dfb372a01589e5aa69e12eff41a1070a9e31b86d2cef91a2dd62b0ef37cfee91a4ab12281dc362db713b772

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\1E61518360BA13E897A17737CCDA8D9067374818

Filesize
766KB

MD5
7a2919ac8d8721af6aca2bf8e0e22fe6

SHA1
4dbf7b5b0d802fad26d013c45f8364949ab81e7b

SHA256
4bd1d796cf82f38150d861ff59b4ba7ecb64c4e1a70d9a4fc6dbd289c19335ac

SHA512
2e0a54cddf2b0f8b3cf0c8906812b14077303175fe9d8f25a16f612e26eedd3a786658327498c4521c0e1953fab78f9f6cea23405efad81d6f2123dcd3faaf5c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\2167B505D934699C441A8E0A03DA105F9166E6A8

Filesize
20KB

MD5
674fa5f872e2be8ef5266237172c9879

SHA1
3dd86b5fa4efe09a219a4f86ff2923ce44844a2a

SHA256
1b0cf92f9ef8b3b6bdbbaae29cc35653bde65b322b07b1fe7bbc01919508926f

SHA512
3a7536bd48bf0e0829e1684b3ca22671fa39a2e16e6bb2c050f204d142fbecb99d134da888c69423f01ba511ca01fc352070a8bfae758663d991b1950b1b31d6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\27B94747B1AC977E16CF31C05A975382785D3017

Filesize
63KB

MD5
1bf6727a9f37e800f70245b40f80b41a

SHA1
d98a02f75ca6910f6bc39dfd551686b39cfbbb32

SHA256
be09ec9842a951f66e9fecc3221def13c56c8656741294769a3ede665b44b168

SHA512
8d77b22be1de9b9a6b1b3a4154c2e11995e1a93beebd4df4537f8b00ffa16f6abc0f7faa8ff0f2714b38c01763f28ceb705e7d126275f21905111706ebc29820

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\2FF45693BE98D1FF633F92C96E5D6A3E6568D5A4

Filesize
308KB

MD5
6ed6368b636a062474eb416f4aa9e3ff

SHA1
1b0dc35b963b1c1c2d9bf1c4c6bfe323627420bc

SHA256
bee18d2d24a6ade31763798a6725385883a8996af4bd063b673fa114e352691f

SHA512
69c7d70cb54f2551a9527e7c5b5ce941258aeef9d35d3aa61698e3824ff71dbb9436213abd64be11458d6be9657f324ea225809798430278b62fff0e9d4004a2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\34231335DC373FC6F959E8D1C1DD1906DAC2A65C

Filesize
48KB

MD5
16abaef32500dad64c9a585739dbbb5e

SHA1
b5f2fd3cda19a422bbd047dbe6a5bb5c0d11350e

SHA256
5becefe9da1a5f0a9ecafead95ce61e5d5ddaef45d646f4dc450b66630ad6fd2

SHA512
e30d6544d96f4f7613b02e5746a0256e1750dc3f3c50529fd22fd2cc42a34f0d864db1b3e8a192592840cb558a4de2976ca8de5c9f4b6247de27736528129d18

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\397854704867B2CB75BA8658E0989793BD1B00FB

Filesize
60KB

MD5
4b1ee3be5021e20f23b0858791d65f3f

SHA1
7ccd624916d24d12415a17c0572383f95d01e76a

SHA256
80e8ef346e808820b2c0834b994db5fa26b884b8824cf8d90918fc28b5f4692e

SHA512
8700a676d84e04cac8fbe0671f6eaf7e2861f9d4711937df090892f673f819e87d31b5ecc81f1644a4b80c5c83f533c644e105777e76a3c0b4780e37dcbc48d2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\3AE8792A487F90E02C5F59DF2EC9D50F1CB76903

Filesize
41KB

MD5
4d30437d58b2256ce9b3922c96055aa7

SHA1
dbf16a3d1a7695efc67aa12aefd343e5998c4331

SHA256
1ab086489af1975ec56cc193d50f317d2efa2b1b3cabe6801bc0f4daa9d577f8

SHA512
cfdcfe70870194fe125f5202eb6e1859bdb37d780ef8d82c9604cc37c712e22dcd99d08b42239ae0f731c7dc12e666d856f6d70d5377fcc470050fe64bd68e0c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\41A9CFFC01A978D91D13594E6490F1FD8F536B39

Filesize
74KB

MD5
a82657dd9fe77e96c29485e8790ea9de

SHA1
29f8599b60246a0fe94522bd063246d9a0c38885

SHA256
4788eceb9549dbad2d881185e5916e0f069b55480e2ec4d376e7fd68785dc1b1

SHA512
4ed72b455278b00eee73476e708e6eedc5fbd889265da12cda57b0bd12ee7dc116cc435300eefe17b1429f6d2f38fc86d98bd4d80322a715112ec8fa6e483ac6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\45722AE6FD12AFDC2A70A368BA642949293F7F4E

Filesize
76KB

MD5
477b329005603a48f14157b6320de6af

SHA1
d19f644afe0de1da6b5584a4dbda729ae19309be

SHA256
88dfa4624da35799d1dd00ef19a2431dd85f717f487dc57363d49d3881c5f8b0

SHA512
5df622712ce27e559e95953f5f6ef9deda46546d6c5ecc2af4446105c9a09db20030b20d9a76a1c734a8130700aa9cca37e060f9eff6bf3bd0721abab8ff95a5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\4E4850626F9B7E787B0F47EB58D5C9D0422612FF

Filesize
90KB

MD5
364e0e957a48f2ce7868a51f52ad91a6

SHA1
61160a8eef077e8912002b3f126fe91edc5a8385

SHA256
62547bda4b6e2d734c05295bdf904087be401b5ee341d6f8ed8dbc51eab23a0c

SHA512
ce574705fbc786a239875328a27d32535d7cf96c2f6245bc0bfb8271aa1d0e24dbe699846ba5117b190f44e397061a7bd0ce2ab337d0759044bccff147292365

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\599EB1AAB4980DFBC75515F606E8841BCFBC21C6

Filesize
106KB

MD5
6a7ac7162879c339fa7b624917942a6e

SHA1
60755e53215622b1a5640d0db0235909b04c2ab0

SHA256
a4606421e71b7eda7c12e4603a743508735d6a9a907d1249e1ae7c3825dabd39

SHA512
905eb41a3ad5e553eb9b20a32e984c2f6ca6700399297d4a947c927ca3830a04dcc46e2533500d79b384e9aa26a2570e2fecbe9ff3508dcd6747765e9d3b1f63

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\5A03586A24A633C39527B079F6FBFC2644D9779E

Filesize
86KB

MD5
8f163727c5e015fcc3bcaa9d25679850

SHA1
73a40a3fc8daef27e78daae053b22896a11361f8

SHA256
837fcb1bcd4ab1767246b0479832cd66665f8dad2b20866117df4e58aca3d44f

SHA512
a29135e739bb38ac16099e81f28ad40c34e3db0bd6bc1ce6eeba0f92a43af8deb98e58a2d3d54e08a9e9898aae05a11f030e638fa7109e4a8c00baa81061e9a1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\5C02CA8BBA40776B46A7BD85ECF4C3B8E37C47F7

Filesize
29KB

MD5
73e70db625f6d17b231fb7234db828f8

SHA1
2812a7cf82fc30aacb5c379b4cbfe1a9b435114e

SHA256
9c3b19c10afe6fa5e6dc781a63acc03f3f5c1a1f9469b9d72b07857ae1b62d38

SHA512
a607509901e3660c9cf9eab8a0350c72c17479a9262d103d6165bb101c87fef02d5bc9be8691971b48d28de78034669ca1fadcfba38445e68e267d2b601481ae

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\610381FD3C71D594CFA6AFE8B8803962D0EF6779

Filesize
67KB

MD5
954dcabc9a3b7fd9e96fb595310da56a

SHA1
ac71f5e0b5f48220f7ee3a6ffef52abfd7838b19

SHA256
70905d1fbc3254464ef950f41518e2b690d44ef0ed1e2eb8ca62cee81ba9b52a

SHA512
d32862a9650183ba396c0313fc009fac8551d837587ed1ca78b767961215e8237edc257313f173131c9e42375d5df4cd0dce479a1506657bb1b6693536c1ed47

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\634E16DC7AF73196290DC0EEA7EC63EF6B95A520

Filesize
40KB

MD5
49c6536c0188eeef402f75455fe2a254

SHA1
54b71c3c216250b47a1b4276b776d51998211858

SHA256
11d9187946c9fea72771b11bf78269c4afadc2242d4fcbdd192fc3ddf0528b5d

SHA512
f09229f5002d511e38bfd13c84ab95bf6b969191fe548f0cd3a73ab0866f2115d4314214e6591f44b3aa1051802f65413f3244af9dd52e76a1d47faaa2664e31

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\6FCB1FC70468E5C5DAA9C741710D63CBD0FE1A93

Filesize
33KB

MD5
5f653f8589290da3123871d5da6a4c06

SHA1
bff9a3a3d8699b296f91f5b9b7852e34c3765a33

SHA256
01450b92e0e51dca6aa90cbf56f406933b71447a7ddd38d65693992a6155e765

SHA512
40e3b6842a2e16fca869e58acb4b32f12b5df2568753bef28077f8dfe8bfb4bc6399d678201fc1c285b43b3afc1893fd2a960405b8dadc24d6f784810d386cb9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\72C61B84C8AD10F115EB062D3B238F7DD4D08F32

Filesize
133KB

MD5
3aa6c6c200c16943a21dd0105b872d33

SHA1
34479b618fb8209ac44a46b7de38d96259826905

SHA256
4002b7e1c6d4ca37a6fd4ee36dc2999f4647980f6d0263a03f2d38db626229b6

SHA512
2893b1e700ce97f8bf1d8a7c408001b122426716c802612ee042174538b66a09d7533809478f89632c77c105c20b2d2d6b04c5126849173e11cd63dc6553c7bb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\74CF8F8A528173430B333A294F41B0AB0333197D

Filesize
31KB

MD5
309d973647ff44beb6fed75a91dfa305

SHA1
94d87e31b4cb71ba29ac20f85b4910c088ccdabd

SHA256
273c839e4df888d1e88dddad15f6ec1aa0881d530b35c627ad43ca39edbcc20d

SHA512
2d9501a37ad68476700d39cd1924d2832fe06abcb189442d20627e545135f6d442f64725aa976d4dcdf389632877546ba36c23212f03486961256fdf2ca6ff42

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\791B8A8DF70047BFA15B8104F2D15B0CB898389E

Filesize
85KB

MD5
a6024ea6fd14095ef052fbf117c37e6c

SHA1
f5a6e85b1d2c5bc23ecd36e916f30ce9d07e91c9

SHA256
b472abc91c56f56e292a3cc176188f550e54da53c60ef313ca505191fee26618

SHA512
b8782e1d427a1e1a4eea61b75deeb1b47fb2fc610aa1aa799805ca2408036e07477171200994385c28bf968abee4ce614881fb8c6acf3b43d00fb97aac0c8240

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\7CFBD4857A71AFB16B02CC3BD4D3534FD96B1E07

Filesize
367KB

MD5
91804b63002a886bf16dcbbbd77ff9a3

SHA1
54476a41e1f8ae803cfc0402390d19eb6c99648c

SHA256
055cf194917ee3e9b866c2d0aeeaf96c4e4ffea7e7370d60ee62e86aae967b4c

SHA512
18529ddaec13badc2c3374cfc8161206f4e14a93c039322c36592458c251b7847950075ed2607d2b753b2c8c5000c9d3da764a6f331c167e2ca77d01bebf097b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\7F24CD669B6E5345700CAF20E68D8E061062C679

Filesize
91KB

MD5
cda2213a41364b118a33092eb345cdc1

SHA1
3947227eb9a37903a0722d95c2bea3def53a18c7

SHA256
fd8fcb0abc784752071b8546be7590a9cc2d8a6ccd0836b9240daa8b4ffad1dd

SHA512
e941c121f0e77abbc3c72cba0540a3483c3bcb095a1278329b8c84c717ff7c41edee0ca8ee13c98970d3db2663256ed1b2cd25ec37d108c3af5967d8f778d6ed

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\8CA2E0E7586DFA0673FF9374189BD72333EEC975

Filesize
35KB

MD5
dd61d24bcb2474dcbe2f670b04f4e889

SHA1
75e5def78e925a1c5a94a11329307fab46f70e4f

SHA256
5925cd51615846469ecd4beafc70a191547b63a25ff1ac64a858e140208afe81

SHA512
2f70c29bd2de3fa56e3a6fc52c26dfffca1c828f294ea5453bcb589c8e34d9a9fc29e1f75ebe888e76f7071f90435885718b4299547c72b678427ca02991d35b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\8CF0FCA8835761241FFF87CD21699A59C31B9475

Filesize
81KB

MD5
b1d43704c284109e3af1a2474222bbb0

SHA1
ea69644114b004e18479647b1f7c5c6cea79fec1

SHA256
66aa461861dd82a6873034b293e195f1b344367009126caad91f97c454fc9f34

SHA512
701157db6af5ae3ceff572f8771dffc49bc75cf98e20fda3a0d45efda120c4d7b16ed94157c0c8168b821a274c7476ba67139e38c6e92f003349b27e2c73610f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\8DA4846151E6B4C90531469D8F98CDC35A044D1D

Filesize
37KB

MD5
1d0413c381592b1effca9af7ee6cbe47

SHA1
536d7b246c1f334908499c60ff00546ae0e18089

SHA256
656f7cd02fba640ce6f563c13f5b639a008bd600f853cac426db91c41ce683f4

SHA512
557d52f5ef1e9efc40a4aab5193e9f91c937359135addd3c4eae02854a497435345e74e64050ef2984b555e0292a8523c7305ecccf65a93e007bd0ca691913ef

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\8E89A5D7C57F3B57BE78CFF50C71386486E66DD8

Filesize
32KB

MD5
a9978b7f633846c9bc21b8f34d9b5366

SHA1
fa1f5d3967bbde7cd776156d86df9f4235c2f529

SHA256
250eea6af91ec2825a3ec36d1bf8df8a2abbf3856d6e1bea1ffcfc6dbccc5f7c

SHA512
aab7f40630848efe4a7f68a646f500fcf2484a75bfd31e8cff1cd703c85265e3ef069ef2e6a88abd8ff4de1e01b00ebd64bbd4c5c1428a13add2e322133b04ee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\98874637C82419E368D41A36BE8DF0A669762B55

Filesize
89KB

MD5
283e43db75d357303e4f1d8a589002eb

SHA1
e03dfd05c77bff4d812ca1bdf99ae27c23cda026

SHA256
2395cf22fd49ae56849c5368391870199c6ebd65c7a1d7e93fc382ab4e617bc3

SHA512
3db2f60061c9ab1cda31d4a8f16bba07f36533301640151be3e9e63cc4dfb177c09852d5ee84dc01415251ab147180a154474c04d0adc3a5d67e0c2b583f6413

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\9C2BBC7137762B4CA02A130A09A82F71C29112CE

Filesize
327KB

MD5
ca2be87569870d14069b5de03c52666d

SHA1
baadd6ec0b2f1f4c788f9dbfc11a9f37e15a8c3b

SHA256
d723afa94146c504b379274d3b345c24f121f758f221e9ec43e477fc2defd027

SHA512
ece5aa82f121ba414200904908523139fe787b7f2b03bcef12a4ef31ad0654eacd8f7b0231c456472c000866962e696dc01ff65003ded2f6177bdb234377d181

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\9F596B445897A380F991801AA8C3DBBD30940ADF

Filesize
46KB

MD5
2d78079a0cb419b64b28d6b3ad9dc244

SHA1
684c46e595332d92460dd6e3c52df2754f68343c

SHA256
a72832fb55f307fab851a2c1ea7820d15dc07b77c3c563d1b58214264449a06d

SHA512
a0bbbf077e32ea043eb076ad268799ba75fda8c5fbbe2ee693f4adeab9152c008f4ac1d0872509439781b21e2abe68b2c1e9fb2c0e066b03a735ef365e15f47f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\A03E71D163D42A487D82C9B7C61A4A800C62901C

Filesize
105KB

MD5
bd738881bdb6fc22323a78196e01776b

SHA1
cb9e9136b087e9a56e0c55fdecdd5e377f19d89b

SHA256
f7c5a3870ff2c0027ce26e5ad93a99cd1dfa0740b59301cd5a746663cd4e5041

SHA512
fec4c93b4e0bd3a231e7d721bdfc0ca8bec2d51ad400ceb1b8c5a3d80164f21cf3dc5d59b684bb308a9def1d4b5ce2885da328a0cbae4b85f709f35a62ec0ee9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\A147B5ED2A02C53D82C74C7BF3BB5529E2B6CD7E

Filesize
188KB

MD5
814ba87228366f143bd93b492fbe9f42

SHA1
5c35cc0aaf245ecdac93a04c93bd2f72acadb45f

SHA256
bd31cfe44a3c153c74b6f8c7d22ca023f02c858d5f0fd2ed0b856ea03582e01d

SHA512
51d9b4d16381c1520e16cb33dd92c3e402fd0a5123ed55f642f31fc22f05ab9f51a5cbe75464b2ad993d06f3ba7d0e077b647f61f1a634ba3bc9fc1a969a60c3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\A3028567A2F61320B2F6ADEE86C14C79696A5917

Filesize
174KB

MD5
a51e26a1660b0b1e9798c311b61850b4

SHA1
c3aac133fab1ed2884461dd0683b74788f3f7c9c

SHA256
0c5a03050c4787834511e54aa90195e08f559d2be35582ba7737735256c7a80d

SHA512
de52cec5c31fd22c8ef6085b415590c378e6afbe8ad9dceac9f1fc1929760fe14558a328b22a2188ed94b1e4fb9baf99b5e6815271dcfda619d8ba8992296261

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\AE04E0BC8EEB702C7E22D403DE96ADF18FA97FB4

Filesize
45KB

MD5
6966990d14c0130ae56a19f7c295e08e

SHA1
9ed225de7e0d27c5fe9fc732e58b4dbb23530d47

SHA256
77c1b6a85f967dc050d4b60fb65598df0ef828904a1127ec88593fe5c2ea75bb

SHA512
db0951b2a07af755629a49780ba77da00c43b1873696a727a7cc600fb592078c9d1f80662508a059071cfb8ccdbb4a5da2ec3b4c87e3a0db362d101eb5ff1312

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\AE1BE5C60797ED13E5FD86423A082A53DD4BFD63

Filesize
51KB

MD5
4af5221db3ec14bc70b18f6f26bc6e83

SHA1
898d9a34d34e6f352cf1cc7dbcc4dc0405de666a

SHA256
e16d974e1c29d44b4689e22c9f9b373eba7344828caaba605e97aed2ad0ad169

SHA512
e6ffcbed0e085b959dc738ddcb6aa3f79d350aa365810758527219b0de787b38fb19ca2cf4f4de31170ed37ad4dd9fc0b81472b9163e74f1011f3f79dc33cfd6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\B514093AD97EB137639E70982E6CC2877881F842

Filesize
33KB

MD5
976af62e7d6516babeca8c562cf45238

SHA1
715eb42fc2417edf57847e45d44c673cabd074b6

SHA256
f72a1935e5962652b4f6ddfbfade69d6c44d5c5662653ff10247178560d133bc

SHA512
e7fc37e43c36d6c0d08f1e8443152f81ab98bb73d48ede7f90345c5a75b6562a596ca2fea42a047ff627386a6f432bfe5d5febc88b3f4957b83757ce031e7d05

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\C5D65487C05B7F29E797CA17C7A72CE082475581

Filesize
87KB

MD5
b49fbd964dfba40958d4dec08d7859a8

SHA1
e673da020114706012974c45395db50de7f0a76a

SHA256
4b8d1ff41a033451410cafa75495cf808951ead8f15d500319b78c19d77a3d50

SHA512
e54accd1630eacc1aa6485f5e3be22e2ba4ad086c13dcd185ba013d15a03649abb6b0c8366b81ee58d9052dd6e92bc354f0dcb36718eedad3d672588ce16c168

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\C8A7726B96F1A9F5164E1E3797C8D8C2C2672193

Filesize
86KB

MD5
66259d1cd44763cb2c183b7655d8b08f

SHA1
8dc0efcf4d2ca177f5ec091bde7aee7d49a9d857

SHA256
3f60db3d7d632b065eca28718e27c8ab89fe370ce6c6e1b01390fbc8afdd4029

SHA512
80c31885771ec2c1dd7fe858809d4ffc770dff06c392b2ce09bbd9999a53753a127a13059fd5ed13726af4656193c251fb3a76f8eb8f69008df8c7afd79d6c94

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\CAB92D6BFF12C33DC97C7A6782A7B9F26D7596BB

Filesize
35KB

MD5
965c4697563064b3102962efb6bd2dc7

SHA1
74d5055789d9cd188da2378d45278dd7885a649a

SHA256
9b66dabc347c8347bdb8c46b70840a03d63d8b6d5b18653257e5d80df4072586

SHA512
9fa9ac99c15a32e67af99e54d910efc8a416ba1f51821cd4167ee151ee0c2ac707bb51cf07f22aeab2d7d4f82b9aadd529f96101390bd1a697d7abbb44ba3794

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\CAE2200DA6CB79BB80534662D92521C46C887326

Filesize
584KB

MD5
e4c98f1c0eb1e5f00d3c711ed861a184

SHA1
f0288ad2f1dec268fde913640e15e74cd7b52f3d

SHA256
0a766c8fe7cb6adedfcd044e82f0f17c9deec03142c043c34365205b06455cc4

SHA512
4f7f5f659b76e61c2901a5366be730b70bf91438cc4c1c18b8785ca0b5f27c65368cd983b6ba1493ca0c3689255b2b49304ab77471e39755512a7d3f2ba7562f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\D9F5C7680FAE30621CEA44047D7237D4ED0D5122

Filesize
76KB

MD5
4653337e90e16bded4e496ec2a518ef3

SHA1
92413e0fd2c9a548e10f7936698d3abd9be1bd27

SHA256
6459d50e787d5d43ee3708fbe925aa95d902383f667439d40be4d0483ed7c72b

SHA512
330d9e4f33cd78dd399e0e539b84beeba27177970099caa3a7631b59a33d5379f9f8e3e7e92a8c58c3ea8715e6c7bb1a26c5124db1ab08c4aa3f10b6643fbba1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\DC6CB4D23713E5F558FEB0D8FBE338CC7797A724

Filesize
35KB

MD5
5f074bf131fbf950a08093a09ae626ae

SHA1
2db9fd0e13635529b46c84f9599af5cbf202ac85

SHA256
6a9217460fec5f1eb2d668c046af47ec53405b3bf645dda6da56e5239577a0cb

SHA512
c8216f246c4e69de893e55130df28a2defb1b3f2c80d28452b58b3703ce69436820dfc0142765479b75abeb218f37632d68a67149f1e779580fc6b9c3d4cd50b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\DE46EE04856B06593A3188BEC9AD0D09C978916B

Filesize
71KB

MD5
c40c2083d81b53dc9c467a9951f9d3c9

SHA1
12576ce282316b1c4c0cf91b6f0784fed2b5149e

SHA256
fa15fd92f26ead837cb445a3c803ad2f7588c282ffb591bfbf68aa47d7de7442

SHA512
927f517659b1e0e0ab3ae3277fa5d1d144704ffed70b901acdf9124c774b6c76786abb91e5ba85f25ed8aeb09099dfd13db23bc02d48e949dcb30a84b70d4bb3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\E530552157B408FA1285AF8C6D7A3C803A79C692

Filesize
77KB

MD5
b15c8022ab8a57c34443db9b19d34a62

SHA1
84f1938048cd79aaff755822b8b6232a2f62a4e7

SHA256
1779d4a102c2775a56bff26a2e23db0f446b98c987af3dab46f2b3643c5f0720

SHA512
d2e7bb1dab61a388319a9921391ec17e18c9a832ef918d84f7b72d04d4340aeccefb822a0e6f54beb967981cbaed53e3e4114fbd3424aa8ce89b52cceff1db84

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\E85384A570E3A2E8F7BD3026AAF93084D494DB5F

Filesize
24KB

MD5
1030ab13e8763ebcc3e2162c265e41bc

SHA1
7c126aac94a700897a6a5109be12af8e81e99a07

SHA256
1e6bb8d1692b5b9bb5f6786bb151022f3366fedf754ad3e08cd6d9d69e06492f

SHA512
6d0e79dbf6810e1fba328bc1008092ee2832e19f60e351e8b079fadf219a101e7ac65239bae0e680964feb264142003ff9920b9cc53c481c5a3f55113311f690

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\EE715477A6CC541A25A9EF2025F6E2391D8F1774

Filesize
46KB

MD5
6c40c422e583413974c62362e07c6748

SHA1
f7ae261dd9fb56699609a38cfdc39b56bb1e21bb

SHA256
ada146a9596bbddb4558c835ba13a92f58299f0452f693fa645cc13cfbc3daca

SHA512
da3e717863681a14168c6b68d12fc95d0b86a17f4b908932b0bebeb828b23c14fb5dd70147af0dfb6a5c1247d90373e499485f0bcea820f717d7dc1b04fd50ab

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\EF4422CC941F4431132E2AF09164F0235D986001

Filesize
125KB

MD5
90697270ff1c65effcc90d823d0a0afb

SHA1
191bdd644087dbbd698b3c7dfc67ce68651112ff

SHA256
c6e494107cdab958aab8e3c2ff8f2b1884a6e3c8558d1aaf0bc0131dc16d826e

SHA512
1f4bebf7952fd31f87ea6c00a61d689ed12c842fb868ebb0a824f8d6e179355bcd3f8eb1b5e70da60d62500b893c821e875cf17aa6d1b41af268e9e521f3307a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\F1C49281349CA1EDCC1827D26710CF46014642CC

Filesize
109KB

MD5
f9893daf7fe652daabb71604753e3bc9

SHA1
04fae1c7907686b1beaa4636d15e3d4abebe07a9

SHA256
cc2528f2f22948642aa0d219a9c7ef7ec328f46232973555c3ba05c578152b8a

SHA512
80691b24d7c2355aa9e7df9e7fea47647f7e9fa037b21a3805128470178963c4a44ce107e4e94b15be161865bd4de355fe45e4cf66b98cb5c899f6af6c091fc4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\F730D11495533A63F19CF13DD76E564F0829AFB9

Filesize
63KB

MD5
de37216abed0968facb627c0c126601e

SHA1
38ee8f7b8bcd3182d6b0ba65ecfa1266317f4695

SHA256
da7089ce477130a2ee5385eb469e82c0d91ccaeb8589a0e4110e4e5afbcca9bc

SHA512
9fc0d79c3cec9f15a605493cb3a7977e0b46d5c9fac6d1e7fc2d70933c90a104f92b02794c7eaf104fd56a27dbf6b26a089f2d2d6b20c2f14527979dc7a93f87

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\F8206F3DA430A4D1AB95F056F60E5B6831C3A2B7

Filesize
38KB

MD5
9d96a893341cc07c049c072db89bd871

SHA1
da17a64f7f77445dd0dfb4efda0ae8f46c3f551c

SHA256
46552936c33d4a766a4fd0a63396ce20dfa877fbcb691f5c09a172ae2b6e7e65

SHA512
ac6142307be5042c434940b4789ce401fbbb5c4299a5281983b7b952eee773ad767c152077fc4281121e8fbb1e663d07f00eb2a52807426b2a59ce0c3af0e96d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\cache2\entries\FAF7831283380F406773DEB9DBB542CE25BEBDF3

Filesize
72KB

MD5
89cffdb6b3fd65e7947449ac0beecccd

SHA1
7520ff75cae602be07ca16ef43c0f3cca7e67466

SHA256
478430aa185871d10710f25d0a872bc26705fa4b7f6158a1429739d496b4275d

SHA512
0c451c6a17ac8a24adf09eb1b9dfce1604e25c3755ee2b017da4c45c428281ae67aaf513bdd0710843440a66ad3c97eb492159b3dca709e6b61057bb9827a2c5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\jumpListCache\AI7ERT_zFRP0OJPLp6oxyA==.ico

Filesize
25KB

MD5
6b120367fa9e50d6f91f30601ee58bb3

SHA1
9a32726e2496f78ef54f91954836b31b9a0faa50

SHA256
92c62d192e956e966fd01a0c1f721d241b9b6f256b308a2be06187a7b925f9e0

SHA512
c8d55a2c10a2ef484dedded911b8f3c2f5ecb996be6f6f425c5bd4b4f53eb620a2baccd48bac1915a81da9a792971d95ff36c3f216075d93e5fd7a462ecd784f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
6.5MB

MD5
2114f980ffba28361b94bf4701796b70

SHA1
aa4a746e01e21bc56f483a04ca433485ce3e7fbd

SHA256
11bb6778806df37ea2aaef3256daa4643a75bab67aef0b03d0802fe34d3a0774

SHA512
0110d08cdb580395442fd04c82331f66b33d5673703e8e360f2c4030743d5bdc5423f4bc12f3c3e1f22b0f1ed9e3071e9d5c10a59463a45621646312903ed468

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
7KB

MD5
3fd875ede822d17b51b614639609f722

SHA1
f5b5f32971d96e84ef9efac9fc2f455690b162c7

SHA256
b328d23d628904662cd9b69591ce60ee7055433e6b1554a8131044a2669aefe8

SHA512
4309b08ed2b3d2b3fe98ed7f2a3e5209dae95fa3619ce1dab051f865477cbe9c5b87de077d1864d9ea1ab2e874a40986134348f4ca6ba439dcb3f9c6a5f95c24

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
21KB

MD5
8b9661e732ef846a0211b4fe2b567166

SHA1
2f818946f936e8577e7786ca57b7d6bcfe137719

SHA256
a3d2814d55951b8b0c2555bf1afc3888f5928230e55a06e14f08878f89733f5d

SHA512
5539086b1324677131f5ba7bc64ee9f5bcbd2acd0ed6610e0003f143141b1bf671104dddadf2ceb338bfdf0d7fedeea5c68f353bfbd0a3185faea19786ca096d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
3d84e66a477dbf6d1ad0d94b1468d1b7

SHA1
1aee553bb2014e19575aa11e29dd25833b56712e

SHA256
318cba716864d0a96b43247dddcc2af2c0dcc927f93b0d28a54ed9621f01e45d

SHA512
2708973b479918ef2478c5fc10a394aba72cf2d62e7895c1a1cab2ea280ebb7dcb139f2365cf95b09d11ab28002210e42d0a7d3dc0a6c89cd2a1b7b1c3fdd49d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
19a61d3b2010777556e07f2bc4637784

SHA1
2be91405894445a243a94d270b2639ab9a3f1f4a

SHA256
8b0b96d6b775566dcb483159c98f97f47fe3f604594657972adee65a4b592439

SHA512
6d0c03d0a4134e63b3ae81d174b75672582046fb05bb789f56fb71b023ea62a559701c13420836c8d048c56003f0141d8cbcf38e46cd85ed4921e20078a5506b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\datareporting\glean\pending_pings\44a833d0-8c89-4079-b5f7-6bac90405708

Filesize
11KB

MD5
e8e5185d7b3db66a8d1a93ec8c47af14

SHA1
e614010530194dbf38f2f60a0d2eb4d8b47e1354

SHA256
16566de8b22be9d09277577010d6531e4456848e6dc3a438bf3a48aad3d04335

SHA512
eeef7b54c09657cf84878a5c4b4bd47e7e09d9d18a6aea15e7ff682b6a347732d49d490cb7fa533c881c465653c81890e9d902e80892686e8b611798270ed9d7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\datareporting\glean\pending_pings\d6f12080-1049-462c-a985-fa527ceea7b8

Filesize
746B

MD5
4c1180208f3c166033164973b1bbf6d7

SHA1
e4a23b81d7bfc9248d70751eabad841ca264731c

SHA256
6fc211935ae3e74c106134d473ba80ad0813a534468b330fc1bf4de52320c822

SHA512
29a66006246d3e0acba00e9ce1068c2c1ae1f666c00998486c50a3c815fb257d553212ad477fbc88746341efe659fc982f9695f7656d94c2671612e74de99d2e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\prefs-1.js

Filesize
6KB

MD5
a7da1d01578aa6770eeb2e0c06f1a7c2

SHA1
95df1afcd6e17085ee0388bb3c60f184046c210f

SHA256
3ce079afd56649d22fea9b82f396a9f026e3d092cfc154c6796db3848d5569a5

SHA512
72d01189dc9cd7f7138252e59d3b098f7144252aa1a02d39943c12d71b63a83f7841895308cdfc467a2e3c5945063f50ed09b5277fe7cd181731a7de973a673d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\prefs-1.js

Filesize
6KB

MD5
b12a4bc1ce49a19dffa0a95a33215c28

SHA1
10fff2d846f5492e19c9251fad14648ce7fa32cf

SHA256
9561bfbcadc0bf84123ff36ac323dde250a2880cb3caacc359651fc07d7865c0

SHA512
efde90ed5aa9b1bb6818b5cd8571fb2d57b872b0290de822b7c7719ef11e3aa898eeee57f4107a5cdc54db8e0073c55d00a1fa67b775335f79e16fd1a6c5937f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\prefs-1.js

Filesize
6KB

MD5
f12e8a2a2d2967f93b5febf79f439d14

SHA1
b726433f2fea7815d24d56083f93bbf0875ad816

SHA256
0254822f5c89d0f285401272ee226908af8019b40f6c9632aaaf4128c024edc4

SHA512
b511956f2f8bb4f7cb3bb55623095d2f28f61b954492465bec188f95e7ceee3f8d1e35f9419867a39fb53306db99b0e642f98d858c9367d24859a272ba0e0efb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\prefs.js

Filesize
7KB

MD5
c15f6bd61ed208be52ec82b9788aa7a4

SHA1
38e404a1cd325ca0824162385c8bc42483142cdb

SHA256
947afee3c03db0a69947ea7e3bd27c3ed2d52683d328b4b1703b3d9337462b89

SHA512
f1995040f262bfd9b85636a3fe3fad3d0f4b5ca455062cb798c203d0e8d32020c2ce56e5f02927a412b3b8682645d445d5ede88820e4369811c44914cb099fba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\prefs.js

Filesize
7KB

MD5
7e0b762044fdfe99c5b7c7645eaa7cc8

SHA1
53349b8c7d490d525d79da25fcaae70a3a31ca24

SHA256
46de61edad1b4844a3af9b766674a66dc0a0f02c6eefcddfeedc9cfd443d3f42

SHA512
26b436b4e8b2259eb04e252cc824967146129c7a4dcdc83f4c6a20e9918f2d8c31dde9792369755ae143fd6bf34bb7a05ab500161b4f1fe5e756eef5e9c55c77

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
41390deca91ad78dc6f48ae506690be9

SHA1
fd474a64c7ba7bf2f6c1a4b8477400a328d7dad0

SHA256
069faf242fc6e8027500189415d7c7757cd68bde0a5be1d76f572ada538ffb2e

SHA512
7e22d5090cfeb8469a75f049a0d3e9e8dd9a3d257284f3c331583993ef4a2a56973a080d322befcbd66a58b4d6b271476ab9231740dd62d37a3ef4f070e6ac7f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
20f501f7666cc032a2aeb6613147fbe5

SHA1
5ece68d8da4d8b47ce0bd73030cc7d8637553ea9

SHA256
71ec5bd0d1505adf212daaf8e571455a95afdd691082428fb90eeaacab0c4ce0

SHA512
ba29835191d8cefed35cf163c177ff075b8e71b9e6d806db24ccf6547f4b152a8878eff9d704904d4b7314e5da75b29463948971327e51cfe762d15bc846ff0b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
fe93f67cfc8cfa444bfb38e5e602bfa2

SHA1
3723d6892292c39ec5092796319ae8c87f4f4e4b

SHA256
e024f38c98beabd768dbed81125bf4e626a75b23a88c6b122d6ae7d48584f42b

SHA512
1b6c578540603346931951c46803a4d378d9c2dbdb4d19345185efea012067a226cc628a7b8b1288d79b76d9854e42945de98e447d58977f33a2fc85d4a21ec2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
80b7d7380c32987173344a709d3b60e8

SHA1
ec23aea34764b9309d5f99b173e201328eac0581

SHA256
40196f924c7638d48370bdcc0039351ed4454b3dc3a168ca17da8017b1d19697

SHA512
7099dac870acdefb7402b31391da42047ce4b706f87c29aea28a5825f6c9520f8fa6092ca02a6b2cd1cdbc47c32ce7cb3487b71f419df156c5b48a6dae6c9254

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
7dc2bdf918476dac57111b4fbf94a7a0

SHA1
2294b573e363ba9af37562c4c401605222676385

SHA256
6a77a82ac54b8769986ea0e453065ab9e4da7d096411bf0ecf72461522b93652

SHA512
dd0aac32ff46744e080af1477798fe29e0e61f6eab53cabef55480f8f6a78bddf6fb2d65812b9721e51e0ea0f26db79e59e0fd65584e828c46872e9eb040d1aa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
aa2000088634c4f1a526db39dc01bbac

SHA1
b19f62cc270459308fa79c451156ab1f95e62cc6

SHA256
d34bed2921afb11c489d5bcdfbc65741318ef2ecb8c28e8819774e366e341d15

SHA512
5b151a5dcb0e4132bc34e489c5eb79d5daa43dee10dbb1d324ba32038571df8fefb22f68966551b6d10260f8d952c9e51a22bc219411b675408e704a44d71ada

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
b930558f261536e9b1dd49036a3e342f

SHA1
2288069e29497f9402884f92e9ec485b877c1ad3

SHA256
94d52b53122903a28e2e886ac891d760400f1defef79cb6af2c369fc65eec2eb

SHA512
fd727859e0eb34287d07221d0a22537e5b980e086ad38fa5181db957ecbfd48d40ee583e8c7cee7f7159354eee5fdcceeaaf6070a0f76a567ec214cfa2f22def

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
38a6cf4b0a6391a4fe345758d21474d8

SHA1
d7b3723d9edf4cc9f2f7d782cc91f1a922e191aa

SHA256
12c412bbed7b0b3e103b8b589911fa0ae874cebd3e4f4b9df2ba12d4f3533ab0

SHA512
ff4fa6740597e4a5f63e1e177972ad8f9db6d4dac75bccdf5c69ff9c5e66ac9950bf7eface955f2939c5d5e5d8542ddc99a5b9d292421802e1dcc2505a5f84f8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
733d0bbe6577f7ae4f7a5f4b4c23f9ce

SHA1
b3a459ac6d117fa5208fdaba4b92f6ffdb33c7d2

SHA256
80dbb548a25b1b6651ecad2b63ce940b2227926f3bde0f765994301b4396cf05

SHA512
204c39830d8b504b97bdb3b150601d60b36120f951865ed76ede206ed1d99dc3f63d3b508e4532261fb61abec882386c53696b1dece41575b125520abefe8976

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
b65bc250f6c3c2db1a81318cf49d9591

SHA1
81d9079eee8ff3bd952c3587c85671d2177331d0

SHA256
1af4d6ef563bdeec48887807d030c95adf0540e64dec4012db7015d45aa72cdb

SHA512
274aa023a7d6bf4e44dce999d256eccc57fdd7173bc45ae3045bd82f48d1c3d6cfee258cca78a8939e3fd18f7331cd91de918e281b778716b622dc86080d70da

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
554fd7dd6085acafc47a4f078d22cbcf

SHA1
e80b73ed6ced50ba8a26aabf6ac34fd095a33870

SHA256
345924f58fd2c914cee9ded7316bb73a6622ddf293b1dc1725a9f3ba8e59c05b

SHA512
b914acbddfd54e55e8e1238a1a7b4076bd0020bd11f0a45b4502e8ebb8d75b032dd53a003475c0eb4de01bf0ebadeee001c5093bc30ed951fa672009c08baa70

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
09b6bd3fd7ac41dbe92cc68842d50de3

SHA1
72d51d8e3718ae4d10837e5e36e7101aa3d283d0

SHA256
a78aa376382eb031b12b16e8790946c7c5b4e6b4f8a671bb448230bc0d14a722

SHA512
29d2ca75ba3a6e6b581f1d62dcf025340ee54ad04bbbe29e6949526ef8a50461186620244c21b3562b7f9a4df47d2f0d54a06ed71b319ac85c99f84e73c050b1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
b199c7e219fb4c569c840b3cafc7d684

SHA1
c60590342fde8a64decf4c75d86e4be2e8e38bc6

SHA256
c45980d0b7e9da04f5a250c131bbc270402122239109683b1d381c3fa8e77af7

SHA512
dfb4a9a357fb5bbb2210ad850278f28cf97e2c06f99373df438f43b72b70164e3aae089567f6eef1b4256a004b75d9e24d5b588edf7d61ec2a7421270888eaa7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
0052fb998925de280c33d3a179fbfa08

SHA1
844a3fce733033845a1bbfae089fe47ba10e193f

SHA256
20393f6ffcdafeed1e7ae9f1ef5ba061a47ff7edb6e7a6232de6f9fa3bae374d

SHA512
0b5be47baa52783d732cd3dae74f5d33a921d5db527f82b0544f6f023b25b76ce5562fc3a54ddd2b5c4caf106f19d92eddaaf2c773a7b718db75110476fadc8f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
b2c12e6745ee4ba54a3e8b2f77a28fbd

SHA1
abfe99ddee61bb500d5be744be6f46f792d8ca49

SHA256
047a9f9c178b757f51eaebed343011e97cf92763021d4a0a012003fe9117881f

SHA512
40191f1c5bd2447e21ca4e44f138fef89a6b8c41dde29409766026b3615fb506c486f21e8bb37f42454a2120dee4c3ebb42ef357e4e315726453802c33bf45a9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
6807080cabff8d52b6e7cf36c40a0695

SHA1
0f56d57fa69e51633c4fc5ed5b7759e7a6dbe973

SHA256
4a38c2dac45e573ba776d994c62435fcbe4b8804938ef3045a9be303d8bf062c

SHA512
ccfb1507e64bd0f925ed4c738c49df6f6dfa2cc5405b5400c59a39ea7a8c5010f53ebbc046c6108a5c3fada566248ee4b4040a3e59f4e83c07bb67a440489cd0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
08b1a99b3a6df81d38bb4d15f0b6957b

SHA1
386354163d9228be4a8200e6cf335d63caf5f903

SHA256
f9a85c32211033d7cae1c371b7fc49376bd8c23c019d573dcc00f12e1686fd4a

SHA512
93472834153d42a3b92de2b4c1c813e6a9654589b0d8e1a372792db3aa5f663f42b12f81044b6e7b9f526be3803bdf17308aac5ffadd80135e28475d96b84db2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
c7d68ab7381a0e06d8428c47b6a7abd7

SHA1
22b2c3f77830f7dbc19a5106b8a400512f6d7f34

SHA256
7eff8f28c9937842c52b02de166c91abb6347548313394838f8cba51092fc627

SHA512
97aeed813b41cf5bf2d4883c01188d300c1373f8a2eb1810262f19ced633e89542a5a7cab6be81f0541a19a4617d8f3c6a11167403b6513669d6292e9decbcd9

Download Submit
C:\Users\Admin\Desktop\._cache_DCQPKX.exe

Filesize
32B

MD5
f6dfe6bc355a4a208266f074c95eef13

SHA1
3861ce01157afb11bae062c12361adf0f6e39735

SHA256
0536359c1bdef23d188b68ac9af4af1a3213463480c8a89dea25161503745fb0

SHA512
f1dd484eab4e86f763eaafdf55b75bfe87de7e0c3400ba2c1965ed0a075d9cfa816fa3c4b8566502198c0bda22dc02ad86786b7e91411a92237088756cd29559

Download Submit
C:\Users\Admin\Desktop\._cache_DCQPKX.exe

Filesize
48B

MD5
430ff385425455fa07972b4d37b5b528

SHA1
fe57d310b1a9712e316d2e97e076056f14bd9c2a

SHA256
462a26f798b127016e2276266a03e0b278693b95f0c3c696faff92cfc9767ebd

SHA512
44722b21129cbea44e04bac467f68e008bab190274a7ece718758cfb35e49a13f259bec06a9f86f745043a70044ca0743d373a31312460d1734fa1e3e762b879

Download Submit
C:\Users\Admin\Desktop\BackupInitialize.jpe

Filesize
445KB

MD5
6f3dbbdbd2f41ddea3a6a200b61484c9

SHA1
5dbd9b9d7f11700e28c700f957b42c788234ffe8

SHA256
0b83fe10d54a25d99908f9bd4f4c197445e1b1f19805241e2020243e938ce6d4

SHA512
57972b991585825eb81165bb3049c08d1e45239b0ba7edddf5b4f68b87bf810dbdb8054d40e4138571ca063c12e4bd85608b7e783f98faf2005950e12249aa2b

Download Submit
C:\Users\Admin\Desktop\CheckpointJoin.zip

Filesize
424KB

MD5
bbf5332adf08379fd1e831aa1363a2d9

SHA1
892d23a58db9c312d5a5afeb13fde2d7dfe83254

SHA256
f2490d68fe6e6cff47e63fa635cc67e1fb51b09d72f4b81227d49e074bd1567b

SHA512
316ae2047246bce4f735f1906558d42ce0c43f4eb9e538ff938ab81ab393ef17a225ac3c9d9a004101e17039404896b57da0fb60e3843cd5a0d88aca0711a69b

Download Submit
C:\Users\Admin\Desktop\CheckpointRename.cab

Filesize
569KB

MD5
98ac95b7e6029fe43d47454790f06471

SHA1
c6fcee468c1844e5540cfc3c586bc5bc3bc08c95

SHA256
fec4c95d217d7a8ac1f6700bd8541ac6894bc7c915a9c438280bca09d2b17f44

SHA512
8edbd77bd8bb8f6c86d518b6ffb17c827893ab283168e7436e7e56a1ebab0780bd2c5370a778d965a15ee73bd5871ecf6c4705d0d70abe46b5d6cd7d605b0d5b

Download Submit
C:\Users\Admin\Desktop\ClearMeasure.wm

Filesize
341KB

MD5
c66a5874b3f529a172c3a98ee9b8c4c8

SHA1
d79c8ed369271e70bb344ebbcf070ae393732543

SHA256
4fad9103f11a46ea6846d8981d8f538f5f9a352cd221ea2f61a004a97d0593a9

SHA512
cc2fc746762befe6b82065f0634f425f5ff97b4833afa19298ac0ed66ac7a634635961a5ebd5f6d96cd575b3a4998a659385a6aa678c06ea9aee8d751ffcf9c6

Download Submit
C:\Users\Admin\Desktop\ClearOut.vssx

Filesize
486KB

MD5
df2b4d674fcfa35ec26a5ada68c4cdbd

SHA1
44472523a2d3e89d35f7190ba2e4483761ab664b

SHA256
bd53ec6ec0ccbbb99160b7ea5ed8d9c7842e3265ee9973ea87eaa5eb080efdd0

SHA512
324e3a900f3b15fd576f0f2d85898f287dda073f4b5b1d19f5bc6e1539952ca4f33d4a6be7e6ca1071103918db3632f961d7a4e7db4ebc3430132cb2f8fbb55a

Download Submit
C:\Users\Admin\Desktop\ConvertRegister.html

Filesize
320KB

MD5
8b865dbd0d274ddd2513d5709a05e67f

SHA1
eee2f542ae4176085736818f8458e9c46184243f

SHA256
a7294321dfebca42e8aad11912a97b11069ef423c9332678ddee919742aaf225

SHA512
be5804369f99ba16bf50ac91299ac20852f290dbf1673131355c9da48f0bd083f6ab143b3ed7978d1b472434f3b64f2ca573a6e06f15aa67d222b6034d4946f9

Download Submit
C:\Users\Admin\Desktop\DisconnectSubmit.ods

Filesize
465KB

MD5
90213dc4ba7c503f044b445b896fd5d4

SHA1
225ba6ef35a187fd30c25682ba69e5c7780abd9b

SHA256
fb52cf500a76dab38b4ece768667a75cc02dc564892adde8f7a49fd8a30131f3

SHA512
3298c6810c54d2dd00d3ad6be8e501ae6833ba4636e93dfce0fd395e9f1faded60e0e076060040a18b74ce5e3562baad8462662f04401b78568da32e978623d6

Download Submit
C:\Users\Admin\Desktop\EditOut.dwg

Filesize
859KB

MD5
85a4efa527fc7b6fe3bc1d20cb1aba4e

SHA1
8829e0c1b83a7db1453bb36120dd04769c32b010

SHA256
7be5c692e608a038b1a0ae85a89dabc404e4f6065f29ca99bd940eaa7b24e131

SHA512
e63f7fa63a6c4b121c783469bf91c75379de9d65535a59f691147be9e9f256cb3382265d8ebf1826035c8a763618a76105c52f63fefbb3387f0f44bce26f67b9

Download Submit
C:\Users\Admin\Desktop\ExportDismount.gif

Filesize
610KB

MD5
93b48a9f43e3b6fb89c9781e45f61347

SHA1
d577d7f654cfa3efbffba6acdf163062648d2990

SHA256
d3e2e478a9b5200f6b33f9afd91f323e3d9bdd177a2001690a9500e8ba3ce35d

SHA512
c1d1aff0208311a18363670225c3d0b9690639ef6527241d4cb3b0461a8065c2a6f566cacf059d99e32fb78edd4d11cb955b30dfd5fbbc1158a6020d9f096c9e

Download Submit
C:\Users\Admin\Desktop\FormatUpdate.bmp

Filesize
672KB

MD5
477d50f4d405379f22065f9057983c05

SHA1
daded8ff4a32c2762a0d03f7955b5a7800223e07

SHA256
896f3a2b5ad46aca35b1d5a1c845973e73243f22473f36d847439c7bc6aeb3a2

SHA512
044ccda31db858108a9ddc61ae33c6555dc5c33ca146fefd15aa1eeeca9facb0f0d22ef5909ed6cbb7a2ac8d800a6e531bb9b01e552a194a14f58a49849d2140

Download Submit
C:\Users\Admin\Desktop\GetResolve.vb

Filesize
507KB

MD5
14b7dfcdf57cb8ebe725003dce5ad0c1

SHA1
c64e96dd97c9675c125f7e1ba2a16d6993f128a2

SHA256
e5a87e2a16cd577a5e6abae49fef1da34d35d668f4f7dc756cad954b39d1aacb

SHA512
05c6f2740ac174a510aca43512b98c8b23f899b9dab8a7b6b13bf8b38506f4becadd550fb375589c3907c4f75c184296c018f15b74865d76a4686f30eafba169

Download Submit
C:\Users\Admin\Desktop\GrantRepair.ini

Filesize
779KB

MD5
40372f91721c464c1da63c5175314ef0

SHA1
eca4d21f7de96e62d23016b100a43efe06a1683c

SHA256
889bf558dde551fb3ba1dd5b94abab391790025a5564b49917ff3b53f3d5bbc4

SHA512
cc73528d8766b3bcb6488a2763c7dbed2311d9c92e9ded636b3b4f6e07f3ffe5bf25dba3740b463cc2d8c8e1a8df827d56016bb869041e2e0a168f6c0cac4b02

Download Submit
C:\Users\Admin\Desktop\GroupSuspend.rar

Filesize
589KB

MD5
3dff7b53d16462f3deace0b975c5a034

SHA1
1053cd913846f7b1e4cf2a54b52d2f552f8d7bc6

SHA256
f03d29bf682f88f41494b150f01044cdc7a35277b929a54f1a0eb33ff236b9cc

SHA512
f64792504beba86d64f316ea982a9b591631c42c5a4854dea6bfcc137e3acc674448156663a5db6e4df2bfce99f8370a01645db6ccfd333928faa706e1ef4b05

Download Submit
C:\Users\Admin\Desktop\InvokeWrite.pcx

Filesize
644KB

MD5
1a7421f34df8edad4281cb62a9ccbae9

SHA1
375f94c973a3a684b555a80ef2e4a783d107b694

SHA256
4921de48f86a6039f46fb9c40d674cdc84332058ae7f35c0a7230472063203bd

SHA512
899f860cae83d2ae8d65d782d7e762a0fed54a7bc0970de84581c51155b9fc54fa163d51fa99c97e53ba950a16511bc43f9d60983033da7400ffcef01cacd3ac

Download Submit
C:\Users\Admin\Desktop\LimitExpand.mov

Filesize
300KB

MD5
69c30e2fb1096e51c3a6c616792a64ca

SHA1
3554741512a07fd89a639eccca6b07de75a4b517

SHA256
25583a3d5a7789e5f343b4e9f2f0639e8e29cb313090857fc7f894d516560fab

SHA512
b6f4377a44927dc5294e70998d53a18fad03277f5e370d20364dd5d1f82d8efccbcf0cb787d65f7eebee2a770885af85244f5f3ca145c6cd08dc3a71af18ee0e

Download Submit
C:\Users\Admin\Desktop\MeasureRemove.ADT

Filesize
362KB

MD5
d98da52298bc5b4fb93e1152a7c976c2

SHA1
a386d84caa352cd357b97bb19b0eb5db8e30e6c4

SHA256
5b3eec6528703ece0fdbd7f143975000303c976e12be94ae320a00e42fbcca64

SHA512
ea5ede91f4d7456aa60e2250aeb48dfc2419b5bdde540b75a78b864f12e73842f945ec20dc0fd5dc6c2b58270cae80ed01c10b8081d801dbbbe2fb681ebc390e

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
1e92c44756c914712b00616f1f4d4457

SHA1
22e010f3ef123c0da89a86c935e43a6a1bd200f6

SHA256
94ad762ca60bc505f15b4dd77572317005c3abd2e9cc3672de387954e55fc160

SHA512
db08de2418e3cc0cf6539d2b35afddf5320c237b8becedfd2873c09eb1d29f660a07a7814d3401356286c57e42512929f1e58c973305fc17fabb07149d8f9689

Download Submit
C:\Users\Admin\Desktop\OpenGet.ogg

Filesize
508KB

MD5
219151f6dc65467ad76acd329dfc92e2

SHA1
ea1d2c3655939fcca63c034b1b0f21ef20d9f572

SHA256
c5428c5ca5dc91a2fe1e1d541e292c134ac13252e33389720f7e1a214a466fb6

SHA512
d4361d08f371558a6dc15337ffbf456a7347ac89df3c0fd74b23c7635314c7f3e93c7d9584b8ab5f0f47903abe8b52b53897441ed35c6ac752e32b15a56998f6

Download Submit
C:\Users\Admin\Desktop\OpenWrite.cab

Filesize
604KB

MD5
3b2df519f02b6cec4f7a008c4aa7f2be

SHA1
9c10ea683e75c7c8a14c27723fbece74175a15a9

SHA256
c04b58aa9574a819d30b80ca57a78be3178a069f3828f266cecd3716a52d97e8

SHA512
5ae5ca4cd453c83c5c1315bdc885882991c4ca8e63821122bd1f120f0d166e36d5520657dfbfa8261a841f7ae6a0c285ed0e921c149fd4bc62876148a0599023

Download Submit
C:\Users\Admin\Desktop\OutClose.bin

Filesize
448KB

MD5
41adbba53072b9a51ed922f411553ca9

SHA1
a876909a4379353e63640d615c70fa584a81f279

SHA256
c9022850394741107ce33abac6534dea2a1674fe0e0d84b3ef8e966a1a894dcc

SHA512
792963940eab4375da47386f2e1c613b27b07dc18aaa07edea56c320aa12dbf444320011ae2bd75b9e9cae2f84709e42b69bf645ea4d82f51ec0a7358c663ac4

Download Submit
C:\Users\Admin\Desktop\RANSOMWARE2.0.txt

Filesize
30B

MD5
35e9b0d52f6c44e51fc721dd8c48d19b

SHA1
bd2dbf5e8c9b8394eab5b70e920465dcfd99472d

SHA256
55aff57e7d5a533ccaade52f02d791d1a5f422a9fc4bc5d41b418739aded8b0a

SHA512
13859c79427ba01d8f66a9d6306fddd0e660ea06909ab6223ccb0539bfbac2722544add360336d4ace7832948f9703ebf4eb6ecd9c0060588e70cd64d344c1fa

Download Submit
C:\Users\Admin\Desktop\ReadConfirm.lock

Filesize
461KB

MD5
17f97b5126c4ae3e28e9b95db13a37cf

SHA1
5d14d9ed9863253a9cc73b4dade59d39e75a4674

SHA256
e5917300ef21aedb911e8b32b900d28b0a5bc4a47f800e2c9254abf84fdf368c

SHA512
510a510f81e3ccf3ea2a6582602b7842599e470aa665fd3f88a8dba66f55bcac93baefe3d95371aa0b81a74ee1f378633e78831df1ac1fe3d92c50cd0a1f7455

Download Submit
C:\Users\Admin\Desktop\ReceiveDeny.edrwx

Filesize
403KB

MD5
c0e1c93e4785f4d3cba608a794256bf6

SHA1
39d6fbd720622df032d819733c4dae1b43cdb08b

SHA256
3345e2507b5975bbf04bcf72c0d347f86bb3d3e3f43b143dc691b5cbb36aa35b

SHA512
c3097c9e7ccd57c9fe53bc8f36efd191cd9acfa386677b3e5a83a0afa5439744c54de3869f48aa864d0048142934a110062676ea4f1884a71b2f3f3406777177

Download Submit
C:\Users\Admin\Desktop\ReceiveDeny.mpa

Filesize
319KB

MD5
41850d7d04643be8cdeeb290e178d22e

SHA1
995c2d82f81dccd4870a66d3eb4e76f6e9a0cf74

SHA256
a8bc9f468c1c077402e4768b31ed101cb3aa62baa9c17babf88ee1d8b0240dad

SHA512
78e92f546a480fc2b5a1e00d075e165f0092d6a2f5debe62d986b24c23ea20fc116b2a6e65bdfbc622c18444b3d33762701bda769b7ca04bfc133b4ec878d9b9

Download Submit
C:\Users\Admin\Desktop\RedoUnlock.eps

Filesize
184KB

MD5
a9259d1dc248784a0fc2ea130545e670

SHA1
a5c391a6f16d55a4aaeaa27e6324da0624dca4af

SHA256
4fe4cdb15d700fda2309249b534f7d8806c847d75a9de72ba6644a16d941e70e

SHA512
65f6b5ef086615324eeeecb0c0af3701c3f469174f870322b9940f82267bdaad47e94d8c67e668f117cd6fc447bef5d0be281425b282f1f725617a89a1310aea

Download Submit
C:\Users\Admin\Desktop\RemoveSync.ico

Filesize
187KB

MD5
4d979045e44f83a53866f13ac20672e9

SHA1
cf2120c1eaf0ff64b5de2845d3f9afd7322a7479

SHA256
c4a95438abd571bb2cc6f7d738c49b2bdf37483a5204d7ed660e0ef563a941ca

SHA512
2cb8ac9c919b2afee702eff17fb89f673b638e467ff78d15ec8bbc2e339207eae8612da439f526ea5fb11da75d5f68e7fe4c17a99a3b0804e904c02eae514bcf

Download Submit
C:\Users\Admin\Desktop\ResetPush.ppt

Filesize
133KB

MD5
77ec2df3bfe08c0b116ad3ac2bc89dda

SHA1
906e9fcd3c6439535aae7587630002962bf0108f

SHA256
fe88a034e26283e3bdc4a4c6f0f75ba3494f5d012057c677228b8ebf6118bc2c

SHA512
d9ec0a3137cb4e5f298c84274c8fd5c752d4f1097cfaa7abb7945d9454d56df1552ddbb460b06b103e320911e45059c98e714400e8619a32fdbf215767834b67

Download Submit
C:\Users\Admin\Desktop\StopAssert.pdf

Filesize
128KB

MD5
b5ed9516035ed763669140f4c2c976f6

SHA1
dcdacb642ed3b2c9b43189129242af4fe3bd8100

SHA256
34663277d5152fe4077ce2054cc259535c47451944e78835bfb073a9da9582a2

SHA512
d5a8d8e10876fdd9c5e021f602331e191c62e2d0782c6d7f0c47084dd936537dd28695ee6745af001efd6616b37ab84539f029d71dea8de36281cf21f80deaf2

Download Submit
C:\Users\Admin\Desktop\SyncConfirm.au

Filesize
73KB

MD5
c330e35ae89711fdf292da61d651a220

SHA1
e2d1d9961a26fb54f7c0fe15f55bcfa2db5af84e

SHA256
4276cc2491b22245593f6c1cef4032ac9fe6ec475a9d28a621088b9b165dbb49

SHA512
470f96fc3a94a029e797198fc3fdb11367bd0a79728dcc83bca6d156f4c658b7d8989045b0b87583f5585fa4143dc3142c0472d9edeb4f5172b0426f2c4f7033

Download Submit
C:\Users\Admin\Desktop\UnblockCopy.m4a

Filesize
104KB

MD5
f1d573137e9a797ab9ec6a3535e9373b

SHA1
9c9a0ba5726b8e6101d73ef54bb87a6f1e361d0e

SHA256
69f5325d61160630283236123e2dec5d0f4d8d972ab1c1cf2e876a4a59fd4532

SHA512
146432f0f1fe35575a4f33eb9dd109f72a408a6068ae5f4c11dbabecb270598482cc5af89f8e7b1b2353d13f1eab132de11d63f9daa1ac7ca8b3815e78715985

Download Submit
C:\Users\Admin\Desktop\UnblockEnter.mht

Filesize
72KB

MD5
49df305d322a09d3c821e753f10a9388

SHA1
01de653b78b1083b0dd858143f528978551094be

SHA256
5416b1f89f539fae30a7ade49bd7f537b07359b60591511cd4013086e1d2a29c

SHA512
095f7035b3a5591f6344d20445ade0eb5d5397ca68c24989883ed3d559192d8d30aa883b16e07a9fee04409da7c98f42f648c62628398c6a0f7f49faf8b4bb26

Download Submit
C:\Users\Admin\Downloads\BackupGroup.vst

Filesize
850KB

MD5
80204fd6d81414f2efb82f2347b5c81b

SHA1
6dbe385ddcd48caf984acffaccf8f63eb0a13d00

SHA256
c5eb11e900c6402a86a00755d655ee03d0c15dda4513ac9b70ba803eeb3062a5

SHA512
39a719292dea6979d4b9d8179097cf2e364b77c88e60ef0d7e3ab70c0f8a31b8e70060f334562bd435e70d60aa311674b7c6009e0184f23c2adca4fb262c549b

Download Submit
C:\Users\Admin\Downloads\CompleteShow.pub

Filesize
779KB

MD5
f673bbae3787d14cf82f7f01ac0d656b

SHA1
3cf3a9797f3213a478d7925c85298937644dec49

SHA256
aab827391f77b2101e920f49031bb37a6a63638b05223d8de25b5658768c0a53

SHA512
794c68dd370b30a317b3af18c2ca1f17b70562fa94e7b400ea8036d3fb1bb815deb925f94d173219500027ead195686264e21ddc7e6ff5d2967087d82d883cb7

Download Submit
C:\Users\Admin\Downloads\DisconnectCompress.bat

Filesize
744KB

MD5
7242c27584a2b4f37ff2f5f19d6a7a97

SHA1
5dd98ce506511e9effdcee945406bfa6d111ba97

SHA256
aed2033de2aad5be730b5378f538ced91cb3b8a930f131f4ad17262b571a83fa

SHA512
3e71e8724b248cc0858911d4e5a04322351be21311d6a5f679fcf4648b1af607b7bca972f464c9565e0a41e9bfc82eeceae6f1087116c16af0d84b04744d6e76

Download Submit
C:\Users\Admin\Downloads\ExpandSend.aifc

Filesize
690KB

MD5
ac5befdb4cd4865ce47a34fe451ee72f

SHA1
e2965625c880976a9f1c345a76221055364091db

SHA256
877f7bb8546956f9471d75f4eb143b491819736fe934482094517e527fb59eb0

SHA512
f949ec54ab926b76f0bd313dfc8d53551ce258a1616aef98314c4d51bc8b18f80c4f3a313af66a32ab8200d82673a00e6d7f5e6cfe26fc43e2936c4301e84492

Download Submit
C:\Users\Admin\Downloads\FindFormat.mpeg3

Filesize
602KB

MD5
f6a76d51dd25d4b2bc27f190d2cf9cfb

SHA1
7462bdb02b6e8998a301a6491697f00bea598e30

SHA256
6de31a04f4e5b573856453754cf2f7c4f56fbb4c179a17f4ca7638f9cf1bb109

SHA512
d1740d11763f597bd07c2b4f9e3107f30da61870c45aa4cd3255caf31dc0f465932399123f7442cfeae5e77f2d4fda35f0d07709bfbe158e76c6292519db0b20

Download Submit
C:\Users\Admin\Downloads\FormatCopy.jpeg

Filesize
354KB

MD5
fefaea1315b7b6020ff344444d63b0ae

SHA1
f68bd7b923e447e37ca9a92c1aa5ccc6f816b963

SHA256
b13aa0e27d3a681a747a898641f0a36084323ff1b4e71f91497f3f85bfd01922

SHA512
3a7486693e3ef070002f6afcb1eafc36ed9f9f9e2b7de37b128c3b27c8e2dca338f7e8da1f392b6d047fabe067c153631fbea634ad0b8228d9d6c3ebb8b09a31

Download Submit
C:\Users\Admin\Downloads\InvokeSet.otf

Filesize
566KB

MD5
1018bc64a74badab70fc427cf2d8db0c

SHA1
c76bcedec33df75f14916f5be775ebf78ca4d796

SHA256
cc80e6192c239faa90a61301fa47bcf1a6e2dab7f156c3b8ef36862dea5d82cb

SHA512
d484cf18d57aff13f26ad4999d2d50caeefc61dc461664fb342b7c8b16a8b0b805bfc947ab9edc27bf9c602e6b1f8acbb3bbc6a472404d6a121fe9cc384cd7eb

Download Submit
C:\Users\Admin\Downloads\LimitPublish.vsdm

Filesize
318KB

MD5
ffdbb0b11f3fc22922c0734f63199c7e

SHA1
25f39969ecc0e86ed70c30e2c15e507241712917

SHA256
9068728793bfdfd7273436c2dc12bd966979120fbb0b3024979946cdddc47994

SHA512
84d68d4f7e259c50f7509d19a5609dfcc302af9884fb3ee23d8dd0a92bd224f4f4a5a710b265aab5538e5fa6bd0859266ea43ae17e4d2de03d8e71a844a32dd2

Download Submit
C:\Users\Admin\Downloads\OutInitialize.ppsm

Filesize
531KB

MD5
0839c74a3d0e88551dc2f9808b9aaa27

SHA1
2d1c1972e43852a64cebcc23001c6f8699317c9b

SHA256
408b15e5d0495c30ee8d0abd990dc2302bcf1bbce673a662b01ec4f87bb4b8bf

SHA512
459749e1eb210c2b8cfc33eff6be49c32cfd2de916938f0fe80658ebc7ce5852c2588b9cdd50aa7426719e9f1a39647fba9d44955a4378540b887255a2c4edbf

Download Submit
C:\Users\Admin\Downloads\OutSave.ods

Filesize
513KB

MD5
ac5ab543533bf21e55d1959e45998d4c

SHA1
a02f4304558f5048936e1c464a076eb7e230b6d3

SHA256
ef3d5423293aea853e93ec6d51ed6f07e9b57f30691f257354f7556077cc5927

SHA512
a3533d5ae7dca501a0a906bf4d00ab24148dfb5722065b9b472e82f3491b1ab853d1b96703e6e22b5893c25afebc2830a58d35266b028ba58458877b922924aa

Download Submit
C:\Users\Admin\Downloads\Ransomware2.0_by_clutter_tech-master.zip

Filesize
20KB

MD5
a7f8452b18722e9ad01102ea6f2a49b4

SHA1
586a8b0ddfdda42d1adf5827727323b90d847073

SHA256
0223498b312f6bdffc56a3a821408ba1e8199898e2ba89f581b3c028c4dc451b

SHA512
52953b338f98ddaac71111f01724b5eced0ee3260eb310a3dbda3792a568aff3400564ad354af0658f970f1d8f1963cdca200c6613ea64940caa1b01cf5b49c4

Download Submit
C:\Users\Admin\Downloads\Ransomware2.r9XSHvut.0_by_clutter_tech-master.zip.part

Filesize
20KB

MD5
0975e7e329250970650534cc8e0e3645

SHA1
517ed3bcc3b40edc58c3d597ec9d1f19e9cc652d

SHA256
0ba041043ccfb916de192dfdf3321c5095ad13980d2a89e034cd00c687fbeac7

SHA512
faf7410097822e1c665efe3568de88cdbefe5b107fabd467a3e81247d099f2f06548dbb3ef6046b8119742c5e94823bdec8226afed2e70e6ff283efaddfae67c

Download Submit
C:\Users\Admin\Downloads\Worm-Locker2.0-main.zip

Filesize
205KB

MD5
8dda3e6938ccfaf371698d0d2b6d1572

SHA1
878fa8b0a7911d38044c566bda217df6ff7b806e

SHA256
54c6f54963e42d39ed43381071cfdc27542db14ebf79721dbea091032f2e6a5e

SHA512
7aae33323f82afa0ebc7dbc8b84773d7ac0f6683eb89871b72cd9f9c8ae6f3658acf6f6ec82b7d2d9fe63ec5f2963d05f8960729ca255b30d502f3a4b3655692

Download Submit
C:\Users\Admin\Downloads\Worm-Locker2.d2_Vc2QM.0-main.zip.part

Filesize
205KB

MD5
bf5d1f6a5b53e99a6385c366ae087971

SHA1
5aa1353022c7fdd9409ae232582a771eb5d88d28

SHA256
0e8939de91339adc88758dfe8fd769d9983e68901661bd805747e3c1686bd027

SHA512
a5989da5cec1a6d1677ed0198269aa9e8f9497322977a46110a5dbf03ee130c79a6003ece3799cb0dc9b66fba2083a1793b392553975830f94397cf415618a38

Download Submit
C:\Users\Admin\Downloads\worm_tool.sys

Filesize
9B

MD5
5031e9989ae1ab3ba509b7d4220c0ddf

SHA1
d92342976d720ff38cf5dcb329be41959ab1ba6c

SHA256
954d1bb83d80bb6f6e746b28f0de3ec4c4ed980cfe67ed23a9159cd464ff339a

SHA512
0d6c3d5051b8eaa9902f6690eed8f1e5d5ff39b9c32b5a9f9fbeda24791117b73b19627f5ff7c5efd1748f9c677005322e908e1cb651492c4dfa6998ba04c02f

Download Submit
C:\Windows\System32\LogonUIinf.exe

Filesize
56KB

MD5
31618202eb911f6606405d237e098ad0

SHA1
829365de595b00bd4ea5bf83a1f344f5288c100d

SHA256
7944285565408818fae6f861d45d7a722f5ac630da98fb762826f061831e46f4

SHA512
db157b67c9b5f966d3ada70ec77cd735f59ef595e786377c6fb2a8b487a69fc77f828897a97b537f6e296bfbe670686ebe4f4d521295a2edd6fc07f6809214ca

Download Submit
C:\Windows\System32\LogonUItrue.exe

Filesize
13KB

MD5
893144fe49aa16124b5bd3034e79bbc6

SHA1
fbf39a288fc46cbf0620cfd297395a8fb4fbcdad

SHA256
cf01e46c146699f6c0e3dd447043f59bc9438dbbcb9563af6c60ebc6d82727f2

SHA512
c921ee3786717ac1f9e1981e35494f33d26d153afb335c52219830261f84155383d5ac9ff0ea1d7f3f6913b28c878ce6b5ea350f60ed9a9bf1ac006596fd4c68

Download Submit
C:\Windows\System32\WormLocker2.0.exe

Filesize
116KB

MD5
041aa5e99ae545dac5f9306bb20d869e

SHA1
88ea126645bfd418abba44cca4a16adf12084d2f

SHA256
830c271c8aca775457a090a51c93ad08f9665361eeeaa3fda3f9ae032202ad73

SHA512
4b8007dddd519c77bb596f6d17f270da62b236894b6fd7f1c528e553b1aac3a7f9c0df4bb40b678461f70bde3c5a8ac4b5e97e5372dd127a8184862c7f6f4c7c

Download Submit
C:\Windows\System32\ransom_voice.vbs

Filesize
397B

MD5
c1f9613622f740c2f00c2fa8881ba7ba

SHA1
bf3271720634bebb3c41ef2b33af525b62f931bc

SHA256
d200a1e942b8cfdcd8190d1ad59f92e27e39b919ba230f2dd88d70c3df428c7b

SHA512
49e00bb3c76f7e69818a889f045f3d3c43badf2116facccbbf69c61de19f91a42aee891b9a5b72a256453e2fc5c637adac1e354cf88e6782679afa886ad1c615

Download Submit
memory/1104-1470-0x00007FFB99DE0000-0x00007FFB9A8A1000-memory.dmp

Filesize
10.8MB

Download
memory/1104-1500-0x000000001B1F0000-0x000000001B200000-memory.dmp

Filesize
64KB

Download
memory/1104-1495-0x00007FFB99DE0000-0x00007FFB9A8A1000-memory.dmp

Filesize
10.8MB

Download
memory/1104-1579-0x00007FFB99DE0000-0x00007FFB9A8A1000-memory.dmp

Filesize
10.8MB

Download
memory/2168-1694-0x000000001ACA0000-0x000000001ACB0000-memory.dmp

Filesize
64KB

Download
memory/2168-1590-0x00007FFB99DE0000-0x00007FFB9A8A1000-memory.dmp

Filesize
10.8MB

Download
memory/2168-1485-0x0000000000070000-0x0000000000092000-memory.dmp

Filesize
136KB

Download
memory/2168-1487-0x000000001ACA0000-0x000000001ACB0000-memory.dmp

Filesize
64KB

Download
memory/2168-1492-0x000000001ACA0000-0x000000001ACB0000-memory.dmp

Filesize
64KB

Download
memory/2168-1714-0x000000001ACA0000-0x000000001ACB0000-memory.dmp

Filesize
64KB

Download
memory/2168-1488-0x00007FFB99DE0000-0x00007FFB9A8A1000-memory.dmp

Filesize
10.8MB

Download
memory/2168-1715-0x000000001ACA0000-0x000000001ACB0000-memory.dmp

Filesize
64KB

Download
memory/2168-1716-0x000000001ACA0000-0x000000001ACB0000-memory.dmp

Filesize
64KB

Download
memory/2168-1496-0x000000001ACA0000-0x000000001ACB0000-memory.dmp

Filesize
64KB

Download
memory/2168-1489-0x000000001ACA0000-0x000000001ACB0000-memory.dmp

Filesize
64KB

Download
memory/3040-1450-0x000000001BBD0000-0x000000001BBE0000-memory.dmp

Filesize
64KB

Download
memory/3040-1454-0x000000001BBD0000-0x000000001BBE0000-memory.dmp

Filesize
64KB

Download
memory/3040-1453-0x000000001BBD0000-0x000000001BBE0000-memory.dmp

Filesize
64KB

Download
memory/3040-1232-0x00007FFB99DE0000-0x00007FFB9A8A1000-memory.dmp

Filesize
10.8MB

Download
memory/3040-1237-0x000000001BBD0000-0x000000001BBE0000-memory.dmp

Filesize
64KB

Download
memory/3040-1238-0x000000001BBD0000-0x000000001BBE0000-memory.dmp

Filesize
64KB

Download
memory/3040-1254-0x00007FFB99DE0000-0x00007FFB9A8A1000-memory.dmp

Filesize
10.8MB

Download
memory/3196-1580-0x00007FFB99DE0000-0x00007FFB9A8A1000-memory.dmp

Filesize
10.8MB

Download
memory/3196-1582-0x000000001B980000-0x000000001B990000-memory.dmp

Filesize
64KB

Download
memory/3196-1588-0x000000001B980000-0x000000001B990000-memory.dmp

Filesize
64KB

Download
memory/3196-1587-0x000000001B980000-0x000000001B990000-memory.dmp

Filesize
64KB

Download
memory/3196-1718-0x00007FFB99DE0000-0x00007FFB9A8A1000-memory.dmp

Filesize
10.8MB

Download
memory/3196-1591-0x000000001B980000-0x000000001B990000-memory.dmp

Filesize
64KB

Download
memory/3384-1486-0x00007FFB99DE0000-0x00007FFB9A8A1000-memory.dmp

Filesize
10.8MB

Download
memory/3384-1230-0x00007FFB99DE0000-0x00007FFB9A8A1000-memory.dmp

Filesize
10.8MB

Download
memory/3384-1220-0x0000000002570000-0x0000000002580000-memory.dmp

Filesize
64KB

Download
memory/3384-1219-0x0000000002570000-0x0000000002580000-memory.dmp

Filesize
64KB

Download
memory/3384-1213-0x00007FFB99DE0000-0x00007FFB9A8A1000-memory.dmp

Filesize
10.8MB

Download
memory/3384-1468-0x00000000003F0000-0x0000000000446000-memory.dmp

Filesize
344KB

Download
memory/3384-1469-0x00007FFB99DE0000-0x00007FFB9A8A1000-memory.dmp

Filesize
10.8MB

Download
memory/3384-1228-0x00007FFB99DE0000-0x00007FFB9A8A1000-memory.dmp

Filesize
10.8MB

Download
memory/3496-1211-0x000000001BA80000-0x000000001BA90000-memory.dmp

Filesize
64KB

Download
memory/3496-1227-0x000000001BA80000-0x000000001BA90000-memory.dmp

Filesize
64KB

Download
memory/3496-1222-0x000000001BA80000-0x000000001BA90000-memory.dmp

Filesize
64KB

Download
memory/3496-1221-0x000000001BA80000-0x000000001BA90000-memory.dmp

Filesize
64KB

Download
memory/3496-1212-0x000000001BA80000-0x000000001BA90000-memory.dmp

Filesize
64KB

Download
memory/3496-1205-0x0000000000D00000-0x0000000000D22000-memory.dmp

Filesize
136KB

Download
memory/3496-1206-0x00007FFB99DE0000-0x00007FFB9A8A1000-memory.dmp

Filesize
10.8MB

Download
memory/3496-1207-0x000000001BA80000-0x000000001BA90000-memory.dmp

Filesize
64KB

Download
memory/3496-1218-0x00007FFB99DE0000-0x00007FFB9A8A1000-memory.dmp

Filesize
10.8MB

Download