badrabbit | hxxps://github[.]com/Endermanch/MalwareDatabase

Analysis

max time kernel
300s
max time network
303s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-02-2024 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase

Score

10^/10

badrabbit mimikatz wannacry discovery persistence ransomware worm

Malware Config

Extracted

Path

C:\Users\Admin\Documents\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x000500000001c920-1085.dat	mimikatz

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD6ED.tmp	[email protected]

Executes dropped EXE 11 IoCs

pid	Process
872	Free YouTube Downloader.exe
2688	46FF.tmp
2384	Free YouTube Downloader.exe
1820	Free YouTube Downloader.exe
3192	taskdl.exe
1052	@[email protected]
784	@[email protected]
300	taskhsvc.exe
3676	taskse.exe
3692	@[email protected]
3724	taskdl.exe

Loads dropped DLL 23 IoCs

pid	Process
1212	[email protected]
1212	[email protected]
2064	[email protected]
2064	[email protected]
3340	cscript.exe
2064	[email protected]
2064	[email protected]
2676	cmd.exe
2676	cmd.exe
1052	@[email protected]
1052	@[email protected]
300	taskhsvc.exe
300	taskhsvc.exe
300	taskhsvc.exe
300	taskhsvc.exe
300	taskhsvc.exe
300	taskhsvc.exe
2064	[email protected]
2064	[email protected]
2064	[email protected]
2064	[email protected]
2064	[email protected]
2064	[email protected]

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1144	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\jfaipnfbp319 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_WannaCrypt0r.zip\\tasksche.exe\""	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
67	raw.githubusercontent.com
37	camo.githubusercontent.com
39	camo.githubusercontent.com
46	camo.githubusercontent.com
48	camo.githubusercontent.com
64	raw.githubusercontent.com
65	raw.githubusercontent.com
66	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe	[email protected]
File created	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini	[email protected]
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\46FF.tmp	rundll32.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe	[email protected]
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe	[email protected]
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe	taskmgr.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
300	2996	WerFault.exe	40

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
112	schtasks.exe
624	schtasks.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3432	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000a049ba94c0feb2ca20ef0758d3704df6508164c265b0bdd82a1a68c9cc43e826000000000e800000000200002000000021d2cd50c6aaf0cc4031c38a3fc12d48c398a5d055449cff277c2aee118def7e900000000ddfe7c1c7e90725bcc42619e86af6bd22b9061d0040b7c8a762be7d53ad0aa6ba6bf2a4fa9b7f43e29fc24e4adee8255fd44f56a07ee2a8e647164759a7eb83c67b287e89a84221fc468fb1ae19e5cb5f1af29e9790482079f03f1481da5ea239c15eb4dc0cb4f790b0e7e7fa8ea228677f720a8b382fa3d5e33fcf4f6bbe57100ce04fa4094253b32cc9ac097f79a6400000009627bf99cdaa75b04d1c1eefbc17bc97d1673dacd51f020499fd93149922ad7e84af9f3b36825465a35622fb5ed410f08c2b43a58e511e7f5a4fc8f68f6b39d4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc5000000000200000000001066000000010000200000000dfd746ae7d2e65fb66b1c2239e87da8bac855c7aaad6f105f3b6a5b5c8e004b000000000e80000000020000200000007d55f529e6ae68ebffd51ab3b7173ddbaeb2dade9e379343205c9c77f951af1320000000076eb4598cab21317d157ceeee3065fba800a1b04ba4a2d821bf60109e3fd91640000000c7db6765e103b904b1c7e4cf836219883da89550c97cc55ad16cf928ae1806a98472112119c8a57cb23916f0c857901ba9a4b18436d55efa99444945964741a8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d00b6367ca67da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{928E0A31-D3BD-11EE-85E5-5A791E92BC44} = "0"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_Classes\Local Settings	firefox.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3716	reg.exe

NTFS ADS 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\BadRabbit.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\WannaCrypt0r.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\PowerPoint.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\YouAreAnIdiot.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\FakeActivation.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Apple-iOS Alert.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2192	rundll32.exe
2192	rundll32.exe
2688	46FF.tmp
2688	46FF.tmp
2688	46FF.tmp
2688	46FF.tmp
2688	46FF.tmp
300	taskhsvc.exe
300	taskhsvc.exe
300	taskhsvc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2176	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	firefox.exe
Token: SeDebugPrivilege	2168	firefox.exe
Token: SeDebugPrivilege	2168	firefox.exe
Token: SeDebugPrivilege	2168	firefox.exe
Token: SeDebugPrivilege	2176	taskmgr.exe
Token: SeSecurityPrivilege	2176	taskmgr.exe
Token: SeTakeOwnershipPrivilege	2176	taskmgr.exe
Token: SeDebugPrivilege	2168	firefox.exe
Token: SeDebugPrivilege	2168	firefox.exe
Token: SeShutdownPrivilege	2192	rundll32.exe
Token: SeDebugPrivilege	2192	rundll32.exe
Token: SeTcbPrivilege	2192	rundll32.exe
Token: SeDebugPrivilege	2688	46FF.tmp
Token: SeDebugPrivilege	2168	firefox.exe
Token: SeBackupPrivilege	3280	vssvc.exe
Token: SeRestorePrivilege	3280	vssvc.exe
Token: SeAuditPrivilege	3280	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3472	WMIC.exe
Token: SeSecurityPrivilege	3472	WMIC.exe
Token: SeTakeOwnershipPrivilege	3472	WMIC.exe
Token: SeLoadDriverPrivilege	3472	WMIC.exe
Token: SeSystemProfilePrivilege	3472	WMIC.exe
Token: SeSystemtimePrivilege	3472	WMIC.exe
Token: SeProfSingleProcessPrivilege	3472	WMIC.exe
Token: SeIncBasePriorityPrivilege	3472	WMIC.exe
Token: SeCreatePagefilePrivilege	3472	WMIC.exe
Token: SeBackupPrivilege	3472	WMIC.exe
Token: SeRestorePrivilege	3472	WMIC.exe
Token: SeShutdownPrivilege	3472	WMIC.exe
Token: SeDebugPrivilege	3472	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3472	WMIC.exe
Token: SeRemoteShutdownPrivilege	3472	WMIC.exe
Token: SeUndockPrivilege	3472	WMIC.exe
Token: SeManageVolumePrivilege	3472	WMIC.exe
Token: 33	3472	WMIC.exe
Token: 34	3472	WMIC.exe
Token: 35	3472	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3472	WMIC.exe
Token: SeSecurityPrivilege	3472	WMIC.exe
Token: SeTakeOwnershipPrivilege	3472	WMIC.exe
Token: SeLoadDriverPrivilege	3472	WMIC.exe
Token: SeSystemProfilePrivilege	3472	WMIC.exe
Token: SeSystemtimePrivilege	3472	WMIC.exe
Token: SeProfSingleProcessPrivilege	3472	WMIC.exe
Token: SeIncBasePriorityPrivilege	3472	WMIC.exe
Token: SeCreatePagefilePrivilege	3472	WMIC.exe
Token: SeBackupPrivilege	3472	WMIC.exe
Token: SeRestorePrivilege	3472	WMIC.exe
Token: SeShutdownPrivilege	3472	WMIC.exe
Token: SeDebugPrivilege	3472	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3472	WMIC.exe
Token: SeRemoteShutdownPrivilege	3472	WMIC.exe
Token: SeUndockPrivilege	3472	WMIC.exe
Token: SeManageVolumePrivilege	3472	WMIC.exe
Token: 33	3472	WMIC.exe
Token: 34	3472	WMIC.exe
Token: 35	3472	WMIC.exe
Token: SeTcbPrivilege	3676	taskse.exe
Token: SeTcbPrivilege	3676	taskse.exe
Token: SeDebugPrivilege	2168	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2168	firefox.exe
2168	firefox.exe
2168	firefox.exe
2168	firefox.exe
2168	firefox.exe
2168	firefox.exe
872	Free YouTube Downloader.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2168	firefox.exe
2168	firefox.exe
2168	firefox.exe
2168	firefox.exe
2168	firefox.exe
872	Free YouTube Downloader.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
2168	firefox.exe
2168	firefox.exe
2168	firefox.exe
2168	firefox.exe
2168	firefox.exe
2168	firefox.exe
2168	firefox.exe
2168	firefox.exe
2168	firefox.exe
2168	firefox.exe
2168	firefox.exe
2168	firefox.exe
2092	iexplore.exe
2092	iexplore.exe
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE
2168	firefox.exe
2168	firefox.exe
2168	firefox.exe
2168	firefox.exe
2168	firefox.exe
2168	firefox.exe
1052	@[email protected]
1052	@[email protected]
784	@[email protected]
784	@[email protected]
3692	@[email protected]
3692	@[email protected]
2168	firefox.exe
2168	firefox.exe
2168	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2168	2156	firefox.exe	28
PID 2156 wrote to memory of 2168	2156	firefox.exe	28
PID 2156 wrote to memory of 2168	2156	firefox.exe	28
PID 2156 wrote to memory of 2168	2156	firefox.exe	28
PID 2156 wrote to memory of 2168	2156	firefox.exe	28
PID 2156 wrote to memory of 2168	2156	firefox.exe	28
PID 2156 wrote to memory of 2168	2156	firefox.exe	28
PID 2156 wrote to memory of 2168	2156	firefox.exe	28
PID 2156 wrote to memory of 2168	2156	firefox.exe	28
PID 2156 wrote to memory of 2168	2156	firefox.exe	28
PID 2156 wrote to memory of 2168	2156	firefox.exe	28
PID 2156 wrote to memory of 2168	2156	firefox.exe	28
PID 2168 wrote to memory of 2504	2168	firefox.exe	29
PID 2168 wrote to memory of 2504	2168	firefox.exe	29
PID 2168 wrote to memory of 2504	2168	firefox.exe	29
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 2560	2168	firefox.exe	30
PID 2168 wrote to memory of 1636	2168	firefox.exe	31
PID 2168 wrote to memory of 1636	2168	firefox.exe	31
PID 2168 wrote to memory of 1636	2168	firefox.exe	31
PID 2168 wrote to memory of 1636	2168	firefox.exe	31
PID 2168 wrote to memory of 1636	2168	firefox.exe	31

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
464	attrib.exe
3972	attrib.exe

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/Endermanch/MalwareDatabase"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/Endermanch/MalwareDatabase
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2168.0.1923898378\1853793453" -parentBuildID 20221007134813 -prefsHandle 1280 -prefMapHandle 1272 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a261c4f4-66a0-48ce-9d48-1b69edcf105a} 2168 "\\.\pipe\gecko-crash-server-pipe.2168" 1380 fcd1858 gpu
    3⤵
    PID:2504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2168.1.550836181\825040940" -parentBuildID 20221007134813 -prefsHandle 1532 -prefMapHandle 1528 -prefsLen 21610 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab5ede70-4144-4471-8ec2-e35d31ad2c37} 2168 "\\.\pipe\gecko-crash-server-pipe.2168" 1560 e73258 socket
    3⤵
    PID:2560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2168.2.1207162397\899246627" -childID 1 -isForBrowser -prefsHandle 2280 -prefMapHandle 2276 -prefsLen 21648 -prefMapSize 233444 -jsInitHandle 748 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5368062c-bc99-4a9c-b375-1c3c4ec105b5} 2168 "\\.\pipe\gecko-crash-server-pipe.2168" 2292 1a5de858 tab
    3⤵
    PID:1636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2168.3.449747352\1676695020" -childID 2 -isForBrowser -prefsHandle 1800 -prefMapHandle 2540 -prefsLen 26111 -prefMapSize 233444 -jsInitHandle 748 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc4693e4-7396-4285-8643-dbce6939c3b9} 2168 "\\.\pipe\gecko-crash-server-pipe.2168" 2672 1cc93a58 tab
    3⤵
    PID:1252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2168.4.1756027028\472882958" -childID 3 -isForBrowser -prefsHandle 3636 -prefMapHandle 3632 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 748 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c54a0c2-13ad-46a1-8089-390d3f2ec5a0} 2168 "\\.\pipe\gecko-crash-server-pipe.2168" 3648 1cc0e458 tab
    3⤵
    PID:2920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2168.5.65123071\1534147603" -childID 4 -isForBrowser -prefsHandle 3756 -prefMapHandle 3760 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 748 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {605f92c4-a54b-469b-9356-87e93f4348b4} 2168 "\\.\pipe\gecko-crash-server-pipe.2168" 3744 1ccd3358 tab
    3⤵
    PID:1372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2168.6.191291293\847868360" -childID 5 -isForBrowser -prefsHandle 3932 -prefMapHandle 3936 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 748 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1bc45e4-02a9-4f98-81a8-03e894dbfeec} 2168 "\\.\pipe\gecko-crash-server-pipe.2168" 3920 1ccd3c58 tab
    3⤵
    PID:2088

C:\Users\Admin\AppData\Local\Temp\Temp1_YouAreAnIdiot.zip\YouAreAnIdiot.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_YouAreAnIdiot.zip\YouAreAnIdiot.exe"
1⤵
PID:2996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 740
  2⤵
  - Program crash
  PID:300

C:\Users\Admin\AppData\Local\Temp\Temp1_FakeActivation.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_FakeActivation.zip\[email protected]"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
PID:1212
- C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
  "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:872

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2176

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Temp1_Apple-iOS Alert.zip\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2092
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2032

C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]"
1⤵
- Drops file in Windows directory
PID:1268
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2192
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    PID:2304
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      PID:1448
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3339918132 && exit"
    3⤵
    PID:2720
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3339918132 && exit"
      4⤵
      Creates scheduled task(s)
      PID:112
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 09:27:00
    3⤵
    PID:2876
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 09:27:00
      4⤵
      Creates scheduled task(s)
      PID:624
- - C:\Windows\46FF.tmp
    "C:\Windows\46FF.tmp" \\.\pipe\{C98A4E15-10FD-4C34-A325-5824B9729E41}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2688

C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
1⤵
- Executes dropped EXE
PID:2384

C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
1⤵
- Executes dropped EXE
PID:1820

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\[email protected]"
1⤵
- Drops startup file
- Loads dropped DLL
- Sets desktop wallpaper using registry
PID:2064
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - Views/modifies file attributes
  PID:464
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:1144
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\SysWOW64\cmd.exe
  cmd /c 128431708852245.bat
  2⤵
  PID:3280
- - C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    3⤵
    - Loads dropped DLL
    PID:3340
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - Views/modifies file attributes
  PID:3972
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
  @[email protected] co
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1052
- - C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\TaskData\Tor\taskhsvc.exe
    TaskData\Tor\taskhsvc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:300
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  - Loads dropped DLL
  PID:2676
- - C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
    @[email protected] vs
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:784
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      PID:3420
    - - C:\Windows\SysWOW64\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:3432
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3472
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3676
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - Suspicious use of SetWindowsHookEx
  PID:3692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "jfaipnfbp319" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\tasksche.exe\"" /f
  2⤵
  PID:3016
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "jfaipnfbp319" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\tasksche.exe\"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:3716
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:3724

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5671c124e836a9f450bd62cf4603ac9f

SHA1
04e45b37f12b7ff851fc39e92e9ed6dc8a91ef3e

SHA256
4ccb663e98a2111bc46c3599468dc9707a0d7c97a86b3313a12aac9fb4e3706d

SHA512
5e3624865a0f8da88c8813877627f6f0182f2b84c354e586ba97e14978be75b91bb80ce571a215a6a430c3117a9134a246a043ce93e27e6a076fd83714699ca6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8edab760d59381b55b819dae4f4fe51c

SHA1
8eea9271ce461f69cdb256f8a20a0fc29a0d482b

SHA256
cdc05e8ae52006726190876e597cdcd491a0da6efca087a5639dadf46739e21b

SHA512
e31153c910cc945d6a71f99bdd5cd707a0b40da2fbe634867b5b31d3314b23d26bf56406edf43a1cd17f46cc73fc9900b5f1a48f901ec2d11c32528748d45167

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a6ace118fa2b9b624e4fefccc024bfe

SHA1
72863925fb33048e2a4b5ecde758bffb9de1a3df

SHA256
a37fbe8c8ecc40c6a08ec0407b1433216aba8bc5ee76dc60dedf45faf4e4f8e0

SHA512
bf0d974ba61e221bf4f0750004cad666ba8833b35a514adcaca90c701299606a7358097fdea27cc9d73936b9c1dc9863c22422d5df168f672e67ceaa7d4cb799

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
006e740f005e2ba5404f25476863704c

SHA1
f0b09ae275395a749cacb8f0b57cdb9dd315f2a3

SHA256
7df527cc8349766cc1f5e929c81afad9412e439475a268640a31ba91a1011145

SHA512
2937aee96580912a33a2219e9d930e35149209d4b7e56a7193ef137a084dd3cfd494bd58e54f45f71dedb28930ea233d6050af537f663d3e355670d7f1d1a2f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d6f25d7c30ad7d84eb4ba311a64c1f1

SHA1
b9ee24cd2a83c6be2c274a3a7b35757d66b39165

SHA256
5f75728bc5dbdbe28ca6c1c773e6cf14ffb72946052b10b840cdc5bf4d05128e

SHA512
74900cbad0b384118e1bc6bd0cd46a4d0472206bb1a1814b7fbf149e6c6b2b88e564020044aaf070ddce7a76c9d1b886c2ffa33af303fdcb33a2c67deb2b3491

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18c3d96be03c7c08891bb6f5d2ad41ed

SHA1
5727dad5326282de38841dc174594fedde5cee6d

SHA256
694e300e75bcab0cd923bad1250c98a3dbce71cce1ed392a065066f90e6e3b0b

SHA512
cd75db5ae8b7e7879a85ea6e8fa3f3c330968cf26b1853dd97731195a10bd83bd97a09707ca01adadc740c141380917f11b58550ce2f7af2e49abed0a8c5e793

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
894a34e50e75e516f765d93b2cb1e549

SHA1
c039b9bc6f1d90d8b3e2aeb783f83c62e924f9f8

SHA256
dcb84a0cd03311ad006a8c1fd48a413b8abe503026104cdc42be0437b628c81e

SHA512
eb34a735ad64111d69b9ad8afa39986458e7b25fb2aac33519eeab64c03533ce63dded2d67f012b84cdc69b20a89cb71df7d922cb53c6635f3d5e0716fd0ddde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
092f0e6c3df249489ed96b48c7e45d31

SHA1
5783387a71aa2ec668a11eb4c835cad281bc8f30

SHA256
0d8d032c717df58e340061a3cc7423eeccff1fbe1bd2dbeb6a994d6287b39ce1

SHA512
be3efd473cfc8f53c252b84658e142755f0af0d165286946b43e79976dd75d6a74f6711ae2ae5996fe3524a6b0c3a9913bb907ee920235b93e1afcbd0ee1f874

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c82151ee60fb2ca53ca698d674d9e697

SHA1
ebd5c38c75f74f9991d1d1b45b0a6266e518d08f

SHA256
d9ab1457273659ae29f193460fb68c89e8ac10c1ee332f8be3aea7e9e755bbe5

SHA512
c2bd855fe64cdb5c8e09f38e670836efdfafc7ebd1cb15af964dbc4f10939e910854c19b76234f79f476b3a82949a1f6b914e3a29fea82425297d7abb82d4205

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3266a69ed18459d0d46d7cd6022f2e4

SHA1
273a1627c72019f229bb6d90538a8d379434d926

SHA256
3c6faae4022698d42bed265c61e34d31bc899ea97f581d6447f3be898aeafd9f

SHA512
7863e91242dc2518f9e176b9cad68989fc2a9e827667e5127a503f6658b952fa288792b27441eab3438a764dbf8c64fc2c0dfb944ff7e2fee096d25f4a452f1e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\u2bjtpec.default-release\cache2\doomed\20176

Filesize
14KB

MD5
9317c270ded649a0be8058bf6c3feac2

SHA1
a1a45e5c56bf90e3bff5061f920eb8a665016f98

SHA256
9bb089f5c9215ee435e733cfebe0504a24036c198b82a6bc0dc58713c47dfb2c

SHA512
118757f6118af1798a05389c1a41d8ebde3ca6e88c9cb6ab24608205bd53e8bedfb36a53b0a14f83bc705ce356d2c1e9317fa9ea7b8887953a57150057f88997

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\u2bjtpec.default-release\cache2\doomed\20400

Filesize
14KB

MD5
c20e282097a6e975f44d15d63c57e3c0

SHA1
6c9e5f45c1a94c1ccf65c40ac37d30dd131b550a

SHA256
82de8b19eb33dea726ec0ed10e27f0d8c495bd835e4fa4c7aebbe123aafb25e8

SHA512
231b7cedaeafc137352a118911b004bd57b4232baa1ef036e896b846857b2ce245e3331b1a95afb97f15bb5d28712e404252a21b3b986163fa214e5e7bf4f9b3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\u2bjtpec.default-release\cache2\doomed\20625

Filesize
14KB

MD5
9a35931271e48b118d7bc001cecd8323

SHA1
0f4b9e004a4beacfd3fa54c9924aacde59dff4c2

SHA256
33ee5d791e6515be7d19c5fb708580961a76affa4ffdaa59c291a49a85fffa5e

SHA512
a002ec91fe20624e7fc0a9d9dc925b8425f8e804cfab7d9c9faf5dd237a2af7dc2a399ea4133fb5db36685c6d4c596c1a270038ce48053368f7164c72b668afc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\u2bjtpec.default-release\cache2\entries\267DAF9500703DCF23A5DF868DCFA0F095F6F6C3

Filesize
45KB

MD5
008dedd9ceb09718adc48471868b545a

SHA1
c966ae991755530402ae44dde2d0787c04b26b3a

SHA256
aae47fb04a15ab405d1aa9aa4a9597e7c1edaba6eb1ac3ec762f07e39df1e6bc

SHA512
f6a682f9fd0b54531660f8fddc518a76422f7d02d1ff500d167ad4319d269446d43abdd4f57983f77817a386748ccf3dbd988cc90cab66502c1410e17fd5f156

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\u2bjtpec.default-release\jumpListCache\PVZCe5m+TML18TO5vqg8WA==.ico

Filesize
25KB

MD5
6b120367fa9e50d6f91f30601ee58bb3

SHA1
9a32726e2496f78ef54f91954836b31b9a0faa50

SHA256
92c62d192e956e966fd01a0c1f721d241b9b6f256b308a2be06187a7b925f9e0

SHA512
c8d55a2c10a2ef484dedded911b8f3c2f5ecb996be6f6f425c5bd4b4f53eb620a2baccd48bac1915a81da9a792971d95ff36c3f216075d93e5fd7a462ecd784f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE300.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE303.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\128431708852245.bat

Filesize
386B

MD5
4f328f9964cb23a802584c5c078ba721

SHA1
30a34d991a386e7f32b2c234ef4731d0605b9516

SHA256
3089e9cd50dc6c3486d1ce4029ef026476cf03bd10dab76a63f2d70fa1e9979a

SHA512
fc6b14db9f622f6a114b34f275c72a70b793ee7250591a43ef74ef58b8beddd9855ed12b8c499e657bef4e0918e5302cacf00a7d3e4b94ea6ef7c55243797f30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]

Filesize
1KB

MD5
f88c66942376152d19bac08760c133f3

SHA1
28ca1148b7ac32a32629941daf82e1133573bd82

SHA256
23c9563aaeb89b46f123c5aadf8995011fd0a8891b3ccb697ddba0d7fd2d1f36

SHA512
0f6768de43338c51d75934ab9870f5b6e1f44b895386b750bd0e1dfe00ff1dcac591eecc538bdfc956f29421e42b1c22856055a091838532d8c8ba8768ff5acb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\TaskData\Tor\taskhsvc.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\b.wnry

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\c.wnry

Filesize
780B

MD5
8124a611153cd3aceb85a7ac58eaa25d

SHA1
c1d5cd8774261d810dca9b6a8e478d01cd4995d6

SHA256
0ceb451c1dbefaa8231eeb462e8ce639863eb5b8ae4fa63a353eb6e86173119e

SHA512
b9c8dfb5d58c95628528cc729d2394367c5e205328645ca6ef78a3552d9ad9f824ae20611a43a6e01daaffeffdc9094f80d772620c731e4192eb0835b8ed0f17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\m.vbs

Filesize
265B

MD5
ba6f59fde07f1793125c22894197a9e5

SHA1
0e778c94464e0bdd535c7aa8693a90e0a93ae95f

SHA256
2284ebff84da9accea9c25c805a9cb5bfb1946af1313901b545fa3a321df7f98

SHA512
990e203c2f189ab5e61e76896bd19532c268074555248363266af8ea92396644c8772fd8e6d3d34209558ab9e246943aebc61df48cb660d7a50705d52f846b6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_bulgarian.wnry

Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_chinese (simplified).wnry

Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_chinese (traditional).wnry

Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_croatian.wnry

Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_czech.wnry

Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_danish.wnry

Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_dutch.wnry

Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_english.wnry

Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_filipino.wnry

Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_french.wnry

Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_german.wnry

Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_greek.wnry

Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_indonesian.wnry

Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_italian.wnry

Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_japanese.wnry

Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_korean.wnry

Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_latvian.wnry

Filesize
40KB

MD5
c33afb4ecc04ee1bcc6975bea49abe40

SHA1
fbea4f170507cde02b839527ef50b7ec74b4821f

SHA256
a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

SHA512
0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_norwegian.wnry

Filesize
36KB

MD5
ff70cc7c00951084175d12128ce02399

SHA1
75ad3b1ad4fb14813882d88e952208c648f1fd18

SHA256
cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

SHA512
f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_polish.wnry

Filesize
38KB

MD5
e79d7f2833a9c2e2553c7fe04a1b63f4

SHA1
3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

SHA256
519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

SHA512
e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_portuguese.wnry

Filesize
37KB

MD5
fa948f7d8dfb21ceddd6794f2d56b44f

SHA1
ca915fbe020caa88dd776d89632d7866f660fc7a

SHA256
bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

SHA512
0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_romanian.wnry

Filesize
50KB

MD5
313e0ececd24f4fa1504118a11bc7986

SHA1
e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

SHA256
70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

SHA512
c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_russian.wnry

Filesize
46KB

MD5
452615db2336d60af7e2057481e4cab5

SHA1
442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

SHA256
02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

SHA512
7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_slovak.wnry

Filesize
40KB

MD5
c911aba4ab1da6c28cf86338ab2ab6cc

SHA1
fee0fd58b8efe76077620d8abc7500dbfef7c5b0

SHA256
e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

SHA512
3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_spanish.wnry

Filesize
36KB

MD5
8d61648d34cba8ae9d1e2a219019add1

SHA1
2091e42fc17a0cc2f235650f7aad87abf8ba22c2

SHA256
72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

SHA512
68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_swedish.wnry

Filesize
37KB

MD5
c7a19984eb9f37198652eaf2fd1ee25c

SHA1
06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae

SHA256
146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4

SHA512
43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_turkish.wnry

Filesize
41KB

MD5
531ba6b1a5460fc9446946f91cc8c94b

SHA1
cc56978681bd546fd82d87926b5d9905c92a5803

SHA256
6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415

SHA512
ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_vietnamese.wnry

Filesize
91KB

MD5
8419be28a0dcec3f55823620922b00fa

SHA1
2e4791f9cdfca8abf345d606f313d22b36c46b92

SHA256
1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8

SHA512
8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\r.wnry

Filesize
864B

MD5
3e0020fc529b1c2a061016dd2469ba96

SHA1
c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade

SHA256
402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c

SHA512
5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\s.wnry

Filesize
2.9MB

MD5
ad4c9de7c8c40813f200ba1c2fa33083

SHA1
d1af27518d455d432b62d73c6a1497d032f6120e

SHA256
e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b

SHA512
115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\t.wnry

Filesize
64KB

MD5
5dcaac857e695a65f5c3ef1441a73a8f

SHA1
7b10aaeee05e7a1efb43d9f837e9356ad55c07dd

SHA256
97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6

SHA512
06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe

Filesize
20KB

MD5
4fef5e34143e646dbf9907c4374276f5

SHA1
47a9ad4125b6bd7c55e4e7da251e23f089407b8f

SHA256
4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79

SHA512
4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe

Filesize
20KB

MD5
8495400f199ac77853c53b5a3f278f3e

SHA1
be5d6279874da315e3080b06083757aad9b32c23

SHA256
2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d

SHA512
0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\u.wnry

Filesize
45KB

MD5
67e7369be3d9e8909ab1f6d1d13b5cbf

SHA1
a4b7cb387f96cb5438745edb808763b3acd7ccb3

SHA256
f14a4e6421dfccdb1117ec7412e68a834eaacfc6c894b2c65987ea4d7d82fdf6

SHA512
32bff6dbcb5f199c97e754f5e823865e7c22abdc43348badea0d2c62bbaf058d9df5e0da732d50d11c82fc2172f1eb1f8ebcfd780d004a27f9e2e3d747c2cb26

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Filesize
3.3MB

MD5
e58fdd8b0ce47bcb8ffd89f4499d186d

SHA1
b7e2334ac6e1ad75e3744661bb590a2d1da98b03

SHA256
283f40e9d550833bec101a24fd6fd6fbd9937ed32a51392e818ffff662a1d30a

SHA512
95b6567b373efa6aec6a9bfd7af70ded86f8c72d3e8ba75f756024817815b830f54d18143b0be6de335dd0ca0afe722f88a4684663be5a84946bd30343d43a8c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\882RPXQ2.txt

Filesize
181B

MD5
565661b8b149ec96262ac89546285434

SHA1
2bfa54d3fb26e0fd0fcff3d1bd1ead2cee23f456

SHA256
5ab1e939f90c7a24d45a2c0bc2fa8c3fee56aa4659cb94bd1afd99a5844c2042

SHA512
7acc75e9c0a4e824a8b7e2cfbe099e8107921bba4536046f3c5c4a01e02f14c0c8d9e36da3d8b6c5ee6575cbad6e52d663873ed0f482b680cd2539c8e3af053e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
14KB

MD5
d5380f2b9b835d4466d13f5a5755763f

SHA1
1a074cff5022bd487958a088ab35bb12f2c6bb76

SHA256
b3216773665955adb3b9143dff4393b89b7998ed7493567e47e1b353f9e88a53

SHA512
3ed532a14b99a47e449d6cc4b9ea95ebe3c2d7257f1ddd3b1c4667521a953d0aa7b7e0090bc44c7e994954ca9b7473d8513cbefd411f830c615f8d92ac43f4b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2bjtpec.default-release\cert9.db

Filesize
224KB

MD5
09de797c175bb441e50db944a3d0e4dd

SHA1
43398d52d312e55ac60025c57f5eec260ef8f91e

SHA256
c01343a02746ce8c7cf1af1daa3b2069ca9aa3fce47922171aaf5d916063c1c0

SHA512
9dbc9fa13d1dc6d3ef46982e2880e866bb958cb560ece4da5276b5819183b876f6ff3ee22735048a12c1933fb5816bf785d3628427390bacce63fc7255f7fde7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2bjtpec.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
9757a9d60806feaed144e0808767fad6

SHA1
c53f12e744da8883b633e8b70fbe408f9438853b

SHA256
0d70eb353bebb809fd4d0848a15decb5715ea622efaadb9877284b57cd40bedc

SHA512
54dbafcb2895f6e2dbdd82cefcbf261ff1da72c8d1b14c4715e3d99ef780ab66536cacec7ff3f1d37e446e08722f7415a00c7f211ea53fb37212d80a615cffd2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2bjtpec.default-release\datareporting\glean\pending_pings\03e66f45-6450-4b6f-95c2-6865c8b3ec54

Filesize
745B

MD5
1c437150482e0205ce1cb6a0d57fba67

SHA1
80a5839061fc097f520ec13058dbc9b638aa1c8b

SHA256
5c27808ef85ab48730224c508bbf46870e9fc985977537d680c5600bd6c9d3e3

SHA512
eb5d46d23300348ee25ed4fdd2fa8d882a8b9e7da1ab752b041a5f14981468784cc8b8c8d674618db3d2ed32f31ae7c11da14b63cce2439f92c0d9140d721878

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2bjtpec.default-release\datareporting\glean\pending_pings\cbd542b5-3ece-49e1-90f3-89a25710c060

Filesize
11KB

MD5
cb12214ccc75ecbc323dc850edee20ed

SHA1
273a6a760205f64a799c11781ceec04fb298ca7c

SHA256
71bc6690b7715ba438a67f53a28f021afd8727cdab31384926237e2807aebfa8

SHA512
3a231f22e2d50904748b3186f1f8ace03859001bb04e7c1f68b71320850a617b94ef0e33cbfb25b594e313b705ae5ebd8a9a1ba14094bacc21b54f3238745a69

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2bjtpec.default-release\prefs-1.js

Filesize
6KB

MD5
d7172d3a310bb1c99be3ae9d4e6a6858

SHA1
2c84c494faec24329b4e508138835bfbbb803182

SHA256
52605c71aae38c6c2df5702c75c6f758664a4ad2cad53b26e01ba477bf74de98

SHA512
b2b3916ce6a6ba30adbc56bc1bba7d28589e93466e6c94718d49069c4271120598ff3fd994ecbf56b33f3a8bf18441a53093fa3a1c0073ab61bc49cd3d7e4f4f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2bjtpec.default-release\prefs.js

Filesize
6KB

MD5
fbf3090e3ab07e9bb944b5ffcd5ea6a0

SHA1
e8cffce3cb6f20c0cc2a270316ef14b167cfb413

SHA256
ab0d240e2905a1e125a0db9f57abcb9eefe89e353ad93233acf7b881122686f5

SHA512
836a605e9f154cad0656fd05fab4153f4e7dc60f6582458e6becd7506ef73c398c01c5bfd67ae42950a2e132d9e015ec15ed585b4f7ee49b7e378ac4bfb4caa4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2bjtpec.default-release\prefs.js

Filesize
6KB

MD5
4b7913e2f325d3f1dbc5ee763d08d122

SHA1
b22ed6566e2394495b17aa4930d0b9a033c69487

SHA256
3bf18fadeffbfb9b12b5a260a2beeaf86d2374b6ca0e6d8ee16bfcb268ac1b3f

SHA512
41d8cd5eedb879ccd0183e7f09418078f3e2a251a9db64f005feab6f327729b8cb24c9b8d5621bc3d500155d48a560b15431509504ae6df0fce9022391a9c05e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2bjtpec.default-release\prefs.js

Filesize
6KB

MD5
e2f3bd4e337137dcd8c8435c603bdbb5

SHA1
39d995e4b6011a7d9e3ab8a403e0c289848941ee

SHA256
a4f82a26c828a41ac5ba5c7e67f38517e1954db9c4d153b04f8ef69c3f29df22

SHA512
5fe6afe9a92c1a4af6456a321b715383780f2f3fd0ba05014dc879a954ec093d705a7e5f31b6214bc8464fc29a83d89b82212305dabdc0cf8174a2253a24b293

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2bjtpec.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
a2441e3dadf0caf704f12cf916e71c61

SHA1
fe6766b232aed4f3e6f017e8aa23ea46d568f8e9

SHA256
b0a2e31b3ff196947ae6880bba647a217a55d24076036f4e3facafb76dc71b67

SHA512
22de3a0de974037443f4c3f5a7447504b7629eb997f4b0433def7b272777143f1051a4938f9d3500bb5b6b751cfc001e2e3872725d88ccc98dc4f55e236161a1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2bjtpec.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
d598eef1f05cd24f0ccea8109d94880b

SHA1
8cc4e016ec9080fdabbb36e34d161f567f8f3ee8

SHA256
84a225d8f12da77e9e4313a3d55cb25cb994cf6857bdf91908d10cf29959fc13

SHA512
626fa7f644adb8632e1970955551f1efa91e3d5a737d31b9c3f3b92407d482945cd613e19e0a947bae3771e04942926fd848583e6b1cc17e9c800b7a0607d1a5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2bjtpec.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
050295ef5573ae597a08eec1dbd2839a

SHA1
34e83087ca89508e3d1cef421771e70d3a80213f

SHA256
eb5cdb2896f6dd6af58a45fd5359c145fbb5a9f18eaabdfb405d64cad882b8bd

SHA512
fefaf270305ff108c7fdbcf3d72e35e8bb98630e3fbd6f172d8f74513eb95c5f1a468b52db5f7e3227143d35d40d76b9bc78cf344230c87d2382b4e4dde115e4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2bjtpec.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
d77be446ababf29df383f11418a41ed8

SHA1
d55e14b8eb3686bcb983c4c2fe144c6be129bb2b

SHA256
b9200ea716a1e6356bc54b1c35150874837882fa14f9aa5247eae934ec4c4f66

SHA512
e4fa0aac20b328b4fd94b1f1c8ea75a639427e26732215f3ce0788c713cf59af5f7f6a3c6ef8fd5433566434987d915205616bfc4eee011279170b10aad3db9b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2bjtpec.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
9701fdb3ad6b3c8d3a77d92a43ea526e

SHA1
9540f30a8cd86d102ae72902bcd7655921c2c4fc

SHA256
ff90683db0ffcabe7efd00460c3faa0637ef5a44dc8d4504191ac405e3410e46

SHA512
af6e0e479dee6d5760597b3b48b6cad94973a887ff536e5e39d1ad76bb1bd435a0e9c2b1fd57e4ef9a6c86ae9484099ac6b8bea15ae5eed297a8bfd248ce5707

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2bjtpec.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
62916c9b2061d2446c899a052cd06b01

SHA1
fde6b98dd4ed0f23ec26dcb6aedd33f0e0dcbbc1

SHA256
2c8494dd755740f8c3d4284fde9aba704a53ec1290b48c065186535f319ead6e

SHA512
f1dd1a2c155a4dccb790bb3461db4bfac71eaf217668c2db4a76094d202564f78491f2d8abff5dd82ebc33c6e5778e571b25d605fbf2a9ffc0b4d6d9f443de1d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2bjtpec.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
59c9e99351f9bcda10beb7d7185d8f5a

SHA1
ca6ce5a13bab0805582384f3c9cc1901e0043715

SHA256
ad2853329a0b8847b99820fcdff1e9ea29b4366a0caa7f09e084ae77bbfc7f68

SHA512
ca74499e9594beb8eb7add890a1a170028161ac45fd3d212608d130def7fe5f186d0a19e4a3566989b7a15b25a4fd342914289a6743d2c9039857a9e388f8f81

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2bjtpec.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
823c813829e11985a7aa122de829b019

SHA1
2c1f83624f5afc4538dd81ab39ba6fa8f5de6d12

SHA256
d6c60ed4f358ad85411c961bf3df5b87a20c6abb3729ee4daacfc3d4a2767ac5

SHA512
103946eb316f974901d7406451428903d11d7325dc14c609045ff688b870773216f8b22ef5452624a3ebd204f27ad17be02b45ae4422eefcdf91259c26075f84

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2bjtpec.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
26b72acb2046c07e4b62bfae31f364be

SHA1
886b34140a06ed6a0674ba7a97e074b9f745556c

SHA256
48892342d372789b84aa45f36251502de6003313b34fcc4a30fbb3e68dd9b5a0

SHA512
19fda0b2323515dde6986055c978153fe28752ce6248190444c88f691346de1f2cee74451d70a3ff04876181cf9379b885fc78b2d5d0cca538fb9a38b93dfdcb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2bjtpec.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
e1992884c1c9d6b84f71b15a269340c2

SHA1
cd3d4c5d839838612923ca3b319c9ee0988694fc

SHA256
63bd4045ab7cc3e7a71cbab4757c54eeaf0a686e714d0060344b1608c5202a37

SHA512
f305ed887a3cb8b1ed9001f3a1ebf463ef51e2fc71711e473b5e4bc58a6ca7b3fd81f3b8dc3c08c96eae24c47534733afd6db34cde18c5aca3dd7c85c513b7f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2bjtpec.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
d0a27be8a225ac1dcb7b507551274cb3

SHA1
3da934f225b47d09de49ee87cdff733c42144f50

SHA256
e4e10bf242f5f1c606f27391b4810a57f31b7a1e28e3167e239275883e6f4b13

SHA512
c3cbd9ddb451957a3921b8cfd77083dc8be84e0d8a01a1002ccf53e5168a865c487b5b051a026eb7875c00c50b2ea8aefc79bd26dacc7a0a1a7b50f9d05c139b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2bjtpec.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
c2bafa782ec09c9bbf4540139ac474a0

SHA1
4343d71feefeed9f636a7c1aed8717c93ff8acc4

SHA256
16d7cf21bde74810333b0728afedfa12637c37764d03bfacdf452dfc987360b1

SHA512
d9f6e1ae0aaa642bc40468dce661e21ee2efdab0b9d746846c37b69bea27e91c331c7f1a720d5f6f171fe6e18f5f5193cecf81de2d9e52842526aefb7ddb5de0

Download Submit
C:\Users\Admin\Documents\@[email protected]

Filesize
933B

MD5
7a2726bb6e6a79fb1d092b7f2b688af0

SHA1
b3effadce8b76aee8cd6ce2eccbb8701797468a2

SHA256
840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5

SHA512
4e107f661e6be183659fdd265e131a64cce2112d842226305f6b111d00109a970fda0b5abfb1daa9f64428e445e3b472332392435707c9aebbfe94c480c72e54

Download Submit
C:\Users\Admin\Downloads\2g9FCREZ.zip.part

Filesize
66KB

MD5
196611c89b3b180d8a638d11d50926ed

SHA1
aa98b312dc0e9d7e59bef85b704ad87dc6c582d5

SHA256
4c10d3ddeba414775ebb5af4da5b7bb17ae52a92831fe09244f63c36b2c77f34

SHA512
19d60abf83b4a4fe5701e38e0c84f9492232ceb95b267ae5859c049cea12fee2328a5d26ffd850e38307fb10cb3955b7e5e49d916856c929442d45b87071d724

Download Submit
C:\Users\Admin\Downloads\Apple-iOS Alert.zip

Filesize
24KB

MD5
7a58e11a576f59df999a40d94211290f

SHA1
ad42645c39d8e8a9e620719c503ea0c949bead01

SHA256
cbf9955466f1c62efed890382243e85e75c323cd1850d126a4beacb72ece5354

SHA512
3d0e7765b84e2ccfc598dbabba29278b88797cd46145b00034038d34bb445ce2a050772630dc0a20a7868c6aaf8e2380e313b649734d0320b12ec8fe794f7fc5

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip

Filesize
393KB

MD5
edbe7edbccee8ee488ffec30c4530c7f

SHA1
3d3ce9b3c9819bfe9cb7dd72b35fc66b8eaf687c

SHA256
216e0c4a6ab3e71d1a26d61cbf3bf264047acd514db0090a194c5293dccc10ea

SHA512
08253b77aabe3c01194bbc4652e9443545bb22750d4d6fc87e61789933569167685e02b3685a6c5f3a44776cb8aaa2d5ede1f014f42d10dcdd6c34bd03734766

Download Submit
C:\Users\Admin\Downloads\FakeActivation.zip

Filesize
275KB

MD5
1e9d6aa5cf5f137b50c3a107bcce8630

SHA1
6fc2f68bac6de18c7c8d9a26617deaa50dd17004

SHA256
970d327f64d075edf27f5cafc415d3af22ee94654d0dee3b3baf7a5965a98624

SHA512
936c0b58d32df53d170881246056816a3253aea697b40f022e9c49239a8da93b907328593cefcf62ab1ade1a441b44491061d951a4f4cc36b2186c63ba031166

Download Submit
C:\Users\Admin\Downloads\Q3wuwzT4.zip.part

Filesize
275KB

MD5
6db8a7da4e8dc527d445b7a37d02d5d6

SHA1
4fcc7cff8b49a834858d8c6016c3c6f109c9c794

SHA256
7cc43d4259f9dbe6806e1c067ebd1784eaaf56a026047d9380be944b71e5b984

SHA512
b1b4269da8a0648747c4eee7a26619b29d8d1182fe12446c780091fef205a7b5e6fb93c9b74c710cca5d2e69600579b9d470e31a32689ecc570d0c4bbe4fe718

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r.zip

Filesize
598KB

MD5
f6f7362fc82ac731020ed46b53827ef2

SHA1
5a2a0f7c15a8159b4343ee6186a77993b906c1a1

SHA256
b05a3046614d0f7645890912377990ed088ed692e02a28e6b35b961994b3fcf4

SHA512
0772098955365a18c134fd6934076b2fbe29ecce372a4bf468ac8f73501028ece534f66a9336222bbb01db40f0a968dba710a632a6925d9be0e93986919f65a5

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r.zip:Zone.Identifier

Filesize
50B

MD5
dce5191790621b5e424478ca69c47f55

SHA1
ae356a67d337afa5933e3e679e84854deeace048

SHA256
86a3e68762720abe870d1396794850220935115d3ccc8bb134ffa521244e3ef8

SHA512
a669e10b173fce667d5b369d230d5b1e89e366b05ba4e65919a7e67545dd0b1eca8bcb927f67b12fe47cbe22b0c54c54f1e03beed06379240b05b7b990c5a641

Download Submit
C:\Users\Admin\Downloads\YouAreAnIdiot.zip

Filesize
223KB

MD5
f06cad7a1a695d566a5cc8e6050629d9

SHA1
45c144856187e6577d65a16342240954e1e78dc9

SHA256
f732094755a5503f2bf751154924208fdf7903ef1099d88a1d1c298ae27bbaab

SHA512
0fbcdbf59bb759072a17c10ffb2f291a869e04d59845e566023519662ac6cec5cb13af703588a51b8369afe4fe11929608ea2c84f632717243d81f80aae5a36b

Download Submit
C:\Users\Admin\Downloads\iL-6nuM5.zip.part

Filesize
393KB

MD5
61da9939db42e2c3007ece3f163e2d06

SHA1
4bd7e9098de61adecc1bdbd1a01490994d1905fb

SHA256
ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa

SHA512
14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e

Download Submit
C:\Users\Admin\Downloads\jJzPvIsM.zip.part

Filesize
223KB

MD5
a7a51358ab9cdf1773b76bc2e25812d9

SHA1
9f3befe37f5fbe58bbb9476a811869c5410ee919

SHA256
817ae49d7329ea507f0a01bb8009b9698bbd2fbe5055c942536f73f4d1d2b612

SHA512
3adc88eec7f646e50be24d2322b146438350aad358b3939d6ec0cd700fa3e3c07f2b75c5cd5e0018721af8e2391b0f32138ab66369869aaaa055d9188b4aa38d

Download Submit
C:\Users\Admin\Downloads\k7TbTbXi.zip.part

Filesize
24KB

MD5
803e14b9be4da03846324b0d48aa95d6

SHA1
260b5485087f8a234b6fd331e304ea2ff905b341

SHA256
bace4d211df8be6821b0aeac7adf26c0866bd0d69387d3fce73454b7cd0dc9ee

SHA512
534449c465bdeabf7bd43081d9b6cc84d1cce6807eea54c9ec7d622dc43b0730b69a4798c856280e003c553cf3c565ce60f9d0c5c787f0c1bcb511449195bb6e

Download Submit
C:\Windows\46FF.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe

Filesize
153KB

MD5
f33a4e991a11baf336a2324f700d874d

SHA1
9da1891a164f2fc0a88d0de1ba397585b455b0f4

SHA256
a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7

SHA512
edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
c4f26ed277b51ef45fa180be597d96e8

SHA1
e9efc622924fb965d4a14bdb6223834d9a9007e7

SHA256
14d82a676b63ab046ae94fa5e41f9f69a65dc7946826cb3d74cea6c030c2f958

SHA512
afc2a8466f106e81d423065b07aed2529cbf690ab4c3e019334f1bedfb42dc0e0957be83d860a84b7285bd49285503bfe95a1cf571a678dbc9bdb07789da928e

Download Submit
memory/300-2022-0x0000000074A00000-0x0000000074A82000-memory.dmp

Filesize
520KB

Download
memory/300-2025-0x00000000746B0000-0x0000000074732000-memory.dmp

Filesize
520KB

Download
memory/300-2073-0x00000000003D0000-0x00000000006CE000-memory.dmp

Filesize
3.0MB

Download
memory/300-2061-0x00000000003D0000-0x00000000006CE000-memory.dmp

Filesize
3.0MB

Download
memory/300-2057-0x00000000003D0000-0x00000000006CE000-memory.dmp

Filesize
3.0MB

Download
memory/300-2056-0x0000000074680000-0x00000000746A2000-memory.dmp

Filesize
136KB

Download
memory/300-2055-0x00000000746B0000-0x0000000074732000-memory.dmp

Filesize
520KB

Download
memory/300-2054-0x0000000074740000-0x000000007495C000-memory.dmp

Filesize
2.1MB

Download
memory/300-2051-0x0000000074A00000-0x0000000074A82000-memory.dmp

Filesize
520KB

Download
memory/300-2053-0x0000000074960000-0x00000000749D7000-memory.dmp

Filesize
476KB

Download
memory/300-2052-0x00000000749E0000-0x00000000749FC000-memory.dmp

Filesize
112KB

Download
memory/300-2050-0x00000000003D0000-0x00000000006CE000-memory.dmp

Filesize
3.0MB

Download
memory/300-2021-0x0000000074A00000-0x0000000074A82000-memory.dmp

Filesize
520KB

Download
memory/300-2029-0x00000000003D0000-0x00000000006CE000-memory.dmp

Filesize
3.0MB

Download
memory/300-2024-0x0000000074740000-0x000000007495C000-memory.dmp

Filesize
2.1MB

Download
memory/300-2028-0x00000000746B0000-0x0000000074732000-memory.dmp

Filesize
520KB

Download
memory/300-2027-0x0000000074680000-0x00000000746A2000-memory.dmp

Filesize
136KB

Download
memory/872-445-0x000007FEF41B0000-0x000007FEF4B9C000-memory.dmp

Filesize
9.9MB

Download
memory/872-455-0x000000001B220000-0x000000001B2A0000-memory.dmp

Filesize
512KB

Download
memory/872-435-0x000000001B220000-0x000000001B2A0000-memory.dmp

Filesize
512KB

Download
memory/872-426-0x000007FEF41B0000-0x000007FEF4B9C000-memory.dmp

Filesize
9.9MB

Download
memory/872-425-0x0000000000A60000-0x0000000000A8E000-memory.dmp

Filesize
184KB

Download
memory/872-436-0x000000001B220000-0x000000001B2A0000-memory.dmp

Filesize
512KB

Download
memory/872-454-0x000000001B220000-0x000000001B2A0000-memory.dmp

Filesize
512KB

Download
memory/1212-424-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1820-1141-0x000000001B200000-0x000000001B280000-memory.dmp

Filesize
512KB

Download
memory/1820-1173-0x000000001B200000-0x000000001B280000-memory.dmp

Filesize
512KB

Download
memory/1820-1154-0x000007FEF3CD0000-0x000007FEF46BC000-memory.dmp

Filesize
9.9MB

Download
memory/1820-1143-0x000000001B200000-0x000000001B280000-memory.dmp

Filesize
512KB

Download
memory/1820-1140-0x000007FEF3CD0000-0x000007FEF46BC000-memory.dmp

Filesize
9.9MB

Download
memory/2064-1251-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2176-456-0x0000000002F10000-0x0000000002F11000-memory.dmp

Filesize
4KB

Download
memory/2176-441-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2176-442-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2192-1076-0x0000000000270000-0x00000000002D8000-memory.dmp

Filesize
416KB

Download
memory/2192-1068-0x0000000000270000-0x00000000002D8000-memory.dmp

Filesize
416KB

Download
memory/2192-1060-0x0000000000270000-0x00000000002D8000-memory.dmp

Filesize
416KB

Download
memory/2384-1142-0x000007FEF3CD0000-0x000007FEF46BC000-memory.dmp

Filesize
9.9MB

Download
memory/2384-1145-0x000000001B130000-0x000000001B1B0000-memory.dmp

Filesize
512KB

Download
memory/2384-1127-0x0000000000CD0000-0x0000000000CFE000-memory.dmp

Filesize
184KB

Download
memory/2384-1128-0x000007FEF3CD0000-0x000007FEF46BC000-memory.dmp

Filesize
9.9MB

Download
memory/2384-1129-0x000000001B130000-0x000000001B1B0000-memory.dmp

Filesize
512KB

Download
memory/2384-1130-0x000000001B130000-0x000000001B1B0000-memory.dmp

Filesize
512KB

Download
memory/2384-1144-0x000000001B130000-0x000000001B1B0000-memory.dmp

Filesize
512KB

Download
memory/2996-344-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download
memory/2996-345-0x0000000004D50000-0x0000000004D90000-memory.dmp

Filesize
256KB

Download
memory/2996-343-0x0000000000FF0000-0x0000000001062000-memory.dmp

Filesize
456KB

Download
memory/2996-346-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download