njrat | 21df242a377d7ddea14251178bb29a2300c8535eac6bdde541f910f709472223

Resubmissions

09-07-2024 23:29

240709-3gzgzasejn 10

09-07-2024 23:27

240709-3fsysssdmp 3

09-07-2024 14:14

240709-rj642sxfqk 10

Analysis

max time kernel
831s
max time network
833s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
09-07-2024 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fffddsfdsgfd.png
Size

82KB
MD5

d586f6d0e6532c1e30c420f7167856bd
SHA1

2b3cd081d870b29df1f6249f3f50d890321bb983
SHA256

21df242a377d7ddea14251178bb29a2300c8535eac6bdde541f910f709472223
SHA512

3f3dc9059bc45b0ff79ac586a8440a87879168ea5ba8f5d07279e99a072656a15ec6d4b7037dfdd3a1faafc087c982116085a902e057b064fef908098888bf5f
SSDEEP

1536:hpk3C1qszuBnQbxe/xRgGbFBH4dCOPEtp7VpRKYlkUTZMdFsiHyfc0Nz196:A3ASBQbxsfg8Fh4dC4WpXRV1ZiSkS96

Score

10^/10

njrat wannacry hacked slave defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware spyware stealer trojan upx worm

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

hakim32.ddns.net:2000

127.0.0.1:111

Mutex

25f7eeb75e53b74dd2777060376f78f3

Attributes

reg_key
25f7eeb75e53b74dd2777060376f78f3
splitter
|'|'|

Extracted

Family

njrat

Version

0.7d

Botnet

slave

127.0.0.1:111

Mutex

7ed27061f4d1ca6d9a32b0e33d0d0084

Attributes

reg_key
7ed27061f4d1ca6d9a32b0e33d0d0084
splitter
Y262SUCZ4UJJ

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

5272 netsh.exe

pid	process
5272	netsh.exe

Drops startup file 5 IoCs

Processes:

svhost.exetmpD219.tmp.exetaskmgr.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7ed27061f4d1ca6d9a32b0e33d0d0084.exe	svhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDE1B5.tmp	tmpD219.tmp.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDE1CC.tmp	tmpD219.tmp.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\7ed27061f4d1ca6d9a32b0e33d0d0084.exe	taskmgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7ed27061f4d1ca6d9a32b0e33d0d0084.exe	svhost.exe

Executes dropped EXE 28 IoCs

Processes:

Client.exesvhost.exetmpD219.tmp.exetaskdl.exe@[email protected]@[email protected]taskhsvc.exetaskdl.exe@[email protected]taskse.exetaskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exe

pid	process
6240	Client.exe
5732	svhost.exe
6748	tmpD219.tmp.exe
6504	taskdl.exe
204	@[email protected]
5140	@[email protected]
4304	taskhsvc.exe
5448	taskdl.exe
6244	@[email protected]
6816	taskse.exe
6332	taskdl.exe
1476	taskse.exe
5556	@[email protected]
6456	taskdl.exe
6848	taskse.exe
5424	@[email protected]
6836	taskse.exe
992	@[email protected]
5548	taskdl.exe
6308	taskse.exe
1936	@[email protected]
5624	taskdl.exe
7056	taskse.exe
4004	@[email protected]
4300	taskdl.exe
4044	taskse.exe
3508	@[email protected]
3252	taskdl.exe

Loads dropped DLL 7 IoCs

Processes:

taskhsvc.exe

pid process

4304 taskhsvc.exe
4304 taskhsvc.exe
4304 taskhsvc.exe
4304 taskhsvc.exe
4304 taskhsvc.exe
4304 taskhsvc.exe
4304 taskhsvc.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

5876 icacls.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4304	taskhsvc.exe
4304	taskhsvc.exe
4304	taskhsvc.exe
4304	taskhsvc.exe
4304	taskhsvc.exe
4304	taskhsvc.exe
4304	taskhsvc.exe

pid	process
5876	icacls.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/5300-1561-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/5300-1569-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/680-4520-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/4336-4566-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qyrzxkvzsxw219 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tasksche.exe\""	reg.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Sets desktop wallpaper using registry 2 TTPs 3 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

@[email protected]@[email protected]tmpD219.tmp.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	tmpD219.tmp.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

svhost.exe

description	pid	process	target process
PID 5732 set thread context of 5300	5732	svhost.exe	vbc.exe
PID 5732 set thread context of 680	5732	svhost.exe	vbc.exe
PID 5732 set thread context of 4336	5732	svhost.exe	vbc.exe

Drops file in Windows directory 6 IoCs

Processes:

taskmgr.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exe

pid process

1832 vssadmin.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

6652 taskkill.exe

pid	process
1832	vssadmin.exe

pid	process
6652	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdgeCP.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeNjRat 0.7D.exeOpenWith.exeNjRat 0.7D Danger Edition.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	NjRat 0.7D.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:PID = "0"	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 65d73bea0ad2da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	NjRat 0.7D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{26F8D842-F6AF-40B4-9401-07CF8A96B64A} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	NjRat 0.7D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByDirection = "1"	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupView = "0"	NjRat 0.7D.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1"	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\Mode = "1"	NjRat 0.7D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 69272aea0ad2da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

764 reg.exe

pid	process
764	reg.exe

NTFS ADS 3 IoCs

Processes:

firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\NjRat.0.7D.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\NjRat.0.7D.Danger.Edition.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

7008 NOTEPAD.EXE

pid	process
7008	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Client.exe

pid	process
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe
6240	Client.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

NjRat 0.7D Danger Edition.exeNjRat 0.7D.exesvhost.exe

pid process

2112 NjRat 0.7D Danger Edition.exe
5408 NjRat 0.7D.exe
5732 svhost.exe
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

1988 MicrosoftEdgeCP.exe
1988 MicrosoftEdgeCP.exe
1988 MicrosoftEdgeCP.exe
1988 MicrosoftEdgeCP.exe

pid	process
2112	NjRat 0.7D Danger Edition.exe
5408	NjRat 0.7D.exe
5732	svhost.exe

pid	process
1988	MicrosoftEdgeCP.exe
1988	MicrosoftEdgeCP.exe
1988	MicrosoftEdgeCP.exe
1988	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

firefox.exeAUDIODG.EXEMicrosoftEdgeCP.exeMicrosoftEdge.exesvchost.exeClient.exesvhost.exevbc.exe

description	pid	process
Token: SeDebugPrivilege	5076	firefox.exe
Token: SeDebugPrivilege	5076	firefox.exe
Token: SeDebugPrivilege	5076	firefox.exe
Token: 33	2536	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2536	AUDIODG.EXE
Token: SeDebugPrivilege	5076	firefox.exe
Token: SeDebugPrivilege	5076	firefox.exe
Token: SeDebugPrivilege	5076	firefox.exe
Token: SeDebugPrivilege	400	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	400	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	400	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	400	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4712	MicrosoftEdge.exe
Token: SeDebugPrivilege	4712	MicrosoftEdge.exe
Token: SeDebugPrivilege	5076	firefox.exe
Token: SeTcbPrivilege	6960	svchost.exe
Token: SeRestorePrivilege	6960	svchost.exe
Token: SeDebugPrivilege	5076	firefox.exe
Token: SeDebugPrivilege	5076	firefox.exe
Token: SeDebugPrivilege	6240	Client.exe
Token: SeDebugPrivilege	5732	svhost.exe
Token: 33	5732	svhost.exe
Token: SeIncBasePriorityPrivilege	5732	svhost.exe
Token: 33	5732	svhost.exe
Token: SeIncBasePriorityPrivilege	5732	svhost.exe
Token: 33	5732	svhost.exe
Token: SeIncBasePriorityPrivilege	5732	svhost.exe
Token: 33	5732	svhost.exe
Token: SeIncBasePriorityPrivilege	5732	svhost.exe
Token: 33	5732	svhost.exe
Token: SeIncBasePriorityPrivilege	5732	svhost.exe
Token: SeDebugPrivilege	5300	vbc.exe
Token: 33	5732	svhost.exe
Token: SeIncBasePriorityPrivilege	5732	svhost.exe
Token: 33	5732	svhost.exe
Token: SeIncBasePriorityPrivilege	5732	svhost.exe
Token: 33	5732	svhost.exe
Token: SeIncBasePriorityPrivilege	5732	svhost.exe
Token: 33	5732	svhost.exe
Token: SeIncBasePriorityPrivilege	5732	svhost.exe
Token: 33	5732	svhost.exe
Token: SeIncBasePriorityPrivilege	5732	svhost.exe
Token: SeDebugPrivilege	5076	firefox.exe
Token: 33	5732	svhost.exe
Token: SeIncBasePriorityPrivilege	5732	svhost.exe
Token: 33	5732	svhost.exe
Token: SeIncBasePriorityPrivilege	5732	svhost.exe
Token: 33	5732	svhost.exe
Token: SeIncBasePriorityPrivilege	5732	svhost.exe
Token: 33	5732	svhost.exe
Token: SeIncBasePriorityPrivilege	5732	svhost.exe
Token: 33	5732	svhost.exe
Token: SeIncBasePriorityPrivilege	5732	svhost.exe
Token: 33	5732	svhost.exe
Token: SeIncBasePriorityPrivilege	5732	svhost.exe
Token: 33	5732	svhost.exe
Token: SeIncBasePriorityPrivilege	5732	svhost.exe
Token: 33	5732	svhost.exe
Token: SeIncBasePriorityPrivilege	5732	svhost.exe
Token: 33	5732	svhost.exe
Token: SeIncBasePriorityPrivilege	5732	svhost.exe
Token: 33	5732	svhost.exe
Token: SeIncBasePriorityPrivilege	5732	svhost.exe
Token: SeDebugPrivilege	5076	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

firefox.exeNjRat 0.7D Danger Edition.exe

pid	process
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

firefox.exeNjRat 0.7D Danger Edition.exeNjRat 0.7D.exetaskmgr.exe

pid	process
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
2112	NjRat 0.7D Danger Edition.exe
5408	NjRat 0.7D.exe
5408	NjRat 0.7D.exe
5408	NjRat 0.7D.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe
1896	taskmgr.exe

Suspicious use of SetWindowsHookEx 49 IoCs

Processes:

firefox.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeNjRat 0.7D Danger Edition.exeNjRat 0.7D.exe@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]OpenWith.exe@[email protected]firefox.exe@[email protected]@[email protected]OpenWith.exe@[email protected]

pid	process
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
4712	MicrosoftEdge.exe
1988	MicrosoftEdgeCP.exe
400	MicrosoftEdgeCP.exe
1988	MicrosoftEdgeCP.exe
2112	NjRat 0.7D Danger Edition.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5408	NjRat 0.7D.exe
5408	NjRat 0.7D.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5408	NjRat 0.7D.exe
204	@[email protected]
204	@[email protected]
5140	@[email protected]
5140	@[email protected]
6244	@[email protected]
6244	@[email protected]
5556	@[email protected]
5424	@[email protected]
5636	OpenWith.exe
992	@[email protected]
6552	firefox.exe
1936	@[email protected]
1936	@[email protected]
4004	@[email protected]
1868	OpenWith.exe
3508	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 2360 wrote to memory of 5076	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 5076	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 5076	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 5076	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 5076	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 5076	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 5076	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 5076	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 5076	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 5076	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 5076	2360	firefox.exe	firefox.exe
PID 5076 wrote to memory of 5060	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 5060	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 2568	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 1916	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 1916	5076	firefox.exe	firefox.exe
PID 5076 wrote to memory of 1916	5076	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

6204 attrib.exe
7032 attrib.exe

pid	process
6204	attrib.exe
7032	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\fffddsfdsgfd.png
1⤵
PID:4112

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.0.19496267\2063212998" -parentBuildID 20221007134813 -prefsHandle 1764 -prefMapHandle 1756 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {05c5e8a1-6f52-4754-b7c3-114698427db3} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 1516 115d7db7758 gpu
3⤵
PID:5060

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.1.1205883772\909335929" -parentBuildID 20221007134813 -prefsHandle 2148 -prefMapHandle 2144 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {029b4463-bbe4-4474-94a2-f5d1768d6376} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 2160 115c59e6458 socket
3⤵
- Checks processor information in registry
PID:2568

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.2.1109517960\755548821" -childID 1 -isForBrowser -prefsHandle 3052 -prefMapHandle 3048 -prefsLen 20866 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5cd3184-c6c7-40a1-8280-039946acada4} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 2728 115d7d65a58 tab
3⤵
PID:1916

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.3.1844008625\986618153" -childID 2 -isForBrowser -prefsHandle 3380 -prefMapHandle 3364 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dced2cb1-34d7-4fef-8ad7-7f7efb63a95a} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 3392 115c5971058 tab
3⤵
PID:3572

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.4.1117976402\836767786" -childID 3 -isForBrowser -prefsHandle 4284 -prefMapHandle 4280 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {83b5a0e4-ea34-447d-8249-b1797d53ffe8} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 4300 115dcf5db58 tab
3⤵
PID:500

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.5.1211559831\1659082396" -childID 4 -isForBrowser -prefsHandle 4928 -prefMapHandle 4920 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {af693410-a95d-4aa6-bda2-7177753293f2} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 4940 115de446358 tab
3⤵
PID:2496

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.6.1542585874\424318083" -childID 5 -isForBrowser -prefsHandle 5076 -prefMapHandle 5080 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f3f18d3-bdfd-4d65-8f6d-5ab4ef196f50} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 4960 115de5acf58 tab
3⤵
PID:1224

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.7.322736971\1848406983" -childID 6 -isForBrowser -prefsHandle 5276 -prefMapHandle 5280 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {35aa6f6f-abb7-40e2-9c49-3a2bdcf93634} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 5268 115de5adb58 tab
3⤵
PID:304

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.8.856149170\1204926336" -childID 7 -isForBrowser -prefsHandle 5684 -prefMapHandle 5692 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f6eb597-66ac-4bca-802f-c1fb56eaf476} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 5164 115e0195258 tab
3⤵
PID:3392

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.9.1575546216\92374111" -childID 8 -isForBrowser -prefsHandle 5016 -prefMapHandle 5104 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {53d0ebcb-3917-4a52-bb4c-4af19eaee24a} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 5040 115da727558 tab
3⤵
PID:4132

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.10.678009022\790096430" -childID 9 -isForBrowser -prefsHandle 4812 -prefMapHandle 1448 -prefsLen 26835 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {88b1a15d-784c-44fd-9d50-beeae611d785} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 4572 115db7d0558 tab
3⤵
PID:1356

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.11.1925405868\1365125494" -childID 10 -isForBrowser -prefsHandle 6244 -prefMapHandle 6408 -prefsLen 26835 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2fedce11-f3f6-4ef4-be53-d2c7b268ef3d} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 6324 115e0997858 tab
3⤵
PID:5428

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.12.814811033\771555635" -parentBuildID 20221007134813 -prefsHandle 5508 -prefMapHandle 5388 -prefsLen 26835 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {af5df5ca-db7b-4340-aee4-bcac78948042} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 6548 115df2a1658 rdd
3⤵
PID:5140

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.13.1719255995\2123812712" -childID 11 -isForBrowser -prefsHandle 10452 -prefMapHandle 10476 -prefsLen 26835 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {047cc237-c9dd-4663-a97c-289a58d9baa2} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 10496 115e23c5a58 tab
3⤵
PID:4764

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.14.590938672\1023337587" -childID 12 -isForBrowser -prefsHandle 5720 -prefMapHandle 6336 -prefsLen 27379 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {de16461a-ab24-42f5-8187-23c25d5e6c05} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 5804 115e386c858 tab
3⤵
PID:7056

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.15.412573509\2033479219" -childID 13 -isForBrowser -prefsHandle 6228 -prefMapHandle 10528 -prefsLen 27379 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {06f9d460-333c-4a90-9c17-aea3c78c70e9} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 5720 115e5ccf258 tab
3⤵
PID:6180

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2192

C:\Users\Admin\Videos\NjRat 0.7D Danger Edition.exe
"C:\Users\Admin\Videos\NjRat 0.7D Danger Edition.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2112

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /alignment=512 /QUIET "C:\Users\Admin\AppData\Local\Temp\stub.il" /output:"C:\Users\Admin\Videos\Server.exe"
2⤵
PID:6740

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3cc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2536

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4712

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2892

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1988

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:400

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2392

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:6688

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6960

C:\Windows\system32\dashost.exe
dashost.exe {1977879a-f204-40f4-980f490367409015}
2⤵
PID:7004

C:\Users\Admin\Videos\NjRat 0.7D.exe
"C:\Users\Admin\Videos\NjRat 0.7D.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5408

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /alignment=512 /QUIET "C:\Users\Admin\AppData\Local\Temp\stub.il" /output:"C:\Users\Admin\Videos\Client.exe"
2⤵
PID:6344

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:5576

C:\Users\Admin\Videos\Client.exe
"C:\Users\Admin\Videos\Client.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6240

C:\Users\Admin\AppData\Local\Temp\svhost.exe
"C:\Users\Admin\AppData\Local\Temp\svhost.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5732

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svhost.exe" "svhost.exe" ENABLE
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5272

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\3405798"
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5300

C:\Users\Admin\AppData\Local\Temp\tmpD219.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpD219.tmp.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Sets desktop wallpaper using registry
PID:6748

C:\Windows\SysWOW64\attrib.exe
attrib +h .
4⤵
- Views/modifies file attributes
PID:7032

C:\Windows\SysWOW64\icacls.exe
icacls . /grant Everyone:F /T /C /Q
4⤵
- Modifies file permissions
PID:5876

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
4⤵
- Executes dropped EXE
PID:6504

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 50851720535107.bat
4⤵
PID:5656

C:\Windows\SysWOW64\cscript.exe
cscript.exe //nologo m.vbs
5⤵
PID:5804

C:\Windows\SysWOW64\attrib.exe
attrib +h +s F:\$RECYCLE
4⤵
- Views/modifies file attributes
PID:6204

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected] co
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:204

C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
TaskData\Tor\taskhsvc.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4304

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b @[email protected] vs
4⤵
PID:3864

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected] vs
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5140

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
6⤵
PID:3836

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
7⤵
- Interacts with shadow copies
PID:1832

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
7⤵
PID:6652

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
4⤵
- Executes dropped EXE
PID:5448

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
4⤵
- Executes dropped EXE
PID:6816

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
4⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:6244

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "qyrzxkvzsxw219" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
4⤵
PID:6500

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "qyrzxkvzsxw219" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
5⤵
- Adds Run key to start application
- Modifies registry key
PID:764

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
4⤵
- Executes dropped EXE
PID:6332

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
4⤵
- Executes dropped EXE
PID:1476

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5556

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
4⤵
- Executes dropped EXE
PID:6456

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
4⤵
- Executes dropped EXE
PID:6848

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5424

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
4⤵
- Executes dropped EXE
PID:6836

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:992

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
4⤵
- Executes dropped EXE
PID:5548

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
4⤵
- Executes dropped EXE
PID:6308

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
4⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:1936

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
4⤵
- Executes dropped EXE
PID:5624

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
4⤵
- Executes dropped EXE
PID:7056

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4004

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
4⤵
- Executes dropped EXE
PID:4300

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
4⤵
- Executes dropped EXE
PID:4044

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3508

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
4⤵
- Executes dropped EXE
PID:3252

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\4081496"
3⤵
PID:680

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\3929669"
3⤵
PID:4336

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1DDC.tmp.cmd" "
3⤵
PID:2324

C:\Windows\SysWOW64\taskkill.exe
TASKKILL /IM svchost.exe /F
4⤵
- Kills process with taskkill
PID:6652

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:6564

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:6824

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:6688

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Videos\Pass.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:7008

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5636

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops startup file
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of SendNotifyMessage
PID:1896

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4600

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:6552

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6552.0.236950368\27972975" -parentBuildID 20221007134813 -prefsHandle 1696 -prefMapHandle 1684 -prefsLen 17655 -prefMapSize 231678 -appDir "C:\Program Files\Mozilla Firefox\browser" - {594fa8b8-3e89-429e-9e30-2cfa7135bdf8} 6552 "\\.\pipe\gecko-crash-server-pipe.6552" 1788 1d1c0105658 gpu
3⤵
PID:3712

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6552.1.862488170\282135701" -parentBuildID 20221007134813 -prefsHandle 1984 -prefMapHandle 1980 -prefsLen 17700 -prefMapSize 231678 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38d4327d-ae0a-424b-88bc-90891bd170df} 6552 "\\.\pipe\gecko-crash-server-pipe.6552" 2004 1d1adae5a58 socket
3⤵
PID:6620

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6552.2.1949469044\240722407" -childID 1 -isForBrowser -prefsHandle 3228 -prefMapHandle 3224 -prefsLen 20227 -prefMapSize 231678 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {34d5c25f-7b53-4b95-ada9-d65d05636243} 6552 "\\.\pipe\gecko-crash-server-pipe.6552" 3240 1d1c33e1158 tab
3⤵
PID:5500

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6552.3.153674979\397755603" -childID 2 -isForBrowser -prefsHandle 3544 -prefMapHandle 3540 -prefsLen 20349 -prefMapSize 231678 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {75e18ccc-21bf-4c75-8942-01d8cc9ee495} 6552 "\\.\pipe\gecko-crash-server-pipe.6552" 3504 1d1c44aae58 tab
3⤵
PID:5220

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6552.4.1808358139\1218804913" -childID 3 -isForBrowser -prefsHandle 2456 -prefMapHandle 2584 -prefsLen 26680 -prefMapSize 231678 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {792361fc-aece-4f20-a9dc-425ac2595488} 6552 "\\.\pipe\gecko-crash-server-pipe.6552" 3680 1d1ada6ae58 tab
3⤵
PID:952

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6552.5.1187394777\338186799" -parentBuildID 20221007134813 -prefsHandle 4536 -prefMapHandle 2472 -prefsLen 27570 -prefMapSize 231678 -appDir "C:\Program Files\Mozilla Firefox\browser" - {400cbc1d-b8d5-4929-9611-9bb7c07157cb} 6552 "\\.\pipe\gecko-crash-server-pipe.6552" 4496 1d1c5634c58 rdd
3⤵
PID:5200

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6552.6.2099811190\564471814" -childID 4 -isForBrowser -prefsHandle 4828 -prefMapHandle 4848 -prefsLen 27656 -prefMapSize 231678 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {67862a38-38bc-4249-8527-deb465487204} 6552 "\\.\pipe\gecko-crash-server-pipe.6552" 4860 1d1ada5d358 tab
3⤵
PID:6508

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6552.7.1593483357\2078127594" -childID 5 -isForBrowser -prefsHandle 4980 -prefMapHandle 4984 -prefsLen 27656 -prefMapSize 231678 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0af7bd1-8210-4f2f-89c1-2d7615061112} 6552 "\\.\pipe\gecko-crash-server-pipe.6552" 4972 1d1adae7e58 tab
3⤵
PID:1468

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6552.8.1786934533\1773927614" -childID 6 -isForBrowser -prefsHandle 5180 -prefMapHandle 5184 -prefsLen 27656 -prefMapSize 231678 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {63b3db21-2cb9-4f8f-aaf7-a26c65b81e89} 6552 "\\.\pipe\gecko-crash-server-pipe.6552" 5172 1d1c6bbaf58 tab
3⤵
PID:5060

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6552.9.1979034889\490489233" -childID 7 -isForBrowser -prefsHandle 5596 -prefMapHandle 5600 -prefsLen 27831 -prefMapSize 231678 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8773975b-4a54-422c-a7df-3b460390dddd} 6552 "\\.\pipe\gecko-crash-server-pipe.6552" 5608 1d1c8a3ad58 tab
3⤵
PID:1356

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Scripting

T1064

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json

Filesize
102B

MD5
7d1d7e1db5d8d862de24415d9ec9aca4

SHA1
f4cdc5511c299005e775dc602e611b9c67a97c78

SHA256
ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda

SHA512
1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
1214bfd3e656cd16093b80de6d145e86

SHA1
91de93089638d1afad07f7855bba5e12a326ac5e

SHA256
4520d414482f1bc952e41cce628a8085270d8e9a2efb09a3d39a5697061b6f0c

SHA512
1a2aa2026201fc2542b4fbeeb35d57b739ebb38708245bff1840f21d07c6f4257dd47d226ae9db74bb901abc5c9ff1ec68bf957515df45e1fcf52050a01aa77a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\1195

Filesize
10KB

MD5
7ed0ee52eec16481ea74e38cb37486ed

SHA1
1f5afa1cc5010d37c3be5fceaa011761b4418aea

SHA256
e7b74ee116d70e2cbe4cb467fc0175850eeea631eb909e0b727d19453d690b93

SHA512
307414897ba0cacdd7f191ba7bba3eeb0fc83d4e9ef9db4bdde98b568c588e4219edf2ff546f2171f7fbbf142dc25f7d303553ad7acc332c9028aa41df21ae05

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\19241

Filesize
12KB

MD5
d9f03acc4d4a5b1cd5f17b1e47617c25

SHA1
0405db75d66cc6b38e4affc48ddb2a4119c58e6c

SHA256
a8fd94b0b09e9f183ecd92a5572fb5ef775372a8ac6773b99572e2dab1439688

SHA512
97dbb2e49b2cae76f475cd997c7857636bb9c64d40ddd3da02cd3d951a705de3bf38faf7631b7e64cfc04b897f0b9a687b7a6ea2b34a3f47e14dc5d902a019aa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\25536

Filesize
11KB

MD5
fb9fb90138d5440925f962a5dbf76857

SHA1
abab38bd31648f64b510af43157a99404b23c337

SHA256
68003bd629310a5d1e28f827dc93160ee27087ca1a730937f6977818abbe69f9

SHA512
b8918c2b44b91c15b1592f0ba19712dcdbae25f08139845380f45a21d22886fa49f480ce159b52cd5a5678dff1683a14a3196df64e865a10eaec2e4ecfa0fdc4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\2754

Filesize
9KB

MD5
e0043b866a8d1b40668afb4d991f642f

SHA1
95194db822c7399d7426169e6bc6aed6aa51465e

SHA256
c3fccc1335b6121aef36f8248fa0da65737bd98537d06546c9d64e31ede64628

SHA512
c20233dd1bc9f7abfe096df1b8372aeda2605c731f8e5686b381a9b521d07f89767fe5e793018f618d1d29e29fb37a22d5b136a77094e7f97ef3bcddbf79e4df

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\5982

Filesize
9KB

MD5
31d7afbd0888ebdca391ca9d384d97db

SHA1
af3b6d1ded52724aa17740d927b68695585a517f

SHA256
2dfd633a6ab9f846da6c12575363e82b0aeacde0a54412d1a6b8aa38a6f0a658

SHA512
651be8a9647f9767c047478b22cc79f461359eb147d498bb8e202b3ffa10f6b73bfd87c8be1c6e3ff352d2e8d40168fc07f6270e837a1a454fd3cf6371411bc8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\1A459DE636F00CBAF4190A3F158631A1F28E919D

Filesize
4.8MB

MD5
d6bf84563729e56fff1c7fb80ed6dca1

SHA1
34613200b3a9bdada4862f5de0f0bab244170954

SHA256
8ae12d66f0ebbc43afadaa77b4221b5da35fe555c1760a45029915a1d160b632

SHA512
0e860c66b99a93dca51d14cb2f6e4e0756e75f5ce7ed972e3a8b9265de8012d84da58fd73442dcc25b4c7ef175893f37a041a873de78c37e39dc80f711c70948

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\21235C60DB68B39BE5D5AAFD7CFDA8EB241CAC6D

Filesize
15KB

MD5
c482e13dbbe6e5c6146a7a83f44defbb

SHA1
91c0cb9de9ff8c31d6211e9732f5e1901f9f67b3

SHA256
3a9be8639ec5a4afdce5f9397ebbb3119ea71fab5b12c400a16c1e733891aeac

SHA512
c54e341dcdcd97e37df2723114877efa68e9a08205dba984d2576a129914c15d53e57add05ca7fb40a7adf9afec8f62d57acf989bd19923b1d27a526f7b7dd46

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\265742DD17F4DD61332974BE5856D8170CCC16BC

Filesize
60KB

MD5
756f82bec2a5d1635a56fc1d8a497fb9

SHA1
0e7ff6281068bf13c9910512dc8b08b494f687fe

SHA256
3a7b921d684c1397e0226faa83218008cfab2e7b3a8a2ecea11cd01b02597c94

SHA512
efc31bff950b7749105bf4877d39aecd9c627280f380cf5419380617fffb3479b17adfdfe4f8e498b5d20d8b46d8b2566f24ab9c9c987227a41115585db03f1b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\462E5FADCC82A134C10A828C114C5F747964CF3D

Filesize
17KB

MD5
cad695ce2e14c4bd084d07d0d5907c97

SHA1
14021c674329347038b10d32b40800140f675f50

SHA256
f3ed5aff8246193b755eb578d7b103220c66593fb79b6e375f3dbffdea7d952f

SHA512
267d0374d2aa5bbb747660e02461e64fc2962cdffb1acdfa4c0d295917c2808db82663a4bdc9d48d82952e541ea18dc6293276bf4d5b561458e023da3cb2b79e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\4D3373C611DE638ED6CA0F7AB92AED0C904A3795

Filesize
16KB

MD5
38cf831e1d8ed652cc5d1b6ee964bb6f

SHA1
4de20d36adaf2a9130f38dcbdf21bd4c13f8a328

SHA256
e9aae8fe16fe415d4d31510762a89d03ee669a86d03753719039584383c1d8dc

SHA512
786af890c3029de6653a2beedc10b408ca0103324cab8e4df3b1de23a9de6dcf8c42b0aadf0dfaf017f56f3affcdc6852141b501dcec4fc0f60dc1e43851552d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\52E1A5F5904D864BC54C4678FE8113AA3A212996

Filesize
13KB

MD5
49682430a4f08dc4ab265fc0244791e5

SHA1
ff2c631db06e6bd498947f72af012220e89e6ffa

SHA256
d944aaad2e72ca7d5fddee887c0b793375192b78f081ce2d7a33cb25a651e740

SHA512
330aa6dc82b0b9676824f84ef193c0eeac43f827ec317ffd01b902e9c939d01847216743c19231bb206c90159dca5a91ac534b7a2d09cf2c7f52ea28ebef968e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\5B23235D54208C34AFF88FC6F18585FD8A8F8FAD

Filesize
32KB

MD5
ce7fccb5fdb95e96e1f38ad0f8b661ab

SHA1
57d15d4d6b8f217ddda561c958b364ad793159fb

SHA256
b546afa241f298bd3f2e6b05e90190b8de10f2b7a619ae132c6c0be0b083b02e

SHA512
2c1d359d1a599547d138f2ae58c4fccb5fbcc150320c9790068e3a7da5a402b62258eebbcfb0cf7cfde8a95b3890105d1dc3739fc3372e76c5097c6e06e5259a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\80EC2DA5F2CC2C485F6EF0F76BD1D734592A48BF

Filesize
971KB

MD5
b3546a39b5aaf0cf7bb9fe6be11d59f9

SHA1
11c0bf162625497ab6ae899e3c553d6714327155

SHA256
b653fa34036ead5741cfe8c13c3147754054f47a7182513947650267a35357d0

SHA512
d7bcdf25e7d87335d64a6b21ee452b8068976a658041515beba3672309c41d7c6a042cd81ea5d06ee3865a81139d5713f552e26ad7b2ea12ca1c4b9bc7ae4a7e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\844DEF2BCA6134A454AE4954EC0B0ECF40796F29

Filesize
33KB

MD5
954e256998403aa0dc3c2456946c82a6

SHA1
c05c12f77f5502ded70d04f8c1cb2bead6c09e74

SHA256
506e3bc27a490d87e7307e6ac2dce8fbe660cdc7f6ab831ff4e66a1fbf43fe90

SHA512
70f6e81d79ab3e5b32f22760f8f44b9688245019eba69690478570db2ab29c57e6310432499a8c2eab3a3b29052fb144f6ee2740b14baf76e6d6a0e6fa94f5d3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\88D2DD145122466A8C6F39785D5A392BF5E86A0D

Filesize
14KB

MD5
122fd40edd2cffcfa6104227f5088e27

SHA1
e8f68b99d74f63825013bf57688b71b616d9f419

SHA256
c8ad4cb770679a13e0b509f0ebacc98ee81459272efcf9b5c693eaf1c2d862cf

SHA512
fe5e80bbae665f381eca2367b64574309dc172f7a92051029df8d2841f1cd7d05a1bab08443882998871ad4a136eeccdeef9a1b1dd0123037cdc412451335758

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\92B7809CBCCEC32F8AA6B585CB23104E10E55D53

Filesize
63KB

MD5
a9101ba5d73ef06b9832a72c1e1c81f6

SHA1
f01e52a7aac8c7cba5db9b57e3a5aee3c6fe5b3d

SHA256
ca6cadaa653dbade4538bfe5dca3fad99c4e856bb2bcf0434d33eebf4dbecd2b

SHA512
cf1e5bbd22bfca2c601c769020df3732246f838f01ace87b0c832cf559b23aba2133ca187df1dd327587c4a26fb982b1c78e232f837dd11a0f9fd34230da71c4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\D4998C47AAA67C5B36F0F21587863CDD1DE58500

Filesize
122KB

MD5
aff8051205de432d0ca6a8457ef06879

SHA1
b58018812f2a514af3e00c1b5a9e5b23eca26dca

SHA256
052769bccee979b25390822bebdb83f53e156f6e55769d08dccd82a1a2687d73

SHA512
a0bc05675129c2832fe6d40c6fa442941c17e237512b8456078b6e9530ae8cde9af7fab268a7016e1c89008f0dbd92d150f72dc3f257df812402f38fda1d3307

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\E29FDE07AE5BEE729429D4F236AD31EC43F719A0

Filesize
14KB

MD5
badc42733cb888e91e50ce23b147d9c8

SHA1
b94f209477399c7f82420c4782aa363361039f0c

SHA256
39761424c88905fc79f5551686b8de86fb990881056032ea647be6b22792aecd

SHA512
aedd28995b9be8e5f4690e97b5fab07d57fd2e3db2396d8e346031744f85a02b002c6aa3312726d36df23de58c8102e3cb1d350380e3a77b19e8c3c90dc238df

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\ZBRLKSH4\B8BxsscfVBr[1].ico

Filesize
1KB

MD5
e508eca3eafcc1fc2d7f19bafb29e06b

SHA1
a62fc3c2a027870d99aedc241e7d5babba9a891f

SHA256
e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a

SHA512
49e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF9F6CBBC1004CC0F5.TMP

Filesize
16KB

MD5
0ae56033e77a45d106f8d1adf230952f

SHA1
9d06a26f460af2d40c87ee107394ec6f68eb1cc7

SHA256
42dc09c737ab6dcaf29e5248d7c613f7272cb9e2adc6483f8678e2346ca82691

SHA512
bbf7cf01eaa84468b00505fd96aecf9a8a37abab6756008af04b652fbb0ffbd8a647eed8ab7defc6fe566e2a7bf678b5aa37107ba6360c3a0cec4273e7bcd5bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\3405798

Filesize
507B

MD5
6d0e849b0647746facd7c73f03b4d366

SHA1
3138201a6608428b922bd86168b51cf80615bc91

SHA256
c2f229ba47f29fccb6d35a908e887bf97e9e87cdb1110e855d5caa39571e5d72

SHA512
3839589f64141ba269f95e2726dd040ee09b6c9c09f5765dcdba847b02f68fa000b588a272f17e73ac42e81b3bb154535dc20da6dce0682b4b3a1ac2daada86a

Download Submit
C:\Users\Admin\AppData\Local\Temp\50851720535107.bat

Filesize
340B

MD5
3867f2ec82a7d77c9ffefb1aac8b7903

SHA1
06fccf19b9c498b5afa2b35da00e3ab28d56f785

SHA256
4e25c23aa5babc853889d3e1e79bb01ca7650837b250314a8d50f2e2c4b6730f

SHA512
b413994e5b9f0ecb956055c7befff14845b56bb658fd8280d3213fdfa175ff76bc56e082174f2475fdf2d1f9eff618ebfd80ee2b67c091eaf1fd9c94697da5aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\@[email protected]

Filesize
933B

MD5
7e6b6da7c61fcb66f3f30166871def5b

SHA1
00f699cf9bbc0308f6e101283eca15a7c566d4f9

SHA256
4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e

SHA512
e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Login Data

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\tor.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\b.wnry

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.wnry

Filesize
780B

MD5
93f33b83f1f263e2419006d6026e7bc1

SHA1
1a4b36c56430a56af2e0ecabd754bf00067ce488

SHA256
ef0ed0b717d1b956eb6c42ba1f4fd2283cf7c8416bed0afd1e8805ee0502f2b4

SHA512
45bdd1a9a3118ee4d3469ee65a7a8fdb0f9315ca417821db058028ffb0ed145209f975232a9e64aba1c02b9664c854232221eb041d09231c330ae510f638afac

Download Submit
C:\Users\Admin\AppData\Local\Temp\m.vbs

Filesize
219B

MD5
82a1fc4089755cb0b5a498ffdd52f20f

SHA1
0a8c0da8ef0354f37241e2901cf82ec9ce6474aa

SHA256
7fbdc49f4b4ba21949eca0b16c534b4882da97e94e5ca131cec1629e60439dfa

SHA512
1573a0c7333accef2695efefe1b57cba8f8d66a0061c24420ee0a183343a9a319995267d306ee85084c95580f9855bcdf9dee559b28a200b27fc3cc353315e78

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_bulgarian.wnry

Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_chinese (simplified).wnry

Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_chinese (traditional).wnry

Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_croatian.wnry

Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_czech.wnry

Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_danish.wnry

Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_dutch.wnry

Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_english.wnry

Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_filipino.wnry

Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_french.wnry

Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_german.wnry

Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_greek.wnry

Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_indonesian.wnry

Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_italian.wnry

Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_japanese.wnry

Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_korean.wnry

Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_latvian.wnry

Filesize
40KB

MD5
c33afb4ecc04ee1bcc6975bea49abe40

SHA1
fbea4f170507cde02b839527ef50b7ec74b4821f

SHA256
a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

SHA512
0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_norwegian.wnry

Filesize
36KB

MD5
ff70cc7c00951084175d12128ce02399

SHA1
75ad3b1ad4fb14813882d88e952208c648f1fd18

SHA256
cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

SHA512
f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_polish.wnry

Filesize
38KB

MD5
e79d7f2833a9c2e2553c7fe04a1b63f4

SHA1
3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

SHA256
519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

SHA512
e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_portuguese.wnry

Filesize
37KB

MD5
fa948f7d8dfb21ceddd6794f2d56b44f

SHA1
ca915fbe020caa88dd776d89632d7866f660fc7a

SHA256
bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

SHA512
0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_romanian.wnry

Filesize
50KB

MD5
313e0ececd24f4fa1504118a11bc7986

SHA1
e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

SHA256
70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

SHA512
c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_russian.wnry

Filesize
46KB

MD5
452615db2336d60af7e2057481e4cab5

SHA1
442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

SHA256
02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

SHA512
7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_slovak.wnry

Filesize
40KB

MD5
c911aba4ab1da6c28cf86338ab2ab6cc

SHA1
fee0fd58b8efe76077620d8abc7500dbfef7c5b0

SHA256
e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

SHA512
3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_spanish.wnry

Filesize
36KB

MD5
8d61648d34cba8ae9d1e2a219019add1

SHA1
2091e42fc17a0cc2f235650f7aad87abf8ba22c2

SHA256
72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

SHA512
68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_swedish.wnry

Filesize
37KB

MD5
c7a19984eb9f37198652eaf2fd1ee25c

SHA1
06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae

SHA256
146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4

SHA512
43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_turkish.wnry

Filesize
41KB

MD5
531ba6b1a5460fc9446946f91cc8c94b

SHA1
cc56978681bd546fd82d87926b5d9905c92a5803

SHA256
6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415

SHA512
ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_vietnamese.wnry

Filesize
91KB

MD5
8419be28a0dcec3f55823620922b00fa

SHA1
2e4791f9cdfca8abf345d606f313d22b36c46b92

SHA256
1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8

SHA512
8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

Download Submit
C:\Users\Admin\AppData\Local\Temp\r.wnry

Filesize
864B

MD5
3e0020fc529b1c2a061016dd2469ba96

SHA1
c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade

SHA256
402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c

SHA512
5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\s.wnry

Filesize
2.9MB

MD5
ad4c9de7c8c40813f200ba1c2fa33083

SHA1
d1af27518d455d432b62d73c6a1497d032f6120e

SHA256
e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b

SHA512
115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617

Download Submit
C:\Users\Admin\AppData\Local\Temp\stub.il

Filesize
1.2MB

MD5
2db1a1ecea09af2b10c51353080e26f5

SHA1
4c58ed961f87b41f8ad5197f31b865c755b4a427

SHA256
8477dd9468ff7558f86c7fcfe9ebf19244e15613ad9aa159c2e9c49fbcbfbdab

SHA512
23d9be995d5ca872be84cff6c6c5473be1b67c2215dd569db7d4a2e26efe7740176a802c0165d758e667c7c06603fa28c6831ce74138540fc49c6978feca1cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\stub.il

Filesize
338KB

MD5
25f2a9cbc89a434dcf499f3d648bb04d

SHA1
9e089e316efd60a5b2b6d6151066be4df12cf7e6

SHA256
e8eec7007be32d3f9f8a28f84b61fc6138a687cd7346071c9b114a67e57381bf

SHA512
f076d97e4dd2478f56e16f899fb18a01ea22c6b76b08a684782e99e61559bcf526783f561afb548783621f5ebe493478ddeed7c1e0d6c662431cda4b1783f037

Download Submit
C:\Users\Admin\AppData\Local\Temp\t.wnry

Filesize
64KB

MD5
5dcaac857e695a65f5c3ef1441a73a8f

SHA1
7b10aaeee05e7a1efb43d9f837e9356ad55c07dd

SHA256
97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6

SHA512
06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskdl.exe

Filesize
20KB

MD5
4fef5e34143e646dbf9907c4374276f5

SHA1
47a9ad4125b6bd7c55e4e7da251e23f089407b8f

SHA256
4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79

SHA512
4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskse.exe

Filesize
20KB

MD5
8495400f199ac77853c53b5a3f278f3e

SHA1
be5d6279874da315e3080b06083757aad9b32c23

SHA256
2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d

SHA512
0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1DDC.tmp.cmd

Filesize
27B

MD5
185c6a1a6a67aa56376895e9af1c844c

SHA1
554f3bd4b28be7417a7110ae53fb9b2020ec5849

SHA256
088b26648dea20201ae89c10eb3f6ceb854a6059a43af918bfb654cbe8b07f3f

SHA512
465f688c6bc666c954b5dc3c45c8bd3f8340f23c1f21ec75e07cbc6c0e12009c57ad293eb0cecc54d1904fd9f7407a2efec8021d2bcfd935668400d7426de51c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD219.tmp.exe

Filesize
3.4MB

MD5
84c82835a5d21bbcf75a61706d8ab549

SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\u.wnry

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
16KB

MD5
f21f35a4e1a3e0ef76cad6a5f439985c

SHA1
7cc6b0b8aebed592d1ff5a9c3e51851f422ee044

SHA256
6917cd09ed5e397b853533416a2be1da597d5245796c9e31d5eedb7326aa63f6

SHA512
dfce77e2b8dd3b196c5a01ed71439bb68b6148071dfebb86a5c99173da8b76c776b4c817293ed5281449faeb6c0a14c75e1dffd86754eed8ba56a073fdb7e988

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\crashes\store.json.mozlz4.tmp

Filesize
66B

MD5
a6338865eb252d0ef8fcf11fa9af3f0d

SHA1
cecdd4c4dcae10c2ffc8eb938121b6231de48cd3

SHA256
078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965

SHA512
d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
5777149d440a931c564494fd536d611b

SHA1
1b7f4039d8c80ce1804a08f22166aa839c27dfd5

SHA256
e8c6e9607d074f930b742b1949fa9cf3a821bc4bc4cc7af26f8f93c4ea96e2b4

SHA512
05caec997656fc44d4f59e328364ad2f819a16957d7cf6866a375a1812c55cf208e48bc15302e41c9cbca69b27fb1a71e7bde517a708a1a05218bb1db5158de0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\db\data.safe.bin

Filesize
5KB

MD5
9ecf0fe7fa6ae821d770d37a54bfb68a

SHA1
adf596b10c4c90e821fe5bfd1eb7094eb64eea11

SHA256
0fd717be8880cfb7a3801996be9da666241b6d0a307fafbc366d59a015dee9d7

SHA512
11d2b155fc7fc08ed3bff35425628d6b53225c457ccca1640cec65fb9d984e00b81b71292679ae70f57bc29cda28e349d63e86ea388df95213a49304ea2e498e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\6f3c7806-8d22-4263-b527-f65108674150

Filesize
791B

MD5
8afee213a86e04a737a21ece08ca33af

SHA1
5f2c37aa12900b2ecc2be7699dae936ff52a2328

SHA256
add775526ee9c0256e3f58906d4303345db41f9706bfee8ef5f9daeb0db051db

SHA512
408f7211c45d2b7e195cf6077d38ac1441febdd880a40f45368637bbc9db27203768028e0813b00c6098e701e4b9004ff66b66c236abf83342ced6c0258d7cba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\7c104866-6d27-4ef0-8181-afccd9bd7b4c

Filesize
1KB

MD5
3e2e4a84bea33a03a8b5d427890e4c59

SHA1
d3d2f8e6f5b5c1ef4fc19ea7c60745363a2b74ce

SHA256
50841e86632e40bc0755541bd500eb3c42ab84a70dfef94b814486a2c9dbe7c7

SHA512
99951d9f8e37297c70ad2f8b022ef0b36fddb0c00b528ce8a5ae8ebd2fff439472bcb582e2101bbf8e04abd81546be7ae6294a8c3f7ebfb325c0dbe6f827afc5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\93145a82-f51c-4463-a9cf-ea1524452764

Filesize
9KB

MD5
433061536a14836db358082b5a8862c2

SHA1
1afd66979c7479ef9901f972b8d21c1349194410

SHA256
ef6ecd9b6f9c7715322e753736c2cf007bd3e1b4b782f448dcc50945294b0207

SHA512
be73a7e0f41f6e3631dd0d7fe783e5287a7cb33df3102252dcc9549da7d9a7204be12a334fa0d21067dea64056890a9ad5eec09d6673eaa290c55dd2e2abb26e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\fba1e4f5-1197-44da-b974-b097ece15ae7

Filesize
746B

MD5
7e1c6c06e904cd86282d03b2b0b7d1d1

SHA1
e522d0e560314a32a5fef5037a6393f6811455cd

SHA256
a3ea5f38c3ba8a4abf8b702a5d366af9e9df478eb2df76530e3f311b31e23ec4

SHA512
77083b088b7f49bd22f3e5bdd937637d9ff238e30c1199d2ba14b5b3149537baf90c088db62e427cbf5c34c5ac562818be1b038638a5d36967d1043199056f27

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\extensions.json.tmp

Filesize
42KB

MD5
7b92524a1371a48e0f60e4305e19ed7a

SHA1
2c4819414be11c2ca2524d1f19bae00a37815b58

SHA256
bea9d8e8595b2ce4fa02e12c3194c36c4d472b57e6a42afac3f76f2255e11280

SHA512
cb1949387aaec377ff67f0b81575692f18522d1a5c5f095a99208808be12fc5d019719968cb9697ed2cdaaedb5f351e43fab835217914a26635590f1139590f9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\key4.db

Filesize
288KB

MD5
2bfc344f1cea37377c6c68e10a6dd0e1

SHA1
53dc2d08426993397660550ad0abbd6b0acabc2a

SHA256
dc08b6b8b8f35435e257d87359eeff14151681c999420e2982259480befd1744

SHA512
c56bc44ccb0a08087efb750bf71e54ec55d0075adb338a858a5590ac16098d22b305c3a45170133411f2c173cfa3332d6223b6f6f848e11e8382c18644b80cff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

Filesize
5KB

MD5
bb4d4ad13f764fb6a5107c4df56727aa

SHA1
5e144cf18daaf1255d0115253e81604f32d4456b

SHA256
ef0d99166de019f9ee39acffee2886aaf000ee5ffbd8d9ec670645072e96bd0f

SHA512
f806966d7948300cefad98a39d9286a09a61afc7c01800044f7b9720c944612d118754caa3b1d70c5be3497926a4916776b621312db35465f8af70b7a32d19ee

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

Filesize
5KB

MD5
1d6b4686efec544917baa5ce91a8b646

SHA1
578079ecb015e62fcaba054be376ce31510329ed

SHA256
fb8057eb2fc13245c260ed000b88f7d7f907d404429ea1180f182e4a8916865b

SHA512
827b5ad2616c0ec27eed20992c29a6f83327c0b7069ba368ed84af7864cb0c2523b12a336ce6e519f09c91b388e4dbca1c82d31b9e6f2150e854b98776f2c190

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

Filesize
6KB

MD5
9ce5a634e2db2d15a19e30b7c70d68a8

SHA1
73bde5fb3483d1428c724c9cdfa1b1c94e35b389

SHA256
045880af3618d03aab261b14f12c2072145d398c4b5359b94477a0a1d8c26a91

SHA512
575142e130646d75b8ecaec6a548bea303a0bc63c6decbee1dc2b801e1363c9d955b5c78d0773b19dfb25cfe35551698610eb487b73a7bac53da2dcdc170e4cd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

Filesize
5KB

MD5
430799eb254f1c3bc1d5e28f7d1e4b84

SHA1
56c234e7b598270d8987bbfe1c7bada1c59b32fd

SHA256
974da4a1ed6ee77333422c518c35631afdab897f702125338b9998fca830f175

SHA512
3cb608a75e92e80f0209fd1a75741125499f92461f54db336a78aaf13754bcf70acb58d2d3dd0abe5e8eaae6911b1a6e3886cdc437fe4901b376acebf5cbb4c8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

Filesize
6KB

MD5
1da1e39704d1f89af13e63ee968f25c8

SHA1
b35c619121e4453d067fd6e710f439d85c19e8e7

SHA256
7cbff1aab9a24ed78e707f84ac776f48e610ff36dae936e0d31915b09185d785

SHA512
d0e89d0525c6447784f902b01ba0e8d1b9c0c49e323184b02c6386428ec7a9309427ffa3f8da84470f30f23e12d7010d1bc397832ebb993bc817d6e5a44dfdba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

Filesize
7KB

MD5
f1213029565c56c46a1d2c923e977491

SHA1
b41a9a47151adbf2e4f1c6db9fdaa79db6679062

SHA256
4ddc8cc4a060443b52f7dfefcd36a96c85915f38a2e307eea473738664911aab

SHA512
82528123ff28f283df3be972dd48220182c6be1d462b23f0be048671a0533da9ef63d14ef7c078c71623eb760a2c138b2ba5eadc9dfa5e751ce1d7f74b55b717

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

Filesize
6KB

MD5
0cff4d5c8a35a704dc08ff332287eef6

SHA1
52427f710e3cac04bde583303ce539b2c0bb9dfc

SHA256
d619b6868ae13dd58264032a9f2c309c8c098fa2857a57e0a307b73ba44d7061

SHA512
d7c394d3e41980af8f62f9a9891903a8627a1d31ee44f463a97df7f93cca07154a4086f827e2c75cea35b8b69c36908d07c542cf0291bd7ce5ae30c75c73585c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs.js

Filesize
517B

MD5
8605504d7cc2b9714fe3dce5bd6b7d08

SHA1
f04083e639edd07cf1512f7cf4900b7955584573

SHA256
eb0e79470906c6a66173140fb2adbf06784eddbbbc34c8c1b6c02da6218c14bd

SHA512
0ce44003d262d301a836ae2141c7d1b2183229cf6868e122559b7193588f44cbc530b37320773107512fd1fe50356111474f8a98a514c772421cb85a4179c371

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs.js

Filesize
6KB

MD5
ab5a8aff7ed279422382b0bccd805943

SHA1
e27948898d41e6a5c2baf0bbc9e3fd767c68651c

SHA256
de89ead909c2618327e5e94803f647d45d4c048e44b5d6dd572f03ce1cc4962a

SHA512
6ed2f08b167bf1475845f2ff90f0d294431ffa1ea080c2440000ce5e68dd383fe70ecb4cd121323aa2ddc3a96a539ee6cb60b3e652821d6a8a6845de0696e40a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\search.json.mozlz4

Filesize
280B

MD5
41d220d4783f67d2b57beec20c135229

SHA1
6e97765e77920b6010fac2cb4abf1e3cea106541

SHA256
5d1881e74d76b95bad59439bb5c7676258a4ae6b6d853074e93b5247cf1715dc

SHA512
dc30ddc4c8cfe598de5e24bc88cebbe4256fbb21a0b1db6c2ec15311053e7d8be6a93a0bcfcfd8a02543f8b9cf9b15a5840154b272a2df71d59d7dfd80984ac0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionCheckpoints.json.tmp

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionCheckpoints.json.tmp

Filesize
288B

MD5
648ea624280e409ac3a7f120b5e9000e

SHA1
168bd9dd85eb0603e0db6bef23a0df64f916bf83

SHA256
ea208bf36fe4e150165db9ff5972004c6f468114058d6dbe5d0350f85e8fc08a

SHA512
49520e85cd86cdb0b9fcefecaabc99ba3915ed5ce0b622ffe752de94df6d1fbf3f2fbae13ee18397b32477aadfb23280e42be6f92ec1c74feb4f246c60eb7e32

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
19KB

MD5
e895ea0d13745783af0c1bfec9c083e1

SHA1
fe7efaa32c1ba546c317f8748b400ee78ed9c4fa

SHA256
3e966687ca38be1625740e81ba62e9b158faa943a715a896b854ea23f1f7d2b9

SHA512
cfb0ca2fe24b395f679aa96cb530b6f65b3127c3b4912fb041d8a209053fa07e23a20a321c173f786802ea14d2c20b146adf927b3789d8c9c98fbd5b8dec2a2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
812bda5339a590a27b3258af265dd8b4

SHA1
72e7b50bb655e1c8ebcf441a94301eb747469e41

SHA256
3fe824a393257848156ea84bad372bd57d1d44c6e1a51754256cadaa885e2c72

SHA512
27950f2deb238b92dfe7c39284e764265fcb603550da17cdbbc52bf47cc6475c0c77d692fc3b1c1223649e93a853e469d6f63b0ce6eab447a24fbe90212d385e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
e7016800be2d42869e0f62a4ab57dc51

SHA1
e22495e8f19c9e02181ca96ef42085cf5f7d60b9

SHA256
c6dcee12a8d2018d11cd31ce91017e2768ed1e724b859d33139b7cc6b5e66b99

SHA512
22eeb3408df12c967967ef750f66334e4b123966abff778ad9df29ae2433025a86d24fcb847b73374f186b0d7ea40f0ae0c38f6cc3b5300c369f7f7b19934627

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
936c3b8e5fe4aa09036cc477e3c0b662

SHA1
c9de8bcf40c88ebd178e43a8b3c74bbfc294c72b

SHA256
4b274452a5022a3ef675463b26027231c65db5518e59402ab7bab4f12ceb8f1a

SHA512
fd36a93725cb4ded08b2466356bf102f48d5648c300b80c4d35458dc9719acfa6e9bfd28a92e8ec49c8b937b5884dbf9ba23f60d3292ea833115549a1f2fd958

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
16KB

MD5
874f7dce83b319ca94227a66cfe8e4a8

SHA1
79f193b06b1988623486be0a032b6ad879ea3bd2

SHA256
0a4427f8ab3ae8469cbd4c9a2af27812a0264f41e11a0386a223a49dc85e93ea

SHA512
7cc1b46bbe652d8f94cdb1d07fa03556c5102a419ef98dfae41976cc92d93c95cbdf66fbe7f7a60852fb624e58fb11f1e4ea72b211cc364c98091836526ef435

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
4b5019e5aa32eb69e5d234c89d9a82fa

SHA1
3d85743f8f701f93a522e9629a4ea58b66af0f89

SHA256
6da336c8370122d6d7f39a20fb47b4b3ca2124759840f41c8a00eb42062efd57

SHA512
c4fc05847a337d634cee69e33d67bc0a7dc64d15bce64ad9e5db5254836b044bf7191ad19ce34af26af847b20f9c01f636651a53931e58960d6769e7aebb9c61

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
e803192fe24b3bdea1a403ef1eb3ae2e

SHA1
596e90b8b4b4698e294c1722720e809abbc45663

SHA256
11bd35b52a91cb14bbaf6a3fcb5df870eec70d66e8d6f9e6c7eeef87ad4360c5

SHA512
7b8a2a2f83bd0afa13980aac240c421c28ed4c4ddc84a1efa22b116991e575a0d047f74ee35086ad1db54aca9132e3baad68f731d165487f11efc8bf5d142a1f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
21KB

MD5
a8cef027fc72b4d9620ba2ff6688620e

SHA1
687fb7f461983692014a07ee4a4b2f7922f1c935

SHA256
6d43ceee030f1177d62b3351806f8ef8cffadf4923078070675752eb1e9d75bd

SHA512
03503cf42a40c8d36cf4618affeec79fa6dc8ec64feb822fa250ed2f003e757f1d1e5a5c310ea207c77baa0cd1d54f8dd30cbde6c34cbe2b5f9e38619343c62a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
3b9ff581d663f14c9314b67235cd57fd

SHA1
155b4b4a09d6a76dcf5323bd1bab0eeb3cacb562

SHA256
79853cf5ec4690a73a87ef0332eb91c11ce171193fa2e32808c6819e480ec1a3

SHA512
1b2fa20147ba180d755ddb7a8ee3b1031739a6e5658cbb834d6cc6e86617750bfb5e0f62e30f310ae5db77fe86abeb137f874e51440424472c7789b52cffdec9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
32c0924d34f6fee13435f40ba6d9dd44

SHA1
d7b3436945f675c308464d3355fc1ddc2a98e177

SHA256
2e4c39944384533eca96a2e0095c39bac0749e49ba3dbf99418c8a82811bca27

SHA512
05b163764bc26ae10762632f759957d24e2d614d2eb19991fba297f1b26db1bbcf80caa399b719f9cbf7d41494e52e91dcc936bd29ac86061f12747a8a14d98e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
63ba12f2d6efa98efe4318abf2a38453

SHA1
df13eb94aec2d6b8bc07c7ce90356948940da1a1

SHA256
a4343a50ab7f2558491a8592582004bb68122f24e7111952d42f8d7e59b6b5f5

SHA512
1796d6fcfc6bb39273be77faed8bb8016e106b0588a6d7c1e19567d79cd5b0c525d02569103fe51819de0da51aa316bbbeef9935bb1be03cadfc77b1b2996165

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
c992fafe81c512f7fa22eb4d99187107

SHA1
e57d4d056dad1fa790203a274823a8e66fc32031

SHA256
b432e5f01cb45c9fbbaad55a84fe615992c815b2c9349ae891d2066681902412

SHA512
41bc6f75a76650f5b9ebfcd91afd5a605a33b785c8b0e900b958c8f61f94fd84ca36826ffdc70c0f84de0eb932540bb6832a1e6b14673f96b2cb137e8897700c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
13KB

MD5
95679ddc14f5353ccf048f74f5962eee

SHA1
173e429597d0d44840a8a6d4559d0dc8af6a6dc6

SHA256
57be0dca272e0357476f0e93be758318ab71ccac81e237e6a161708bed9a6686

SHA512
7320e09dcd4ebed219820c46859115a7b77148a3bdc74bfbc80d5d0d244b78db288f964f02efcee9e90ad6bf47cbc3bca2e20fa6192615326b358ecd51392336

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
afdefe396638ac32f39fc9e793d86cfa

SHA1
770025770be0f33052897ebe1fc2b548d2845c76

SHA256
96c9165c0eb07e4b1799777c5dcd252d936a9676f677dbcd15bd2aef2404dd94

SHA512
de91cccc87d2b013b90945cd38f68d2528f0d4edc19c6ff3c97079629d4b811cbcb61e3190cf6e3a153b16ee1dcf2e4b26c250cbaf951a9782ff518e25b913ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
13KB

MD5
b09d7e44f4531b1ecf484b8d7998d6bf

SHA1
f4aacc52ab47b42a3264b567c4f95f2254f338c4

SHA256
638fd63da03c78fa169d97f624c716fb9279bef2a5c057cb1ca1634ffa9b0806

SHA512
179de63649232161db8ea0780d67a1ba49a8a5c5f26bd444d9c44eca2886b0cc3a047c5229702abc89c4486881fdc96d83ed1f12e876a09c1411a2fbdcb4454b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
9c56794c5626be0702963e2448d79709

SHA1
2bbdcaf270029185906479b38f856903736ff130

SHA256
8643790a9a73d67da64cd058cf7ada80092694a334db126b40101be629bfc84c

SHA512
3ef2482e06113da884a46f9c5b04ae107d6b897803574d1702724e8132946292cd1796207f9ad08a4ece4d28e833dd8d12c3346e2774c96b839547aa0ef562b0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
1d1a314d9f65f4214b68385c9d522195

SHA1
b886a6e8f0e678c2c39b56dfddaefdd7189aab32

SHA256
b8782b8fdeb10e9e94da8d36c6d184bc94ae0f80482aa63067809d7af3ccde0b

SHA512
386136a82a35f291cb01f7f1130f02e77a84acb61b59f36eea9aa00357feec0bb6eae8c13686d01e0722405c7d719be35f94eab84936d8dfc6fd23090c8c1755

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
13KB

MD5
1d787e04dbd400afa19c7e232ace1baa

SHA1
bdf1080fa4c288a735426ab3893bfbd6e6ad3086

SHA256
4691e4eec6ef8f6cde9d0fd49113a20aac726e8457986686d7e4fed911ed6df0

SHA512
561ea88982f1e039abda3316a83897c85f4629b20ad7d1881f9f56929b95e637cacb9d4dfba80bf12c5751228bde1873b146450eff87cd3a530a192c20bc6ece

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore.jsonlz4

Filesize
13KB

MD5
47eb1180aa4aff5db21d4b578d4912b9

SHA1
65f9d731a0608b4bb7341b9436beae9fa9497a5d

SHA256
a6873c5e1b16fed22524246a2a71378a9a75fb2c8d3261b4505f79b0a424cabf

SHA512
95769c78ff40fa5a69e7946539f0aa24512d4d89e69f51eb941b84a1e92aeaaa208cec7fb0dc86613185eb0bc89695dfc2d582b04033f3b1655bf5a043070159

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\default\https+++www.roblox.com\idb\3140325527hBbDa.sqlite

Filesize
48KB

MD5
dec0207d80ba341bba49071001eb6251

SHA1
db876da1f4276c2cb8a20eda5e64cd90e0406c85

SHA256
0d83fb80636116ad547f0243c286635396554659fda0f07e5cb85afd61c144ef

SHA512
05834f135f6fe2430ca2bfe0b113c3db905767a51fdf2e04d159e6d820cdb83a32995adfc3610e829c7fe4d23c8f5714720bd4af4bcada48d3b102d8f68bbcdf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
192KB

MD5
d606c1fdbdeffb3d5cb0c933acfeb923

SHA1
638b90b094c596fbecc139a8f90fa2bd0483dfd2

SHA256
885aab573662a43568b2948e7212af2591f22a2e9536a1a643a7665bf0c61704

SHA512
f407681dff329b858786084e0d5c186f64c644aa6a3a36ab3119a71c35d9fe9c27448770634148fbd7b5602bab4665406f42ffde48805b95c690b95f52dcf552

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

Filesize
5.6MB

MD5
989fe9594b374f871596296e93fc70b7

SHA1
2f73b1a1df457511db50d34f5866ea5a099cd9d0

SHA256
d5b8bbc424f39fcc27528b42cacc048b221fd2c287d07df734ac88c15b9b48e6

SHA512
86ccd861fa5719e92b738af18ff26c793de825a2322c3dc8bec69ce1300ab6f8a790c10a67960fff9914ea5c806a63e71d01e8dc7b9ab5de59fc3c96acf188dd

Download Submit
C:\Users\Admin\Downloads\NjRat.4jd6cjgi.0.7D.Danger.Edition.zip.part

Filesize
26KB

MD5
c8e41d4e44a5e06c30c4c31df53bc887

SHA1
2b2c658057460d2e238643ffeb94dbfb25272671

SHA256
0bec852d177e4eadded8de2718db29feaa2575ae975f4b01608ce0b9c30ef95b

SHA512
7f59bd1ea6239eca5cd252c2b436b8e2c9b8c6134f150917dcf29b7889cf1f65ec381eab304ec65110dd444797ca2c78433257593399f5609fd5869972e8a799

Download Submit
C:\Users\Admin\Downloads\NjRat.PoZ0sMky.0.7D.zip.part

Filesize
15KB

MD5
986c30440cff83a105bc3d4bb1f297e7

SHA1
7dffb98a19b48134cbf2ed7c547ea2cc012d60ac

SHA256
f23e6f862a829416c999a850f171e7a7cee485d649d636afef850d82e1954582

SHA512
b8520bbc00686271c9d8ac7da3a3f0476a77ba97ac4b31b1410eabe3430137d3aad1a24a426769e01d0884173897548e941fd148c9f7aef92eb76a206bed5a0e

Download Submit
C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.J4CSBxj8.0-master.zip.part

Filesize
3.3MB

MD5
017f199a7a5f1e090e10bbd3e9c885ca

SHA1
4e545b77d1be2445b2f0163ab2d6f2f01ec4ca05

SHA256
761e037ee186880d5f7d1f112b839818056f160a9ba60c7fb8d23d926ac0621f

SHA512
76215a26588204247027dcfdab4ea583443b2b2873ff92ad7dd5e9a9037c77d20ab4e471b8dd83e642d8481f53dbc0f83f993548dc7d151dead48dc29c1fdc22

Download Submit
C:\Users\Admin\Videos\Client.exe

Filesize
30KB

MD5
0505cd35e6e6a7e0bd84a0fff677cc01

SHA1
c344e3064dfa3ca4b0a849bad667be0fcf9a1deb

SHA256
03a34d14f0e6d7756612dc88435f6a409e2cdec4ebbbf1db672f1db72bc2046d

SHA512
a46a0b241171f1891f1799c6a064e8de15c6c3fc935b0e4c39cbc2488b10135d48f76fa6322d3ceaedb5e3c95aed3ae5676ce938092bb27ac94dc0c8e5c17456

Download Submit
C:\Users\Admin\Videos\ER

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\Videos\GeoIP.dat

Filesize
1.2MB

MD5
797b96cc417d0cde72e5c25d0898e95e

SHA1
8c63d0cc8a3a09c1fe50c856b8e5170a63d62f13

SHA256
8a0675001b5bc63d8389fc7ed80b4a7b0f9538c744350f00162533519e106426

SHA512
9bb0c40c83551000577f8cf0b8a7c344bc105328a2c564df70fabec978ad267fa42e248c11fb78166855b0816d2ef3ec2c12fe52f8cc0b83e366e46301340882

Download Submit
C:\Users\Admin\Videos\Mono.Cecil.dll

Filesize
305KB

MD5
851ec9d84343fbd089520d420348a902

SHA1
f8e2a80130058e4db3cf569cf4297d07d05c93e0

SHA256
cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9

SHA512
5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1

Download Submit
C:\Users\Admin\Videos\NjRat 0.7D Danger Edition.exe

Filesize
8.2MB

MD5
eda04645089d60f5cb602c8012a33e07

SHA1
85ae9d1a404d0a2063bee3d8d7bb9bef233fa71a

SHA256
e6cff62a0e8e7c654eec97093a1295773f223cd3a6a11f65c91491cfbd6be751

SHA512
fe9a1bddd90aabb6f5abb1d15666e75ab3c6136d1dbf2c79f0bbcd1dffe2089ac8a73ffe11b3d1cbbd6b393fc51f921fd5c50bf490a38e9038d2c366aaa9468d

Download Submit
C:\Users\Admin\Videos\Server.exe

Filesize
93KB

MD5
fc393e3a7b81f574693bc635c34f92b7

SHA1
543f79dbc11835e393bbd76ab5cc77c236dac196

SHA256
baa92db6a3aba3e86ae1e12c3162dd7822c8f926873cdf597e3bd2fd8adbc66d

SHA512
2ab181d976969f90113e838ad66504d7c8fe899b4939dc5ddac6a0c8389c523ec42b52d0c201dd6327b05bf4e500bd2411090da29ab61c06cbc0231428077911

Download Submit
C:\Users\Admin\Videos\Server.exe

Filesize
93KB

MD5
d2b1effc1f7c566b63104d5a626cc2a3

SHA1
6771c5f428f2364d93f6e43846073eb196c1bbd3

SHA256
689ce15078c00bba81022577def70c3e99bcb28bcb63233972b5e8ded63914e4

SHA512
9cfecce6c3a8e1c0e7c76619933b3b583a254a8f39cee8ad75a2c0e1242bb1604e67003c7dd2bb9d166d6eba3db87fca53f3066f60d273e073c26c885c511eb3

Download Submit
C:\Users\Admin\Videos\Settings.ini

Filesize
15B

MD5
332f4072f2109e4d81f2701c2387b186

SHA1
36bbaf7dfa5a6d6d52ab04f533359f3c65cfa8e4

SHA256
17f547710bf4fefb27ff4470e0f78089c4888567eec25380e136d9fde1e02276

SHA512
53841fa1fb9f0fc1c6633e863f1195d27c8dfed1c0caa7ae519d224893eab3fb23487b130539b5c1839eb8aa99d51b3450b6d15cc63275c0a32841897c84d67a

Download Submit
C:\Users\Admin\Videos\Stub.il

Filesize
1.2MB

MD5
abe394d9d5139ff9c586aa7dddc97e68

SHA1
6b3ab81b04af61685cd480a41bc953cd6a963f90

SHA256
78a156fe7e6900ece45fdd25516c0f9ffeb2083ef3d62685f189fb5ef5a9a0a5

SHA512
30a7d44e319ef500802edc4c74c9bf39bf43ada220427c230973aeecd71f18f02466c824332cc265b96622b6588bda472f3949b1ca3d81bdaa4d6e617bf2a114

Download Submit
C:\Users\Admin\Videos\Stub.manifest

Filesize
487B

MD5
4d18ac38a92d15a64e2b80447b025b7e

SHA1
5c34374c2dd5afa92e0489f1d6f86dde616aca6c

SHA256
835a00d6e7c43db49ae7b3fa12559f23c2920b7530f4d3f960fd285b42b1efb5

SHA512
72be79acd72366b495e0f625a50c9bdf01047bcf5f9ee1e3bdba10dab7bd721b0126f429a91d8c80c2434e8bc751defdf4c05bdc09d26a871df1bb2e22e923bf

Download Submit
C:\Users\Admin\Videos\WinMM.Net.dll

Filesize
43KB

MD5
d4b80052c7b4093e10ce1f40ce74f707

SHA1
2494a38f1c0d3a0aa9b31cf0650337cacc655697

SHA256
59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46

SHA512
3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450

Download Submit
C:\Users\Admin\Videos\nj_users\YBQDFVLH_Admin_12B51BF\@[email protected]

Filesize
1KB

MD5
b4936328caac9d6f2d3eeb1228bd6780

SHA1
c2ca04593a1c9c753bc7d4d309bcc2086c07b1aa

SHA256
e4503c3e154cb376b948c1ffb8855e28e89cba08cb59644b33a5173c7cb1f416

SHA512
e3d29aa6d96677c2c53b2219819171bbecc9a5d5afb7e4d5aa27ab75765b6284a5e2781db15a97b64e198cd94181710819671ecdb374bc314d35e7e9abab1ac3

Download Submit
memory/400-601-0x00000206DA900000-0x00000206DAA00000-memory.dmp

Filesize
1024KB

Download
memory/400-599-0x00000206DA900000-0x00000206DAA00000-memory.dmp

Filesize
1024KB

Download
memory/680-4520-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2112-542-0x00000000733D0000-0x0000000073980000-memory.dmp

Filesize
5.7MB

Download
memory/2112-543-0x00000000733D0000-0x0000000073980000-memory.dmp

Filesize
5.7MB

Download
memory/2112-1446-0x00000000733D0000-0x0000000073980000-memory.dmp

Filesize
5.7MB

Download
memory/2112-509-0x00000000733D1000-0x00000000733D2000-memory.dmp

Filesize
4KB

Download
memory/2112-510-0x00000000733D0000-0x0000000073980000-memory.dmp

Filesize
5.7MB

Download
memory/2112-511-0x00000000733D0000-0x0000000073980000-memory.dmp

Filesize
5.7MB

Download
memory/2392-868-0x00000255FA150000-0x00000255FA152000-memory.dmp

Filesize
8KB

Download
memory/2392-617-0x00000255F8BB0000-0x00000255F8BB2000-memory.dmp

Filesize
8KB

Download
memory/2392-944-0x00000255F86C0000-0x00000255F86D0000-memory.dmp

Filesize
64KB

Download
memory/2392-621-0x00000255F8BF0000-0x00000255F8BF2000-memory.dmp

Filesize
8KB

Download
memory/2392-738-0x00000255F9D20000-0x00000255F9D40000-memory.dmp

Filesize
128KB

Download
memory/2392-746-0x00000255FB400000-0x00000255FB500000-memory.dmp

Filesize
1024KB

Download
memory/2392-797-0x00000255F9E00000-0x00000255F9E20000-memory.dmp

Filesize
128KB

Download
memory/2392-619-0x00000255F8BD0000-0x00000255F8BD2000-memory.dmp

Filesize
8KB

Download
memory/2392-840-0x00000255FE560000-0x00000255FE660000-memory.dmp

Filesize
1024KB

Download
memory/2392-852-0x00000255FE360000-0x00000255FE380000-memory.dmp

Filesize
128KB

Download
memory/2392-857-0x00000255F9280000-0x00000255F9282000-memory.dmp

Filesize
8KB

Download
memory/2392-943-0x00000255F86C0000-0x00000255F86D0000-memory.dmp

Filesize
64KB

Download
memory/2392-934-0x00000255FC290000-0x00000255FC390000-memory.dmp

Filesize
1024KB

Download
memory/2392-863-0x00000255F92A0000-0x00000255F92A2000-memory.dmp

Filesize
8KB

Download
memory/2392-865-0x00000255F9ED0000-0x00000255F9ED2000-memory.dmp

Filesize
8KB

Download
memory/2392-870-0x00000255FA1B0000-0x00000255FA1B2000-memory.dmp

Filesize
8KB

Download
memory/2392-614-0x00000255F8E00000-0x00000255F8F00000-memory.dmp

Filesize
1024KB

Download
memory/2392-878-0x00000255FB900000-0x00000255FB902000-memory.dmp

Filesize
8KB

Download
memory/4336-4566-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4712-557-0x000001F8A1420000-0x000001F8A1430000-memory.dmp

Filesize
64KB

Download
memory/4712-573-0x000001F8A1520000-0x000001F8A1530000-memory.dmp

Filesize
64KB

Download
memory/4712-592-0x000001F89E7F0000-0x000001F89E7F2000-memory.dmp

Filesize
8KB

Download
memory/5300-1561-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/5300-1569-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download