wannacry | e2ecd9c38e7a59f956d075465dbcddd45f762711897eb485edb9966edf4694a0

Analysis

max time kernel
299s
max time network
301s
platform
windows7_x64
resource
win7-20240704-ja
resource tags

arch:x64arch:x86image:win7-20240704-jalocale:ja-jpos:windows7-x64systemwindows
submitted
03-08-2024 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[email protected]
Size

657KB
MD5

7c0d00670b90e6de5799e5c14c2f4246
SHA1

6236943887d6821f4dcfe8d1d9b2e977a2ddd787
SHA256

e2ecd9c38e7a59f956d075465dbcddd45f762711897eb485edb9966edf4694a0
SHA512

ae6d3b589e1b343c8ae9d4f7e2490e288e30b79a51ced6a605327958d1e438ca82b044403fede87d2d4a2debd88a03449fbaa9853ca1dc6805a7a9657feabff3
SSDEEP

12288:Q8eJgTBMas9UySVHl/WfHMwqIY5AunV+LggVwwQSQq51jkH71v2KQrOPp:tDTqhUySJl/WPMP5AIe/wwQSjYH71v2Y

Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware worm

Malware Config

Extracted

Path

C:\Users\Admin\Documents\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops startup file 2 IoCs

Processes:

WannaCry.EXE

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD7647.tmp	WannaCry.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD765A.tmp	WannaCry.EXE

Executes dropped EXE 23 IoCs

Processes:

taskdl.exe@[email protected]@[email protected]taskhsvc.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exe

pid	process
3836	taskdl.exe
1612	@[email protected]
2244	@[email protected]
1524	taskhsvc.exe
3432	@[email protected]
3976	taskdl.exe
4052	taskse.exe
4076	@[email protected]
3948	taskdl.exe
3976	taskse.exe
3696	@[email protected]
1744	taskdl.exe
2748	taskse.exe
1796	@[email protected]
2780	taskdl.exe
3124	taskse.exe
3044	@[email protected]
3204	taskse.exe
3504	@[email protected]
1360	taskdl.exe
1696	taskse.exe
3496	@[email protected]
2248	taskdl.exe

Loads dropped DLL 33 IoCs

Processes:

WannaCry.EXEcscript.execmd.exe@[email protected]taskhsvc.exe

pid	process
3348	WannaCry.EXE
3348	WannaCry.EXE
4084	cscript.exe
3348	WannaCry.EXE
3348	WannaCry.EXE
776	cmd.exe
1612	@[email protected]
1612	@[email protected]
1524	taskhsvc.exe
1524	taskhsvc.exe
1524	taskhsvc.exe
1524	taskhsvc.exe
1524	taskhsvc.exe
1524	taskhsvc.exe
3348	WannaCry.EXE
3348	WannaCry.EXE
3348	WannaCry.EXE
3348	WannaCry.EXE
3348	WannaCry.EXE
3348	WannaCry.EXE
3348	WannaCry.EXE
3348	WannaCry.EXE
3348	WannaCry.EXE
3348	WannaCry.EXE
3348	WannaCry.EXE
3348	WannaCry.EXE
3348	WannaCry.EXE
3348	WannaCry.EXE
3348	WannaCry.EXE
3348	WannaCry.EXE
3348	WannaCry.EXE
3348	WannaCry.EXE
3348	WannaCry.EXE

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1696 icacls.exe

pid	process
1696	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\oipzgxjd460 = "\"C:\\Users\\Admin\\Desktop\\WannaCry-main\\tasksche.exe\""	reg.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

Processes:

flow	ioc
411	raw.githubusercontent.com
412	raw.githubusercontent.com
414	raw.githubusercontent.com
76	camo.githubusercontent.com
77	camo.githubusercontent.com
78	camo.githubusercontent.com
79	camo.githubusercontent.com
409	camo.githubusercontent.com
413	raw.githubusercontent.com

Drops file in System32 directory 1 IoCs

Processes:

DrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\volsnap.inf_amd64_neutral_7499a4fac85b39fc\volsnap.PNF	DrvInst.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

WannaCry.EXE@[email protected]

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	WannaCry.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\co.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	msiexec.exe
File created	C:\Program Files\7-Zip\readme.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\be.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	msiexec.exe

Drops file in Windows directory 29 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip32.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.dll	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f79c830.ipi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip32.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zG.exe	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.sfx	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zCon.sfx	msiexec.exe
File created	C:\Windows\Installer\f79c87e.msi	msiexec.exe
File opened for modification	C:\Windows\INF\volsnap.PNF	DrvInst.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\f79c82f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.sfx	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\f79c830.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zFM.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zCon.sfx	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zFM.exe	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.exe	msiexec.exe
File created	C:\Windows\Installer\f79c82f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC90A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zG.exe	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cscript.exeWMIC.exereg.exe@[email protected]@[email protected]vssadmin.exe@[email protected]@[email protected]attrib.exeicacls.execmd.exe@[email protected]attrib.exe@[email protected]taskhsvc.exe@[email protected]cmd.exeIEXPLORE.EXE@[email protected]@[email protected]WannaCry.EXEcmd.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exe

pid process

3476 vssadmin.exe

pid	process
3476	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A3698E1-51A8-11EF-AE00-EEF1BA599152} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Modifies data under HKEY_USERS 47 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\6CF876C7\LanguageList = 6a0061002d004a00500000006a006100000065006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\6CF876C7	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe

Modifies registry class 35 IoCs

Processes:

msiexec.exefirefox.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420722210000010000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420722210000010000000\Program = "Complete"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\PackageName = "7z2201-x64(1).msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420722210000010000000\LanguageFiles = "Complete"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\ProductName = "7-Zip 22.01 (x64 edition)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\Version = "369164288"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\96F071321C0420720000000040000000\96F071321C0420722210000010000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Directory\shellex\DragDropHandlers\7-Zip	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\96F071321C0420720000000040000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420722210000010000000\Complete	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\PackageCode = "96F071321C0420722210000020000000"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Drive\shellex\DragDropHandlers\7-Zip	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\InstanceType = "0"	msiexec.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2748 reg.exe

pid	process
2748	reg.exe

NTFS ADS 4 IoCs

Processes:

firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\7z2201-x64(1).msi:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\7z2201-x64(2).msi:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\WannaCry-main.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\7z2201-x64.msi:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

756 vlc.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

taskhsvc.exemsiexec.exe

pid process

1524 taskhsvc.exe
1524 taskhsvc.exe
1524 taskhsvc.exe
1524 taskhsvc.exe
1524 taskhsvc.exe
1524 taskhsvc.exe
3240 msiexec.exe
3240 msiexec.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

756 vlc.exe

pid	process
1524	taskhsvc.exe
1524	taskhsvc.exe
1524	taskhsvc.exe
1524	taskhsvc.exe
1524	taskhsvc.exe
1524	taskhsvc.exe
3240	msiexec.exe
3240	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vlc.exefirefox.exevssvc.exeWMIC.exetaskse.exetaskse.exemsiexec.exemsiexec.exe

description	pid	process
Token: 33	756	vlc.exe
Token: SeIncBasePriorityPrivilege	756	vlc.exe
Token: SeDebugPrivilege	2628	firefox.exe
Token: SeDebugPrivilege	2628	firefox.exe
Token: SeDebugPrivilege	2628	firefox.exe
Token: SeBackupPrivilege	2548	vssvc.exe
Token: SeRestorePrivilege	2548	vssvc.exe
Token: SeAuditPrivilege	2548	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3528	WMIC.exe
Token: SeSecurityPrivilege	3528	WMIC.exe
Token: SeTakeOwnershipPrivilege	3528	WMIC.exe
Token: SeLoadDriverPrivilege	3528	WMIC.exe
Token: SeSystemProfilePrivilege	3528	WMIC.exe
Token: SeSystemtimePrivilege	3528	WMIC.exe
Token: SeProfSingleProcessPrivilege	3528	WMIC.exe
Token: SeIncBasePriorityPrivilege	3528	WMIC.exe
Token: SeCreatePagefilePrivilege	3528	WMIC.exe
Token: SeBackupPrivilege	3528	WMIC.exe
Token: SeRestorePrivilege	3528	WMIC.exe
Token: SeShutdownPrivilege	3528	WMIC.exe
Token: SeDebugPrivilege	3528	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3528	WMIC.exe
Token: SeRemoteShutdownPrivilege	3528	WMIC.exe
Token: SeUndockPrivilege	3528	WMIC.exe
Token: SeManageVolumePrivilege	3528	WMIC.exe
Token: 33	3528	WMIC.exe
Token: 34	3528	WMIC.exe
Token: 35	3528	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3528	WMIC.exe
Token: SeSecurityPrivilege	3528	WMIC.exe
Token: SeTakeOwnershipPrivilege	3528	WMIC.exe
Token: SeLoadDriverPrivilege	3528	WMIC.exe
Token: SeSystemProfilePrivilege	3528	WMIC.exe
Token: SeSystemtimePrivilege	3528	WMIC.exe
Token: SeProfSingleProcessPrivilege	3528	WMIC.exe
Token: SeIncBasePriorityPrivilege	3528	WMIC.exe
Token: SeCreatePagefilePrivilege	3528	WMIC.exe
Token: SeBackupPrivilege	3528	WMIC.exe
Token: SeRestorePrivilege	3528	WMIC.exe
Token: SeShutdownPrivilege	3528	WMIC.exe
Token: SeDebugPrivilege	3528	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3528	WMIC.exe
Token: SeRemoteShutdownPrivilege	3528	WMIC.exe
Token: SeUndockPrivilege	3528	WMIC.exe
Token: SeManageVolumePrivilege	3528	WMIC.exe
Token: 33	3528	WMIC.exe
Token: 34	3528	WMIC.exe
Token: 35	3528	WMIC.exe
Token: SeTcbPrivilege	4052	taskse.exe
Token: SeTcbPrivilege	4052	taskse.exe
Token: SeTcbPrivilege	3976	taskse.exe
Token: SeTcbPrivilege	3976	taskse.exe
Token: SeDebugPrivilege	2628	firefox.exe
Token: SeDebugPrivilege	2628	firefox.exe
Token: SeShutdownPrivilege	1556	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1556	msiexec.exe
Token: SeRestorePrivilege	3240	msiexec.exe
Token: SeTakeOwnershipPrivilege	3240	msiexec.exe
Token: SeSecurityPrivilege	3240	msiexec.exe
Token: SeCreateTokenPrivilege	1556	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1556	msiexec.exe
Token: SeLockMemoryPrivilege	1556	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1556	msiexec.exe
Token: SeMachineAccountPrivilege	1556	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

vlc.exe

pid	process
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe

Suspicious use of SendNotifyMessage 30 IoCs

Processes:

vlc.exefirefox.exe

pid	process
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
756	vlc.exe
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe

Suspicious use of SetWindowsHookEx 44 IoCs

Processes:

vlc.exefirefox.exe@[email protected]@[email protected]@[email protected]@[email protected]iexplore.exeIEXPLORE.EXE@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]

pid	process
756	vlc.exe
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
1612	@[email protected]
1612	@[email protected]
2244	@[email protected]
2244	@[email protected]
3432	@[email protected]
3432	@[email protected]
4076	@[email protected]
3100	iexplore.exe
3100	iexplore.exe
888	IEXPLORE.EXE
888	IEXPLORE.EXE
3696	@[email protected]
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
1796	@[email protected]
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
3044	@[email protected]
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
3504	@[email protected]
3496	@[email protected]
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 1020 wrote to memory of 2628	1020	firefox.exe	firefox.exe
PID 1020 wrote to memory of 2628	1020	firefox.exe	firefox.exe
PID 1020 wrote to memory of 2628	1020	firefox.exe	firefox.exe
PID 1020 wrote to memory of 2628	1020	firefox.exe	firefox.exe
PID 1020 wrote to memory of 2628	1020	firefox.exe	firefox.exe
PID 1020 wrote to memory of 2628	1020	firefox.exe	firefox.exe
PID 1020 wrote to memory of 2628	1020	firefox.exe	firefox.exe
PID 1020 wrote to memory of 2628	1020	firefox.exe	firefox.exe
PID 1020 wrote to memory of 2628	1020	firefox.exe	firefox.exe
PID 1020 wrote to memory of 2628	1020	firefox.exe	firefox.exe
PID 1020 wrote to memory of 2628	1020	firefox.exe	firefox.exe
PID 1020 wrote to memory of 2628	1020	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1516	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1516	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1516	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 1104	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 676	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 676	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 676	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 676	2628	firefox.exe	firefox.exe
PID 2628 wrote to memory of 676	2628	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

1160 attrib.exe
812 attrib.exe

pid	process
1160	attrib.exe
812	attrib.exe

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\[email protected]"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:756

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1020

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.0.1348482957\1762757865" -parentBuildID 20221007134813 -prefsHandle 1232 -prefMapHandle 1224 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7660938-6d65-471d-bb08-6c52d381aa76} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 1308 49d2d58 gpu
3⤵
PID:1516

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.1.1797554723\1496761114" -parentBuildID 20221007134813 -prefsHandle 1488 -prefMapHandle 1484 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {738c8058-cb9a-40cc-9b8a-3d87465ac653} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 1500 d72b58 socket
3⤵
PID:1104

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.2.1967487618\63238545" -childID 1 -isForBrowser -prefsHandle 2056 -prefMapHandle 2052 -prefsLen 20966 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {88e83af9-928a-44c7-9eed-9cdaf5325304} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 2068 1a576f58 tab
3⤵
PID:676

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.3.1811898463\776084425" -childID 2 -isForBrowser -prefsHandle 2808 -prefMapHandle 2804 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d7625a3-ab76-4fbd-9dc7-87dc2123badd} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 2824 1cd67b58 tab
3⤵
PID:1000

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.4.1185633918\953056339" -childID 3 -isForBrowser -prefsHandle 2928 -prefMapHandle 2924 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1167cd37-f28e-493f-a69c-e014db004ff7} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 2940 1cd69658 tab
3⤵
PID:1316

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.5.606591604\1385957065" -childID 4 -isForBrowser -prefsHandle 3584 -prefMapHandle 3740 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff158464-43f1-47f0-a131-bf8fc0e4160f} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 3716 1e813358 tab
3⤵
PID:2652

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.6.3126458\553867597" -childID 5 -isForBrowser -prefsHandle 3836 -prefMapHandle 3840 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {15020f3a-a198-42d1-b4a7-4e6d788da252} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 3824 2028e658 tab
3⤵
PID:2104

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.7.2028449679\112071974" -childID 6 -isForBrowser -prefsHandle 3876 -prefMapHandle 3872 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e088f5a5-61b5-4f16-887b-7a1649bbd257} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 3888 2028fb58 tab
3⤵
PID:2408

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.8.1767941697\848881473" -childID 7 -isForBrowser -prefsHandle 3564 -prefMapHandle 1680 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ad1a465-d107-4ba4-bda7-547d952a6a09} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 4340 22645358 tab
3⤵
PID:444

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.9.1920265171\1776343087" -childID 8 -isForBrowser -prefsHandle 3940 -prefMapHandle 4484 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8923965-8541-49f1-8fe1-7e12359de02b} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 4480 22764b58 tab
3⤵
PID:3812

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.10.689311887\38798706" -childID 9 -isForBrowser -prefsHandle 4448 -prefMapHandle 4512 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2102e72e-96bb-4f04-9d23-66d7f58df2bc} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 4684 25447158 tab
3⤵
PID:3424

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.11.1316594236\513211465" -childID 10 -isForBrowser -prefsHandle 4580 -prefMapHandle 4404 -prefsLen 26836 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c291b55-f98e-415f-885e-0cd9491818ef} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 4316 23bdc358 tab
3⤵
PID:2184

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.12.393439633\730998412" -childID 11 -isForBrowser -prefsHandle 8984 -prefMapHandle 8988 -prefsLen 26836 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2597695e-6e7d-4a8b-92df-d707081577ed} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 8972 25599658 tab
3⤵
PID:3672

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.13.2002247910\1305444151" -childID 12 -isForBrowser -prefsHandle 8892 -prefMapHandle 8960 -prefsLen 26836 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {443605f1-94f5-4e03-8b2d-5195d52efa8a} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 8896 107efb58 tab
3⤵
PID:3044

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.14.38817709\2095709826" -childID 13 -isForBrowser -prefsHandle 8820 -prefMapHandle 8804 -prefsLen 26836 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa57dc8e-b0fe-4fa9-bb00-885b8dcd984c} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 8840 107ee958 tab
3⤵
PID:2056

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.15.1061070297\1515526590" -childID 14 -isForBrowser -prefsHandle 8608 -prefMapHandle 8604 -prefsLen 26836 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c41a7807-7727-4d90-a5c9-b155b40f7114} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 8620 107ef558 tab
3⤵
PID:3520

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.16.592739107\45424075" -childID 15 -isForBrowser -prefsHandle 8764 -prefMapHandle 8372 -prefsLen 26836 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c60662b-52e5-40f9-8063-23e02775806b} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 8564 10861b58 tab
3⤵
PID:3076

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.17.776299241\2109561592" -childID 16 -isForBrowser -prefsHandle 8420 -prefMapHandle 8404 -prefsLen 26836 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {30f83970-3795-4707-8785-c4b672858363} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 8980 26295e58 tab
3⤵
PID:776

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.18.1705423242\1987570307" -parentBuildID 20221007134813 -prefsHandle 3548 -prefMapHandle 3504 -prefsLen 26901 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ae7cf34-4d6d-443a-85e5-957fc8b86ef1} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 1124 d63858 rdd
3⤵
PID:3112

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.19.1814513469\1747481112" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 8832 -prefMapHandle 3284 -prefsLen 26901 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9edd7d6d-c3b7-4c33-ae2f-26dbe8dc209c} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 3224 d6b258 utility
3⤵
PID:2692

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.20.1877204262\409159229" -childID 17 -isForBrowser -prefsHandle 8800 -prefMapHandle 8840 -prefsLen 26901 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {46153b31-0ba6-4b95-b995-bf8e94f13c09} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 4792 10734558 tab
3⤵
PID:3368

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.21.2118062464\884972794" -childID 18 -isForBrowser -prefsHandle 8724 -prefMapHandle 9016 -prefsLen 26901 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {271c4692-7361-43ea-a8fb-2ae31f90b094} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 3616 24441658 tab
3⤵
PID:2256

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.22.414808129\281396596" -childID 19 -isForBrowser -prefsHandle 4672 -prefMapHandle 8800 -prefsLen 26901 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {92ab30cf-6e21-488e-a098-dfe6a566aa80} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 5072 2444e458 tab
3⤵
PID:3624

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.23.318884310\1759875734" -childID 20 -isForBrowser -prefsHandle 8996 -prefMapHandle 4288 -prefsLen 26901 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {435d1071-32a1-4020-8f61-a81d1b1480f1} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 8100 218ceb58 tab
3⤵
PID:4188

C:\Users\Admin\Desktop\WannaCry-main\WannaCry.EXE
"C:\Users\Admin\Desktop\WannaCry-main\WannaCry.EXE"
1⤵
- Drops startup file
- Loads dropped DLL
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
PID:3348

C:\Windows\SysWOW64\attrib.exe
attrib +h .
2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1160

C:\Windows\SysWOW64\icacls.exe
icacls . /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:1696

C:\Users\Admin\Desktop\WannaCry-main\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:3836

C:\Windows\SysWOW64\cmd.exe
cmd /c 96971722696759.bat
2⤵
- System Location Discovery: System Language Discovery
PID:3952

C:\Windows\SysWOW64\cscript.exe
cscript.exe //nologo m.vbs
3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4084

C:\Windows\SysWOW64\attrib.exe
attrib +h +s F:\$RECYCLE
2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:812

C:\Users\Admin\Desktop\WannaCry-main\@[email protected]
@[email protected] co
2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1612

C:\Users\Admin\Desktop\WannaCry-main\TaskData\Tor\taskhsvc.exe
TaskData\Tor\taskhsvc.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1524

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b @[email protected] vs
2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:776

C:\Users\Admin\Desktop\WannaCry-main\@[email protected]
@[email protected] vs
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2244

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
4⤵
- System Location Discovery: System Language Discovery
PID:2976

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
5⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:3476

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3528

C:\Users\Admin\Desktop\WannaCry-main\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:3976

C:\Users\Admin\Desktop\WannaCry-main\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-main\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Users\Admin\Desktop\WannaCry-main\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4076

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "oipzgxjd460" /t REG_SZ /d "\"C:\Users\Admin\Desktop\WannaCry-main\tasksche.exe\"" /f
2⤵
- System Location Discovery: System Language Discovery
PID:2952

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "oipzgxjd460" /t REG_SZ /d "\"C:\Users\Admin\Desktop\WannaCry-main\tasksche.exe\"" /f
3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2748

C:\Users\Admin\Desktop\WannaCry-main\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:3948

C:\Users\Admin\Desktop\WannaCry-main\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-main\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3976

C:\Users\Admin\Desktop\WannaCry-main\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3696

C:\Users\Admin\Desktop\WannaCry-main\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1744

C:\Users\Admin\Desktop\WannaCry-main\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-main\@[email protected]
2⤵
- Executes dropped EXE
PID:2748

C:\Users\Admin\Desktop\WannaCry-main\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1796

C:\Users\Admin\Desktop\WannaCry-main\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2780

C:\Users\Admin\Desktop\WannaCry-main\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-main\@[email protected]
2⤵
- Executes dropped EXE
PID:3124

C:\Users\Admin\Desktop\WannaCry-main\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3044

C:\Users\Admin\Desktop\WannaCry-main\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-main\@[email protected]
2⤵
- Executes dropped EXE
PID:3204

C:\Users\Admin\Desktop\WannaCry-main\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3504

C:\Users\Admin\Desktop\WannaCry-main\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1360

C:\Users\Admin\Desktop\WannaCry-main\taskse.exe
taskse.exe C:\Users\Admin\Desktop\WannaCry-main\@[email protected]
2⤵
- Executes dropped EXE
PID:1696

C:\Users\Admin\Desktop\WannaCry-main\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3496

C:\Users\Admin\Desktop\WannaCry-main\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2248

C:\Users\Admin\Desktop\@[email protected]
"C:\Users\Admin\Desktop\@[email protected]"
1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3432

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how+to+buy+bitcoin
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3100

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3100 CREDAT:275457 /prefetch:2
3⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:888

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2548

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2201-x64(1).msi"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3240

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005FC" "00000000000005F0"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3492

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:3692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f79c831.rbs

Filesize
26KB

MD5
66a7df3689a5f8944eab3082090827be

SHA1
e09f87163b43b7ac792123c61d21e8a74c01147a

SHA256
0d842311a2ba296a7dd8071e814766f0aa570201640f661286ca10175b5f3fc8

SHA512
cf2b2ae85d3fd453938a8292d33eaea0f5edb35c04e3cf2d9e3fd0f52645cb624cc78aecdf58932fd519753f3ccbe6940d2009386353ba8c1d19385501b1e86c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\activity-stream.discovery_stream.json.tmp

Filesize
24KB

MD5
066c9aee72e12733da5752c2fd0c6904

SHA1
5ecbb0642b315854e6fe8c3e66d17b412a4c9f5c

SHA256
76eb1d320132b62b0a1033d4d63655649f97da2b43dd861956791e69f6e293cf

SHA512
93b5e76469460ff2c6f90c8805145dd0a016e9c90091aba49982866d57d0048fd71d4e6bbe4519f1fd4621044061bb3074e9f96a7af0c411fb565ba94a9c86f0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\doomed\12760

Filesize
10KB

MD5
2e588c128743936caaeb43efd2d87b28

SHA1
e21aca72d6dc7b9f669f06fbb7da134e7d3a4d38

SHA256
e98def0e65fdf2b7f680b9176ea6f88bcd0eb27a4685735effa15e056a614057

SHA512
a8caa0ad9d34c568648b5e66cdd3802461810c39d978c5df2ebd2356c702bf3c5bc1eefde104b76b5798a32a0525a2389861bdf271c3e0f9fa9c59697c0896ab

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\doomed\20718

Filesize
61KB

MD5
4dcfd0e0b17807e5ae6336a5f11f48e5

SHA1
56477dc14030d62125b0b9d677ee9b10b453c9dc

SHA256
1a1f644dd4cd6a1680f9280c2e1ac5cc9501bdf07dd63ef6d9c64a4f240fdb5b

SHA512
f3ace9a952968c23f0e1f14512a24d1b5a26eaf577a5d713cc8d49bdf3548ff42d4ee229f4f8918909fad4883d0b60970bc6571ab58bb63e1f0b2bda3bb8a55a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\doomed\25451

Filesize
27KB

MD5
a6662341f2ffab073122fad0ca22876c

SHA1
f3bec49e4b9b5c42b12dc60e3845fae72e5e960b

SHA256
a1a2be1a383740b5e07559ca0f71e8605991ca52c26bf84df99165e20bab4e83

SHA512
9677677375e9fa83a421d38a3315875df8031fe76c2c0028b9fd0e20a27b9f09f64afdf73228bae8187fec346a955894ca1758e383f844607aaf342f80442137

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\doomed\25742

Filesize
27KB

MD5
0b5dfb86d3a06b49dd457f4037547807

SHA1
aa7a580b43aa73e7748345573ac265bd609a5099

SHA256
1ef6c72e35746b4520bd443a8f390b1e071e9fd33bc4ab2ebf394813f9a00c0b

SHA512
38d31f1e2028c87edfa5066eb0f38ecada3454b70dd374fc581c6221f54974734e866f6c5661dd05cc875b74f8b53dd3bcfe7b150b8b0c0416c7e535be5036db

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\doomed\4152

Filesize
9KB

MD5
0b2da3085de9e01141656363a9c44f8d

SHA1
a5ba29b3ae668de2e70fec2f23400a7409919347

SHA256
a8f1516c95ecbb88ff64c7a4267d430344d74bb1c5e4b1b08eb01c05f0d439a0

SHA512
6c3e19df51a59dff2d201329f2cab32c739c9fc08902e95f1ff34fc88c7e50eaaa7a3ee271ff37ec3148ec23f743485f639121e42cacb2d609fb041146e353b0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\doomed\7863

Filesize
156KB

MD5
9e228c25fbfe9201aeb1549f1775f368

SHA1
6121dfe1d30a898c99a0490f274bc8307baaa12c

SHA256
eda3ffce5fbe7960e697003dc079ec39661d9114848804ea87cafc04facd7d1d

SHA512
fe7644abcc971f17dcefb240e0aea36a3fff4fa6150f81d584c30302314f13763257b2c53ca7a73b78ebdcb1ec4e90099552103a3f495e96b55135c8136a339a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\01ABD05F24B7C929E9BBF7B620E2289C4EE00CD6

Filesize
59KB

MD5
bf5c5f3c8ee2edf8e1d0f356e3487f35

SHA1
ee413159fe70bc5b120699c770b4a04fade8f9d3

SHA256
7a9b375a4d1a69ccd7c712ba24e2c67b383704bc85a6d2d2805005d5c0f9d847

SHA512
ecbf942a4d3bcc074d951a85ecc03b66590cc57170a6521353703f621be5acf2f2a66aac4a739cc3f3f84464630e8c108f84e05b8ea9ade87f7f684c051d8d20

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\027E6BED03090055EFBE6ECF794DEA90B346DD4B

Filesize
14KB

MD5
62a0542adf32b08c0c1a9359063dca8a

SHA1
e9bd80da31f6b58a6d90edfb4841dd612b763557

SHA256
598e3469a28c10827bcf718f1aa7aecaacdde24c727a80a053d01e6c3cd76171

SHA512
0e70a4b0f4e782a49431ba1f59a47fe4042305d713746b3e03eac826698cc9fbc526604fd80e3021f6acbeff1c18d40627cd398f75138047d0b9d8a6739ce6c2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\0334C1D29A43126A467AAFB397D122E28AB8F4E5

Filesize
82KB

MD5
20169506ed864eb224b48d495f72e307

SHA1
283a01920b619de9824ec804608bd4070cf48d7f

SHA256
4c7d7201e7ba35a076e38466a14297e22b19b9b627edb9412091af8efcfa722c

SHA512
b4ea4bdc0dfb7c67a3fa976a0362ad060e214c09fae72b86b949ed2f2159704146b3c6fbb96251016909f5f69e7bd5030ea6d2bdd167834b84b7944892975603

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\07BF7F949D7016E98DC005D187733C1C61FCD2AB

Filesize
142KB

MD5
46834171200e987dd119b37372a83ea1

SHA1
3cc1efa6fd7946e0ca4045e4455418482835b853

SHA256
b90ecb6db695e09ddf4f0c40b5cc2c2cad6e76945ba14db05a935f436d3d509f

SHA512
1436f43a9500a666c121d113375702fb8177a0f15761311cb49377103f4e32d6181e9331c152e3c971e41f504e38084dc6083a80ae6846a82306a121d4b2b0fd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\0EEFA6E8FD25053ABC063C8A23F8ABEC30074379

Filesize
18KB

MD5
484fca358e5156044ecf70cd2347bf36

SHA1
ed88055969e043f632dc0f81600eb389f85a349a

SHA256
0db15deddaac57c2794c5a623a4406efe6d4e5b8e5990b77b49218d8f974140e

SHA512
f4e5ddfe6f68faeb497d23e0098aa98757796f2e1c806dc7c3fcd6fd36070c78c1ee607e050320e2c92471b272519e076ab0a19e15194aadad129ec17c31e341

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\1243152E7867EAA24697321508C34F9CEF98EF1A

Filesize
60KB

MD5
fc55e47506243e7df4febe7c1a26542c

SHA1
a8bd9b3d8c95c7cd8fe29a0e5cc32ae78582a8c6

SHA256
9274b43fd75fbceed9b20739c45619ce87eb7bfc737ce9b6104bf6bd2a35ef28

SHA512
c12aa8fb2f7e86e2d50ae50c3377449ca3d268716e6fc278361822cac08a290e9cd1fe8c1fdb5a0028b12488e026a12f01f229e62a8993a7e67a738a41e2b401

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\1402A9E66F9AA3A9DF2F0E11E293B20FE3C199E6

Filesize
25KB

MD5
932f27f56d8758d1d745d1a5ae5f66b9

SHA1
94053f1e39efd6367c0ec9fbf2c72248b715a885

SHA256
a49df9c157614b2570a4081c40aff41030afea4f80e3a201d0ee7d659221b71f

SHA512
c1e5027360c4d3302d556f09c1e22e137fd3b3d01f56fdf17fe49b8a5499278d263840aafbe3aaa115ac150c260a9fc0832d60e5ff28acb64e85e96da62143d7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\1700543EFE3FDD8336AEDA53B92CF1F0341F07E1

Filesize
15KB

MD5
83f3b84f4335d428566eaecfd9302ea8

SHA1
fce359759ea49bdc420b6e7a4f12a5a1540f1c98

SHA256
169fb3d8213018d16a554800227808317b26909b762f963eeabf089b12bfc22d

SHA512
98151071167fc60ee0add9691ab312d3361b7ffd2e5dc31f215f3defe28c9119bedf222e3ca0cab0b9ccfdac20db2e6220392e4ae04b4044acc7c855889b2fbb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\1BB2475AB4B2919B1EF9B5152027DDB6BB364A4B

Filesize
16KB

MD5
10ada1ce98827b109f08b6fb350e90f4

SHA1
2befb2b6eb595f633ac398d773342b0a4beb52c5

SHA256
0e5f83e5b7f2422a7a267b3c6989e84c0c9d65495710a76339ea7eba939cdfcb

SHA512
7ffd2071de6f967c7f4d6bb0bb208420557184edf3ff1830e202410c26b7b08e5cbfe5848fd59de628bed5a34621ea2ec52fd2765f89a90a84c155230aa6711a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\1BFCF30C19190141EA70968C6D0386B3A55376D2

Filesize
20KB

MD5
902a5f2a6711e977c2262d763dc93f05

SHA1
ea786d022a25ab1d086bcf2925a9efd54907042b

SHA256
ab9985211f78d261e829a3fe1cdd015709ca81d38b89214d559f4d24046fb442

SHA512
2888849bddc6a92278fac43dc0f554ab48489dbfcc8447629fde151db4d1c376f72ea82bb1a0df77e4b9795ca45174fd56b36f746a9c2217a08bfb0b8e76dc32

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\2459AF41BC18A6BBBBCEE8201EBF6F7350ACDCAD

Filesize
21KB

MD5
5d161f2dbb1ab65b0e221dc897b98638

SHA1
ffe92d5680b49d87d45fa4b6cfee38cc605197a0

SHA256
496cf865aa054ed13a087c6435c98c34ca28b044913d81a010acd03c5a18f587

SHA512
d95ced5e98896a7fd57504a834abe41e68a45e23107db51d9d5353fa953b14a4a2a1fb93456f9c9c6ffd7c9cb96562a20abc58f77102763511eab97f90deaf9f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\2492994A253B970917AF5CDF605580B1C2DC16A0

Filesize
63KB

MD5
d2edf8a24fa1e8fa5f3e3b370fb1083a

SHA1
d54c9a67a878224912ff3ac31d8882400830f72d

SHA256
53349975dededa2963e8bf3e1fd2e5d4f5901ff434fed31853ed42bebb02d7fa

SHA512
dd4baa387e860b48e442474e03b9435eb2f2a6e4dca4692f059b81190c5d7bc38834e7cda341868bc210594b67dfaa484ccbf8baa9fe0ed89ae2462058020e82

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\2587B8254FF29804EA8C313AE41DED8329BBA421

Filesize
38KB

MD5
752697a9f9b7449f102061987ddc0fe8

SHA1
cc9a41c6e74e5ebf27a37795fde5318337262fe3

SHA256
6f79876d522884ffd2d4b33fb4c887019be77a8b2d96870da56c2282d6497ef0

SHA512
471d375613ab1407077c8f7a40447692e7c81c3ce82099151cb80088b9d7db201a6ea3a4e194053d0a8fa878d7846620c945e00738203f934825f593abd920a1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\34C769494F4DF69B9CDB4BE623920BFE21770EA9

Filesize
61KB

MD5
5d394d696fcd622e6d013e75b18af0eb

SHA1
70fbbfcea45a9a10f6971264bfb36dffe78aa1c2

SHA256
c99e4bbccf5e32ff88bf12c7793a88349c42fe103c09933bd80e2c511674f97f

SHA512
ad0cc8b07e15584720ceca2064ec40153d3593906b803afdf437b369ffb72c52ec9f86bc9e6919183b1ac25244c96dd6047aa8d2cb17a26a9fd978f0ee9e4156

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\38A28212D5F2E38C3832D2F27A4133D0DE1AF6D6

Filesize
31KB

MD5
eef800708ad4b95ed71bd8a606c28972

SHA1
31cb8618ae4a5cb5860bad2460b64169c7dc0b56

SHA256
6c91a86c088075b834c53b706bb76b405e7694fafc057d1cadef22fe71f6e877

SHA512
f015745693bc3def8bc78ef30ee553571a4ba86748ad3a9e1026a1b27b764440f9da368383b12336b8bf55deff7ccf309b38323b3544c35e0155ce70bbb505c1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\3BBB7CA8DD414D65915B48B9B7996585CD0523E0

Filesize
253KB

MD5
9a83a88661a10bffea7ee2662b41310f

SHA1
1c62f898011c6c78d9f29c3342573f25ab3ff304

SHA256
33a87cd02f05489f879620ca628c73d034d55d5ab6e5407241ebfda3da72e650

SHA512
f785abd5cec44015a6a1134a707efaf1a0b97c178beaa22ac44b2ea6f274820b0e766e3a3677a6fb9614fe0537120126d3c6dac5624ce9b8410aed2785220248

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\45B3C58F902E6DC4E91D2CD7FDC52DAB4CBEAA2A

Filesize
22KB

MD5
154993df6a42a8b0b3b678a5f9d80951

SHA1
807d57cadd14a9ba83c2a8426d86fe967d9283fa

SHA256
9d465d2a2f6c93502aadc82ba4c31927bf468bf5bc72349896cbc15b831799d4

SHA512
2865b08bad2fceb5ba067376571af04f8b0a29974236285ef0f2bd8d48c9f1ac54e26e495b442ec89910c457ae185fe8c61c411d7825b7725493985109d57e7f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\45C13727B6DB444F70F2FAA20129C63BE433735D

Filesize
35KB

MD5
e94f4cf358a10435329f8290352c3673

SHA1
b9f1868b38e25e3144d1fef0f6407de7c7c9bff5

SHA256
22ee29de5c15fb6e7c73be6b30f3f7c11b428ea622898acccf13331b08eaf57a

SHA512
1493426fc293493a34e69583e47202f1e332cb42727edb2e55ff905fec071a7f500c30f6f10a9d7d8870ff6d20a464a7483621155ee980ae90e892ae8c8ccbd0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\45EE6CB87CBC96B4B00B1E1E23A723A778F6B78C

Filesize
16KB

MD5
1367d5699650c8cc42c5d4a06e127041

SHA1
e8b0b16f44d4b6198e2e52f984e040f0520b5c6f

SHA256
fd93815f88297093acc9447f6889d83df69c5ea2609a76876310dcbe4ebcb4f6

SHA512
120178441aef3db687d800cb9e98af1db7faa7a693b30970235a6e8b9c3e52c4f86e474965ec8774d7b7499b29a3ce4a09c0009faceaeecb4ea56f57fcd40c1f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\47C337303E0865EA24B4F5FD62C57282D8FE23FF

Filesize
16KB

MD5
38a1926b09da4c8503c532ea8b9070b8

SHA1
50e62e2ffb81231f874047f06218944ea2a8ed97

SHA256
9adccd095b1edf7f659ebe8c00437caeca1d5bbb54502439c34e891296323796

SHA512
a0fbdbb21a5f19829f6a0535f04186246611a2ee1371f2e348384f72a48ac7d7e5c167f356bcab73356eae657e244ef6e2153548ddb67239c695d57de6cb29ab

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\4AF72ACA6BDD176CAF72BEDC6DA0DC7F1FE27FD0

Filesize
273KB

MD5
d2ecf739c59e05e4756c07478eb7212b

SHA1
73a2acf4bedc4672918779fc8ad61eac5440f3b6

SHA256
079949b6bc8af6d87fb936600f9a5f42af636763a4674c5bfe2d6715e4af8907

SHA512
865539e727fe41c50f95f088298b3911747104cef4259f6486e146409b54cec60f6d3becabbebc1a05e150c5fdb31e163e341be96ede9dce961d2a3a1fd47aa7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\4F1D3F9466E0A9C3C127F5A37410FA8B8EE0898F

Filesize
22KB

MD5
1d756db1e3155cd539098ec56d149a3a

SHA1
21e2b7839d7086dd7fd9c30bad5b65ffecb6b8cc

SHA256
c69316f13250b8bbcb7fbbb4523707f0e9a64e16b2380757c68da55fc0d3c682

SHA512
f845ddc603360f249501701b147474137683cf4549fb901805a3843acf95f700d81ef6e8e8d80bd4d7bde0a8e7bb1838b37462577776f6f9d1d12682f10fabd2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\515FBDC877C4D5D06806BF48FA01A44A001E8A8F

Filesize
14KB

MD5
78da9ff9f2f125997746cd11a35986ea

SHA1
b75235cec4295cfb6739ac99421d4cde7b4f1994

SHA256
7ea73b211354fe373250818cbf2635fab11e09ed29b0f623435eeea1ec158635

SHA512
bb19095264d84fbb007cfd6737c07711cefa7b7228f909e5dc5fb773fb44bc739bee34db2d814feb5e9333705ed93c9ab7b8b04a520636f0d38a86303d7a45e2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\5F9F089D8FFC6D83A1895DDC6467B17FA267617E

Filesize
14KB

MD5
0573fc8677360153ba9800e71a7b242c

SHA1
b9b19c6483424a4a59379eab39f849a928bbc59d

SHA256
789e79f25a092e0a954d86f32c8cccd20fa5717a60b77cac52b1418f6086e277

SHA512
aaa7873522754121f66543a01437f51d9b39b1e215f55c9984c3b395eac619fa2b7b433f0af088c2678e21c4963943ab01bb8fc419a7c1de929bfd1ee92c1762

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\620F16825A5E0AF197A97B3F53DDC3975F800408

Filesize
17.1MB

MD5
62fa08bb6ee4d99c389d49f4bb408e17

SHA1
a712f029aa775885e32f023c029e4f6a9981a3b6

SHA256
4a5c0822bd0ee6454605eca2e46a8bc461a984ad470517b0a2098b962968be1b

SHA512
84364ee2625c8ff8fa6b3f6a94990e6647b33787dc62425d9ff9f0d4f7b1f3d7ab55e293e4b998c6de1b1f24fa9e6df20e9ca27950c5a65dee6fa95665f615c2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\704847FEB974FD86FFC852FAECC7E0F82D1F17E9

Filesize
31KB

MD5
53243957c24283f97d8ab89e994a6d9a

SHA1
205024861ab2ac4c0a2486140837929051924df9

SHA256
7de6b2f4a409282f48c5d759d5f290956452bbbed9f757206ad060529ac340e1

SHA512
00dc234098016d8c6f05609c1d72522fe4a695d067d3989b58432d1d5c850270e700291255fa9f755ba5337ecdc7ad8b784f67915951862168093394d00535c8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\781FBB3D3B40A7498C3B30E0E7963E79B4E483E3

Filesize
21KB

MD5
45abc53431d1127b0db2119c51c2f98e

SHA1
2fd3a0405abf6e01ce8a55ce9ed8eac079fb244a

SHA256
0fcb6b9d0b43975392989e8580361b3e697e7da3b6035f6a114c28e4115515e7

SHA512
1aba5672104f288a77db0d529cb45168f7ca59e07d5501ab3be80b2fd1be305c7fb5611f5b352029bd48efc452f8608204b1733cdd17b23f0f57cd3817b9278a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\79937C26E4821EF7CFE47E9486F5EDE17E103C75

Filesize
14KB

MD5
bf5c297afed239a6c800df1f9399f4cb

SHA1
023a199223144493f8232328e45d8644745fa3ae

SHA256
a13034eb7fc98a614bea013ed745d2084b91c9d167806a0f3be31f4467dcdbfb

SHA512
6448445448672e4346c2f88d29a7ba6cfbaef0d06d964ce8645dce2fef2e5595d6a5d51b81da13840bcaf47d86eda647afb31850e3f99fb2d5a083867d3128c7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\7DCCAFC1365D206666565F856BE1D8C395E60E9A

Filesize
13KB

MD5
ab1db47d73d04d3fc882b78c6e74c6ab

SHA1
a1d2be95c9ff32653ddc463033427c1cc006e7b4

SHA256
98aec186317a4958824a4f6c8c16f3aaff97dbd19eeb2baf9644e07b88994110

SHA512
68d53ae538e1d3cd6f4b3082d58085a3b9817ce2d06a81489e0baaeb7f05a5122fd9d3f1b7cf74cdb746c7b0df484a273afdcf2ad45353691d6fb66dc2acd4b4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\80285EC16EDB2FCB53FE4D6500B0396AC776DCD0

Filesize
666KB

MD5
5a4718e2f3d0646b327fe9edade11eb0

SHA1
eb158c342d00d0593c782300af142b52584a482e

SHA256
eb309ee51dbf168064f79988589d44acd90885fb683dcdb92277a1ca8e815883

SHA512
b6204f334fb1aaedd2817e7ee322eeb7d97d815b3269de9bf9d3ac350541995dfe9ad9380c2a642c49fd5551675979148a91bcdc6b1a492d38fd6738e9992d6d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\83F5A1C45CBF5DA2EC9AA394E3194AF37368CCD6

Filesize
14KB

MD5
6871e84abe7b4a16f2f75fcbf05f9045

SHA1
c767719f6b3c5a874540e9a949de70f7ce5f9821

SHA256
f7ad371ac955eb6e8b5f0e68d88b8b71077a73d4c1f775e72d0765710d093c14

SHA512
1e25f3f3adf6745e6925e5817fa9cda25e89990ffb534ed47c7597e8396b1dd402e5c18740a898b562802a7675bde1881663aca59d389a0ec8d03a645d114674

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\861488CD251F042EE273075F23EA4E34F6014642

Filesize
26KB

MD5
512ef4d47c357b2f5f1baae22ced7c51

SHA1
82a821daf0094fa85b49484cf44acacfb2a9ae16

SHA256
def531308d0332e5404d67cbbf3c4b8c05f673453f1157979a235b86df5bd71c

SHA512
28a96f26eaf3c80138523da8e8aeee4110a3402cf325cfc0c8913fb1c0ca436bcc6b7163bd2181db753771b294bfc47bb7e8464413e322470154ae86377ee8d2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\89751F14315B5A8187805B379FE4265E13BDF9F3

Filesize
13KB

MD5
6556aacd5f90198d098c332611ff92b9

SHA1
2d039646e5f1f76912650503356696657ae17231

SHA256
c462bf2cffa8e47a4494441d882a0280cd30d3fdf166523d1961a18aa4fe50df

SHA512
5c96e76ebf80daa8de5b349f84d94698f2cef7e7399dd60775ffe21669a9cf3a6f35c978157077e27bddc439783e8481fe6bd10966c40222d5e37d8f07c3112b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\8BA1D269DE7120D62FD5399B7E6CD54F0A3230F4

Filesize
22KB

MD5
c70f25f4ac801d419714b3ebc808c5f6

SHA1
2b34b10cd094a6a789f828c3add0bace129c44f3

SHA256
61e632013ab27c04039b8ac4719d41f2da331ea36dc058e51876038fe0ff38cf

SHA512
65c035a0a721f27d1bc76d31c222976f61f55adba03395d6151f245b91eb55da57ec017a7d9cee7c2b6f8d0dc97be66ec9318f71b64061e76af15af6643b6c8e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\8D0B3AEE10D42B559E79291D4048E0CE02C6BCD7

Filesize
26KB

MD5
bdc505438eba1f242c75080b0b4c83e7

SHA1
8b0bc2db60fa9c1ef9a28329bc6934bfd48d7a4d

SHA256
6ffeb8b7f7978ec9afeebc7be03f78c9660edfe886e8e7d63f934e1760208e90

SHA512
3d85f6aa68a89ecc624e7f3cd5172489b1a93b67a47759af4dc2b57290486f95aedd5a0306ae741af508a6f2ca6ca182c70375dcc4f41a2736956ad13c360c65

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\8ECDCEA3C0FCF95DA60C035D0D409AB65FF51BB5

Filesize
51KB

MD5
a62884c8ce396361c6fc0eeffd6c4437

SHA1
329be2e1eaeff118e559aec9f88d7a35a76deac0

SHA256
2bd83438fb7d59112d414874adb640aa72fe941da786b6a97cb5710954b9893c

SHA512
13e2197a0f1321ef5aa72dd852c6b560b97559d568b0331f31538b41271168bab6d34759a3a0789956f160b8b8e9dc68fdc2a918bcaae7b4ba2545094fcdd94c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\90213387BC57DBDEBEC9693256E750C8D1BBB0B8

Filesize
18KB

MD5
c31dddd4756aa89fcde395dc68b0466c

SHA1
fa63099cb7616d64afccdec5fa76f7db2134b9a6

SHA256
1e654a7d6d6bb947730739e76108b0784d46398591f318f6caeebef6fdbcb26d

SHA512
9f65d2cec4f5b375e35e81730a85e0d223d9132deebe7a0d987eb9799a84e3174f6c5fec9470afb717099ddf10177df6a389d7fe59f8d24be14b1e663c41f90f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\90BDD4E54E2D0C47FC36E0F2DF80A5B00A64EFD6

Filesize
26KB

MD5
1c0a6cae30ab42945a9e2ceb685dbf4f

SHA1
e0fb6735eae9e3923f3983c6fad01bd1296c0363

SHA256
30a7ff652849652f19249ca8e7936201aa84d839419f92bf4dec1ded7bf13282

SHA512
d9f507d4713462e71e916a0cd49945c693c0680c817b78b02a59000ea5656d3964c5e4e4e97dcb7512bc319fe223f1eb7473c9820234df2aa40693dbb0242dfb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\93628B06A5DFF74BD4A344CD558FA5F28618533C

Filesize
14KB

MD5
941110edd17bfdf176b00d46db9d141d

SHA1
f4c82627a7d064e786f68b7281bc1a2ede1ff6c2

SHA256
b6482c20b1b9c7a0889a3ecefcaa0552bff62cebcc48efe4b47bc3fd01021869

SHA512
7749d6f66cf7ea5271fa2b7ac232e29b5d6f1bdc6779d22da1a710f28fe05dc50e31787327b4332e650f6674c0757c6c22a119e6a63cd439a98bf922f3f9c7f8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\93A3F61C53110DFB2A449EAE79580128ABAB08D7

Filesize
96KB

MD5
e91cc3d260fc3e847befe8efa1fd0e0c

SHA1
a2c5aa3fdffe3a9fd6053ead7687bfa3cf5d6b63

SHA256
58e078ac08a8f9a711b3bc1acf1c10d3272ec457910350068d8e759d68c7e673

SHA512
19d49b590f64794700f3662772316ad14876cd18df4d1739815e54a5888f1b8e925ea097190e02261e458c58e6cf3ca54f8d3f5f2f62641ed026922aa0071e10

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\961162D7552FFFD2290177E0F1F7532061B15DB9

Filesize
22KB

MD5
f08073d2cb1df6affb5a5c8706dcbd2d

SHA1
1942b29c925e1924eb724425ede7041f228b3af9

SHA256
8ed18169983736b5e01e401e28cf4fb33bc62124416897c00646fe982284a6b6

SHA512
b831dc45c362b64e4a556ea4684ce0dcacd8d7b2723b8b856da8716c708e7faa03cb26c56af3b6a00ae0db3f60f5f4a79d3ed8c4cd12bbd3f952c005e1050e2e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\96B6E7B5152A18601B0E937E329DCDA0D7A5827C

Filesize
78KB

MD5
0908a1c83c3bfcd6071591a416192031

SHA1
ec50c7b197ef402f9d484bab2e3e69d41bb44c3e

SHA256
a4aa311ec9d3790e728c3edc66f0307b96301f709142b7915d4e8d182245d442

SHA512
70190704a08316daba014b407ea4bd3563663cd2417f8ac70df391407f4a07b108817625da3581c06701ba5fc8d84cc62d31d105bf5b4246b24c60e499ce35ee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\A26BA674CCAAE264BE061D0D2419920A7AC15BED

Filesize
19KB

MD5
968bbc61e5de86b119e3adff95fad7c0

SHA1
1de2ec129f3ecce08f50ba433649b0f4a87a4c8d

SHA256
eadd4615c964ab399176b516c45be477a2561906fe2f85376263bf9cbc76a068

SHA512
ca35c684ca802bf496a5dc0a3bbbf46ab7383e51074f42e16431d35abfc29f2f681b5f135aea4ec9222f6466af126b9dbdd815062d6d41bbd9a36d1e4b32f20c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\A2BD72A3227572715C6CBC7E489B8F9A87263541

Filesize
36KB

MD5
20a471190c2be3c1c4a7a2f165965209

SHA1
0999b7546ccf9ed52a7f1b3a9839e5a44e56f0ed

SHA256
5548c2e3630d868416e68e78d2d253d8a6d36f44291727b41bc708ea21448ced

SHA512
aec249f762b5e171d9510ec32db3e38363fb97734951d899c6dffa1efe4609f21c9c98db4530230007a61d5655ba0c7523b32167677352224538a763120483a0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\A41024D9D9E42BEB4C4E9485AAE963FCFCADF968

Filesize
16KB

MD5
735798f7e4c371199d7ea30609fa2735

SHA1
8078399c4627387af95e9edeea0ad0add1e1186f

SHA256
983b1f4cbd0ca29a36c12b9c3d77fb1a55196b97b68ccbe8a729a716531a1604

SHA512
a2f2bf6801c30dafd083750c8b37c8cbb7c328e9901efab434006a7165cc462ac5dfa2297efd5597c22d9aef8d4a5cb35488fecd96ae02eb704830b9599c0a8c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\A955C4DBAB0484FEB6B6510F1945CC6B13BC7ACA

Filesize
14KB

MD5
a7e5bc142e0703585444bb2870e33ad7

SHA1
37975390fe9a38fff35b20bea30f7aad45d084bc

SHA256
b42df5eb8ae5c72ecc900841b0306101f3dbc04c518e3167c8317a89b6083267

SHA512
c4b4d58fa124d4cdf16d968e77778fc40fd16f2a4ef93a3d82015bf3001fbf46373fffe261e92ac45edad81e0cb2a44f05625c6e85eaf6c6407d87f6bdbb4bfe

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\A9CBE1F111032C0C8FE37659F53E4F8B9096349A

Filesize
22KB

MD5
d0ed2aa78682348b4cc05f4d5c0e50af

SHA1
e50f9e5f983b3c993a02913a99ffca872017590f

SHA256
598a32490414384d4c0acf2ba9b7c2d40b3bfbfef48c4bec0d882d556fc7b53e

SHA512
e787681b5a20272f9e1c03f641b266daea8925812ae082e95ae97b32830b3c6361d7c8623b19d722c6c086c15333abb196280607cc896e0e3d2381ffa2001f29

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\AC3DC5397D47D506A24C8C199BD58D27F201BFF3

Filesize
17KB

MD5
749ea1774ecd832c7e6446aa67e3083e

SHA1
b1f7deeb2a95daa65f01e9f90bd1c22af2090871

SHA256
f36c939c23ac980703924bce06c966969b1fe544d3b683efce35b59785bea53c

SHA512
1f48563ee1b4ae07348b916f00c0393b18c1d4ce4f094f4fa4de8a81a4ce202b1d564658284d9b875c6bb80c9455406976b1cb6a56f7d0b73e5e87fe30b8c77e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\ADB77CF89BB7C3EACBA0400910D8956D4F8A5D23

Filesize
1.2MB

MD5
92a3bb9a3fdce695bcbcd1c43bd94a6b

SHA1
ae37a1eaa478999f2e09599c56f400fb1518d4ea

SHA256
1694ce08cf2558580428997364a3adf24181882855f530ad754b39d5067863cd

SHA512
3a3863c990849bd938656869d80350dd38ff7d91bd656d603308215a03019d6d6f711825e56807406c12064ad7daccc1bf623e107356d7b4ba71982922ffd297

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\AF6E7B7DB9908D7B867517AC33D094ABD56E38F7

Filesize
38KB

MD5
63e20d585e3cdd4b4f0556a5fe3c5e79

SHA1
14c5114476f6e88e4919a7c689b6c89f1e101ac7

SHA256
6df3aa397fd0e23edfece2c61b121d4ccb4c910f1f41d1014b1ca505bcf2b80b

SHA512
1a8f94d2f0a5973013515dc4dcd44dbf95d54c2c5d8a7aa3463077d752411c09f698bce474cdc1cf9bf8ebce1e9d669af134ee1cad8c8250418d1fa4550d94ff

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\B47C2290387CA81094036091C984E8DF3E89AE1C

Filesize
62KB

MD5
03e21c67e0c2db6aa8dc131e1fd3a25a

SHA1
d65eaee89201c5f293b191072da9ac8abbd13479

SHA256
ed8d611fd9670169a7c4f79306846da22e9174387f5c6cf37c7ecb70acc35bdc

SHA512
8702c31c80e51036b2da5ca5422756c2aa9db497e33f775e25979ff71456f8b91315b316e9a3d7ff336387db0451229ef57b4e6e3cee89b2996b8f32a81ee96e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\B4BB6CA3F4D36357699536B7A5A56E073406626E

Filesize
20KB

MD5
16e7594434b7672e07989c9d7c6f6533

SHA1
167f20846d4f726622d33e0947cab12a7aae3126

SHA256
5bfcc77cb28db45103afc1b9d13715b06e338fc7538bd7eedc1084461e6706e4

SHA512
0ac966d25c2fcfdcf798ce746b8555a39bb2df10c7420c4f09d60c61cf4cdd8d22f52c53f12244b4f7db554251c43b60b885a29ec7bc6385af8829ef1627ce1b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\B769C34BC6E6B3498176145B4E9D8A7D03530596

Filesize
25KB

MD5
72fbd8d11a3e85106a7b88b8970f1ed5

SHA1
66dcb6e4f36badf5f16aabfb89fd3049cf1e4581

SHA256
c71cc36a23e40b9844a4d45b5d52e87455624fe1ee4890d0a6d5ec41489192c8

SHA512
d6dead739ac2198d50c749c82c8263f027f2b8182f76994a8cb6a840b3de0f8a9abccab0e196e78e6dbf22e7f3a488a61bc7f67dc63420dfa3e755d64f50ee8f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\BC892227EBB982466B272FC2F0056837623ACABF

Filesize
16KB

MD5
36e37943c3e17a65ee266e669d1765f7

SHA1
58a164e9901ecf5b000749cfe734cd32e5abf1e4

SHA256
e87eada662bd1d3818a6a5bf4719b876dd36afed170440a8ee3e28cd32908677

SHA512
e403e76cdb4c08559c115a893e24b65cc0395407c9ddfdae701ccfab38b2e68093b135645df74c0f0063f46d81195357cf66479d2f5236e08c63d2a35c4734fc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\BCACB8DBDBCD64F192807A78158BC9F7B07FA8C8

Filesize
16KB

MD5
43adfe1a56742da59d9509e8a6274b72

SHA1
c5c87cb9f9f7898d99fd4d27dfeea4b26a251543

SHA256
5a59b754a5ad88e499746ec18c5beb6605f5afa4911497cad88e80c2f5805bb4

SHA512
0d166ef1c5cef1d912f5fdaa881b9b9a6df1f78ca158030c99f9de1b0f2a4acfc25e83f443cecfe7bb74f15c1ed43e488ed0248f53cb04c92ad446c3ba8df4b7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\BD518506D48E5D9A2A1A812001B343D87149620C

Filesize
175KB

MD5
9d4e79ef8ff9972434a177ed62f780b2

SHA1
cccbf2a8e20b7cd346b4ff4cd49863acbbc8c20b

SHA256
32d37bda538c81939d623517be822189dbcfaf18247913462e6b682967be1fda

SHA512
c4d91eec188ef2dd1ca9134d3bd286d9be798b39d5a93ecb560cf88f702c82216acda4dacf96a1e5fcaa6d36e56c0cc1d863112779ffbaa574d947d45e47bad9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\BF0923D6C9AC3F4148AB74C98E937ACD57DCEAD3

Filesize
50KB

MD5
dddae6bf35dabb31662b2979d006d828

SHA1
b611f82335b04572ecf22a72afc6f73510897a16

SHA256
ed7a985094c6a75af42d7f621d397c7b0b0c40283bdba8971ea0e2e8c7a6f68c

SHA512
4f998f8aa53aa3f9786cd81fcc7ac0ed82a4735b446bfd41f2a1660a08361838918fa833aa2d0abdd2afaf02fd77542c8a57e53694e3b3c5fabd58a537881f5d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\C77FB4383BD5DF4BB455E7EF3ED75755C3E38A5C

Filesize
35KB

MD5
a107e865df2194383cd6b825e79f1df3

SHA1
9228a01b05f170130cbbcb5898984de3f5ab5a3b

SHA256
7c13765447c1e95380ee31031378eb39a3fbccc43032ce20ef4aff8790028ad2

SHA512
a9649c788e30d6fe75bf18289eff3f22e22490d6c8b50b95ed4985ab8e9c6b4be2e926091204dd9f6d656cf2676ef9c0e5a12e19036cb454592a8e617ab6a4a7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\C99EA98A5D9032D2FCAB011415C22D8C4B356154

Filesize
14KB

MD5
9d3d1822db17244e4361c0e180cc6297

SHA1
bfb2928310cf93766c40fbf558a0856db52b1eaf

SHA256
28d38b95a07c6744e7c9b4cb28e4c61051c7692eb2e7716d96ade8d448285708

SHA512
8573dca9d05d572b4c5fd6ffe34b68014c993d075f617d8282b2b7aebaf72def0675c86845ddd293684d2a361423312925de9c5cd830acc671edafce3f2fdd3b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\C9DA6FF1DC01BB46CFBF009FB19B09E459B2D290

Filesize
24KB

MD5
42884ed7130086a9526457c8af5b0525

SHA1
dafa1d8f9e0a0a68b5a690b29d3fee70fe2d9abe

SHA256
11647ca1451488b61f8d59b27525f0a5aa7613687b003d9b49fa46dc025954db

SHA512
de5ab6564c6d2bc2ddb463953474bc397bb08d26d0926f21f27b6995ce963babb94847b7ea099092eff697834d3aebcddc2aa2a5ce509edd9b3d3bd538d9a142

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\CBEB5EBC714A9BE052CCCF042BE8ED78FF05B3F1

Filesize
13KB

MD5
274e9dff3987fa8b0c2bd05e29bb08ac

SHA1
3e0da43e5235c52534667f6b608956d8bf7a74f3

SHA256
4fa73173a32bd1e912d16295b71b48ac1c1f67bee07d5e0626e9f9f988d3f4ac

SHA512
e3f80f45e0a450aa58314d225acf1a43600823a43bb2bc19941bcf08d56bf4a6883a16e23c16c86218f3b6933949a183de90a585d864785ce54c380d0c4d7b4a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\CC781311EDB0FA207C7EA7AF0C720872F6DBEB95

Filesize
12KB

MD5
c87262ccd0dcaf3b50528aa9bb498aa7

SHA1
075a45593948605c25b5759132078715768387f2

SHA256
ec75ac4bc5a9674c2e1a6aa9df2f86c21feea91a7b59e9372402a1e75c4186fe

SHA512
c9c123d68801ac8f40a651eeef21613eeade01a79919dd82423f055e85d09e135c93e7716356e12a36533a9a134b819e9f3cd0351afccbc7ba66cc3743bb907f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\CCE1C627D4C52CDAA0B852B84E77EA973DF81D73

Filesize
20KB

MD5
323427c5250f04928e91fac8f5cf3d26

SHA1
bd0612740f0b84790e912a1cd32469c26051718a

SHA256
e618e48931093233c9f021108ed7914b7099e726285782ed1501c80cf15119c4

SHA512
402c2504369b71798db17cd85946ee074fd681da0e6a3b559c75176b24f7414134cbc6ef83f289281a90ba39c677ad5de9bd97603445c6f5b9edef25951f27a4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\D0F1032CE092705033A3D45B720CA716051861CB

Filesize
22KB

MD5
a36da241300575b32b79c0932df970dc

SHA1
3dd4c53e196811564fa000d162fbd5ee6178613b

SHA256
e25a6abaaca100b76ff0417e5c22be66f2a5a793f06758e3916f4b81eeb39731

SHA512
d2912b8a4e860d75caf9cb9bc55ee1ff25afe833fad8acdd2763bd1e23a0c7c42fcdd28441f6ffe3454df7ca53352a96a0513975744a29903d29a405feb8f25e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\D105AB5F954C0907C9073BF810F90A3C36C6D3E5

Filesize
843KB

MD5
8b6c19f1506442251521591752278008

SHA1
d0a587f11eae0c6573017f614e25fbaf56d7d262

SHA256
e3b7e1cc433f093d925333145b549712dae5a20cb1a86635fdb05f87108cd1bd

SHA512
d3499ecd730d6ef86b60b9e8c8d3ac3313e0f2f453d8da89963d1ae204fea19fb231fd1394edaad3d9c5aa4568061ac9e8fb95f82b8d1a9ccacef6f69b4720f7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\D2764A516583A378D0BA2325F933EF3C538EF129

Filesize
47KB

MD5
c3e92ea2a924bea4db93318d57434940

SHA1
6d204b2708f343c773a088e2c5965610beb2a7e1

SHA256
50b3600e1286ac036e454563d1f47b1e05801eceff4f6b034a413c92def045b6

SHA512
8a33dc638f6cd12175d94cb59d93c165c69743cf331776277df0b07dc25eda38f93c4bc3f097f45552f65ea0d59c61759c643e89729f08fca2d09386cc8047fa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\D730CA398E0FD308A82018862D156E21C6F32BB6

Filesize
54KB

MD5
0510e6815e73c2146522a6a0a94cb46d

SHA1
9a8299c5136ab0a1d3b9e64c621a1890e8c2d37f

SHA256
14f4341f296c1e47569221cf18a9d473f3d62c3fa86c0ded07188a3fa6caa8d9

SHA512
5b39f823b38377f067b0984376b0ca946082947ddcfd2a3c9450fede15b951c76e8178c892326d4d3195870ba77e77e6ed1b38c54e4b9bf72e9848feca903b50

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\D91DCBC75ACA3B74B9064DF4DA63D61C3C8C39F2

Filesize
13KB

MD5
7bc45df6e39259ffe1855d32ee61588a

SHA1
3866775848d921aa7b55657cb441c30f6fa411d7

SHA256
881ba43580bc6dfe3d3edf8b34553e8ca9cc3dbeb0bad7d72258cbd84c062082

SHA512
d87c3757b24e2c6e0ec78d14cec07e78c1b8a10882020f42fa26cee647b8defbdd6824e062fc42afb0f216c1f880e14d5b6436bbf734a7dcf6ef63e9c146c48f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\D9D17E89CACE3C58E7B0BAEA0F4A935474EB3FA5

Filesize
14KB

MD5
8d437b827ac7537dc7858ca1ff3906d5

SHA1
623777929b1514cda90c2936df50d2ef52abbea3

SHA256
d6f45177567fa9467581c43eeaa816db7479fe49a74d1e296b76315c1d8e6c8f

SHA512
f09584f7a21c8850df3c50482bb993397a6d8bf19f4bc9e9417baf3980fd3cb9901a0bba643eaeee211f7c3be4e96245690a103b986069e8d05006b75e64f759

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\DA68DF3812B13D23EB9ECE0F214D43142D2B5F6F

Filesize
19KB

MD5
aeba9cc75c7b441735844ab14edf2c8f

SHA1
f2af34156127b4726e46c781eef950d218cb2f13

SHA256
24c7f4b29a347f8e40b46c20ed797041d2846180bc41f4a06e454bcb74f69234

SHA512
0aacfcfd0024497ea3bf26ce8733766392b3eb1e00f5e993548a5f4ab685c2fabecacd8258b8a558bfdf1405a79f3cd363f36573a5bf3534d874c5e13fb258ac

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\DC6086EC8F3DCECB5FDAB23100B46388E4B264AA

Filesize
15KB

MD5
5d6261954fb2d67b9c94ccc59ea2168d

SHA1
d60eb39f4fbfe9c30b9089950d5ab4f6f22165ff

SHA256
6ce7f62318e51514f281341f4f3d251a6e5ca73deda9beac734366e30de6b331

SHA512
eccabd1178e5313ffe6bf75b7a6b3c7a5591bd4ae16d09795ffce744eb8a19bbce3189ca72a87dd61086051970399cd4f4211b8a26947aaf7ead10f595953b55

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\E043FEB329129464EF8A0CE4F6B8FA07926AE211

Filesize
14KB

MD5
ef1ea6d688471559ff9e3b58b55b0bde

SHA1
5cb63a2ab0a1386e5d09bbb67f363edc60831a7b

SHA256
40183ec904297361c5e8f3a95335b7d2c5679f2f4f0a8cd36bd527cf14075402

SHA512
c61f7343d8a2bfbb879932b2f80becb07262c015df8a17cd98107fcb29e11646b3b7c723ab962671dd2ed376a55b8f814d73c0c17b950f1a54a8851010356de1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\E44D8EA2BB95FA202605B58E615B3400B72A14D2

Filesize
38KB

MD5
cebeae67bdb9360ba04391214a1ba560

SHA1
c84eb5198713e9169cdccb3b81debce6a3a05a06

SHA256
ac2afa63c11a1c78ac3fe6c3a84ae9f28072f9387aa3d38b30224c662047c116

SHA512
e2e290d5e602b11eda5d5b1c86c642266472d6bfbb0ffedff1c8e288ce63a1a4e16e5b9dbf91f4798762e1df4d3ba2781bf90ddb1c2d59a192fc64944de0ca21

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\E9FC0C2DCD87A95C50F94F06B94EA53549DF85D0

Filesize
23KB

MD5
0028071b99deac40edfb4aa2aa9efff9

SHA1
6f39c726358ce2158fdce6bfef71da05f40d38eb

SHA256
47efd3ef0b3af7dbfa66dac1f7f9facb7a40e4a43210ce02544e59d57c30d3bf

SHA512
8dc080504faf30ac79cb1bfb95529a60b596db76bf03404cf20d1088899c69837f4fd7f9f05254612a482a1b530ada62d3b13012166a5d2c25fd3c9dcdd0f41c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\F3EE56124B465F78FB4C9A44DF691FDBC3505C1F

Filesize
15KB

MD5
31181cf7c8b216fd5cfda18d22bbc18a

SHA1
003badb1e231921938d75dec23771c685eb8c367

SHA256
abf29e7a1c62fa0ad8f04ae63282af3de52497e30058d8be3e8fab52bf86aae6

SHA512
5465d4a1923db6b885bb5ec193aef598de785c0083f63d043b7a2386e2928ca740bb6a6d7b3f4bac705ffdcd6e009dc04f5f3914a82dd417d0a7476904a7c272

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\F54E7030F181831909BFCE5EACACBD3D867BDC0E

Filesize
19KB

MD5
f8870700596a76c70b8c94cc90d6f3b1

SHA1
58a42d8aaceedc76d51968408dc2f5d1ed8ce8a2

SHA256
c24c79716150a1a76515ee6f6be5555223137fa0b01c2dcf716ef385735dd387

SHA512
fef03677f32aef6197b405f754ea8bb630a9c23f4cad6270bf8fcc25ae3830fb9cbe8d9ee917fcd93dbc8cc962a044d734ead34fe561795cd1216838dc189db8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\F9F504ECF271968F9BB19C6A9840E704FC5C822E

Filesize
16KB

MD5
c906f99c12910d7cd723bbcfcd422ad6

SHA1
d002d6fbbc75a2d60d74f946c0a3fcc58c1553af

SHA256
b19146983a9c27b63cebb5c62b392ff926432d62b5a509549621266d983c9b16

SHA512
2deaca1f123504211f433cf8ce2656afeabf541dabdabed3e542666b49db8b7c455eaf44d0b376e52962fde4ff200668bdaabec7a678d3dd65625e9750bf5d82

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\cert9.db

Filesize
224KB

MD5
cacd12d91b2926d05a26b1b6d11f68d0

SHA1
f879ed37a9a4278d3e18228fcd54aaf162075a72

SHA256
f8a3b8e23c17ba20d67423bd5b98cec4e09e3e4e232a0dc0b5b03eddf6bed3e8

SHA512
97ca3207c0b4ea2e6ff9dfac09994add41accd562494db9d23224518e4874e2ba2720f7862551fb9c44d8703d3a490d914fffdad94c266278abd4d662054fb5b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
efabb73bad6bd8c63b2711cdd5e94f00

SHA1
8d8d28b36daaec6a4276e156b0295b7d479d08c2

SHA256
707b7cb8235863f4e0e5d513bdcb7679e22f7e04c0b40c2f81dc85cbba32c612

SHA512
17a80dd79353a4e3df46afddc915475c2abe19dab0205cfdfdb99550c24f52186e731a82ec10a41eeba1c327552393497f1c2097c531a8637d801fee579431b1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\datareporting\glean\pending_pings\1b4c2f9d-4843-480b-a83f-aa29bd22a94d

Filesize
745B

MD5
858abb7e33bff6087f7c4a32d3107396

SHA1
8f34ea59662e2f8e3a96ed2161c7766074331c31

SHA256
69242d6de01c68614b8309214eef1709523fc97f8636ff10f1ebbe1d993a1cc3

SHA512
6d297d930b988d3e40fe3be7662b4613b396055322974c305db8e8d1d20491bc845d2ca90d4f3e88a4b2526b437cd4b392296eb0d1394699efa583405962f4fe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\datareporting\glean\pending_pings\ca200906-3483-4b05-84be-120993b94001

Filesize
10KB

MD5
7372aef36cfd34503a3bb50f0974bffa

SHA1
c21a995f83264b7d8997693d9afa0646ae39d7a4

SHA256
e2ee4fcb88d2dddc2e6424b480e6ecc966370c2a72ca34204fbea0c7792cdada

SHA512
02ee5df49290f70e740cb9af397609fcbc5c382f99d478e9b4f1289b84c74a13ed7463d37028399040bf2795974f192315dce773b163d2e75fb0a609c7061619

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs-1.js

Filesize
6KB

MD5
457342356da87f31d697e21708962570

SHA1
8d3b8a9a594e8631f3cf6cdc160483d37a9ae47c

SHA256
2327c057da80c3edaa573ca6b2d5bb00fa4481389d2d2ad7a89a1735955b4345

SHA512
42633c474e4d37267f804ae1bdf04466925c50e6609eb43584e98ba7e163ff992dfe50fefcda7dc9589e825b6dbb64b79c4265d5a5046566304426ea4e1a0df4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs-1.js

Filesize
6KB

MD5
503b7b2b84a022f431c540db3ad917d2

SHA1
fd10fd522e4fe657343008078d7ab35e74b48331

SHA256
1301b4457e5db872af6b2382ff942277a6ff0ef35e8ecf01fbce16c8bd5000a4

SHA512
aa829a252510101c313433aa2540b5588d44fb4f36a5c1600091a83a5298348a2b31a8ee5d4031c17ef976b70fef92e4de34ecad6e302b3b7cbc8e74bf4e8e6e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs-1.js

Filesize
6KB

MD5
2c65bb5d322737f1f62c96a16355e4e5

SHA1
acd0cc025f0cf6df4c99e5ae224296d671c327a1

SHA256
42634db76f3a6100e6c9a8af432637ed5d892e1c99b3374bd197796c5ed36120

SHA512
981b817b5e9cc72ab3b703c6862b4e36d05a736dff19017de5feee1d737323205ff006a081f2f4fc7a1ec544fa15fec26d7651d4de0286e7b331238124cf83de

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs.js

Filesize
6KB

MD5
097979e483a360d9ee9596d5d6195e73

SHA1
58985a51253d13c91b2321fd557822e9b989b27b

SHA256
62f0cc9a72d15c2aeb4e8f5efd1f75224a08de9f684fcd65e2d231c3ccfd52fb

SHA512
82d8fda39030b4ad98fe66cb1fac46b7a6aa13c5d0b3392e7a22a1a38120f36634836b0c3c1a95b0193513e5fa22828ba3994c618b4717ad79cdbd9fdd3bc8c1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
906f7394c887b4192adb34ac6d80a70b

SHA1
abb4506cf50f6e9d4f7fbf782b038085ee37ca88

SHA256
5da6f0613da9d6acacbdc66868244745921cb2b0e7a6f084ac59756930f77824

SHA512
2bdda2c6462055b8edbf6f948d78690fc6fc4a94d73e1701e83cfeee9aff5744647959bea83ae3dd7cf44a27008520136b8370c49116770a09b895b7d697a915

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
bf837a13c0e4998f7cb4b9df21f018d7

SHA1
6c249e73b559943665c1c6ab11970437cd7649b6

SHA256
5e07ae50d1c2a4fa7b705e499102f9bfd68bf40875a8c3fbe0f1c262c76c6315

SHA512
764db48989980faca1f4283163de2f8026586b7803e16daebdefc0d2618b7ce01e89e38810c17c702fe82f0c1afd49aa99952bd8032f23686750711b85571350

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
b530314e239f68b0ec8bb9220274f57c

SHA1
6961c85f9a4761282bc36b5108a981d21a6c1ddf

SHA256
ac157c4c375d87c03cb9a419484e6cf704c3c2fba731a1ae51da53daa74d4839

SHA512
5e00c98f0c38848dd8bd0bd8ab8cc8a03b898ac5d53b0363513dab7b668c6911354b92d773b4529d00886e92073138fa53ecdbb4affbbd4b55d1632711959b7b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
1c44ca45b041cbcc1ad281347f21e0ad

SHA1
b63f17ce55087ff4b5624a8ff45f28b65d8aff2e

SHA256
b17b043358915add0b6d77b7c74be14a21bf471d552e8f46e6c9671a5f3aafb9

SHA512
6e8d5f8372c61cc550a26d2cca791ab37b378168e9a11334244f8a61fdb9a90e3648eac3d2d5a5874f6e6b59806cc7bee1d5360a1350cded740e7e77cba1aaf1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
a8ec526e6071d9369eb3da90709702aa

SHA1
ce2240ab57ac0e9f2f620a592ee9caa23d7e93bc

SHA256
ffeb08cf212677a6a7cc9c3ae0548b3b4b4d94cd9c4794e75c8962cd1da20643

SHA512
618be23ccc203d6ea1f5964524b367d38dacc6015424599bd4460e194b92490f8f4538a46e1cc19c2641013e94e78ca58e100ae6c399e8d54b509565fb9a8d0c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
91cd7a9b87398cfe0c9a41f13e845762

SHA1
8c1f186643a626b211ed7ba70b246654ebc62b67

SHA256
cd125788c1914dee157f1f1d3ac1e6e672d2e5c2b903f69232b2a791d2aa165f

SHA512
aeeb0da2a4c9d27ffa2c0317918d587dd8521264c50eb3b5fa35f942bc78fe22033e82cf84210d3abd2f29a1416e203592e402ba9afd102a97cf7d8bf0a636b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
13KB

MD5
4bebe11d1310f94c245581dfb5420ab7

SHA1
c8c4d12888efa6816dac2c8c478f4534b0698a40

SHA256
a4db2f7ec5ee43b8ea22a10d61d02a545c002b069f226950206157ab705c830b

SHA512
348261ea8faa2d6244c769c19561465c71fd2cf87e448ae0ce3605309b355b871808e952f4fe9d1e2806a596f138c6c9c5d377889114e5ca2f7bd9136c377909

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
a50c29b0468c7141c6c542d700b846c4

SHA1
70a9ad8fb3cb136b7a7121f18b66df235370a5a9

SHA256
fedbd24e9094fae6ea28fb1e97c061a996e51932f60b9b6e9d569e0929121503

SHA512
629502461d07340b5af07b3d7ec991cf86ca71876a5ec4cb681f756a0bae9c1ffbc9c332cebb9b1a7835a131fd812097c46af5614aa907b341c7fd216a2b4c6e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
5c1a2de898e809acf21fef64f2a4ada8

SHA1
e0dacbd7860665cce1f9d9004b3a6d48bb3734bc

SHA256
b5e690884c4f953cb848e76455cd20dd89e32e998e04721e736b44c203f692ad

SHA512
d52d3bc1fed865f2d5bc08c125153b4a7ba2c79c8a29acbf78ebcc18f1f7b4ecee6a7168d49a4973bf8bcaff7f606ac886671ffd42fb4c722dd3c7a955a6db41

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
11a8db63b9f64ed6df2af8e3bc34e72f

SHA1
bc71634f79b7f1af15539ebc0f517c082e250330

SHA256
3527c5f5c6ab9737558e5bd1aa1e41d2fa5080adbaf7424dbc818fddb912c57a

SHA512
98821baefa05d26c96ade29bd036111faee95a51375a9afab88864a160dbc588216e9de207e382d8118af1e7c93992cb23c66eece17e93b792f7ea120792df13

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

Filesize
13.1MB

MD5
b3a0b10f2a23f175c935c5870cbd4d3f

SHA1
30731b4dec1679974cef2e873d2c746562636f9e

SHA256
ffd7be40cd1967e2f6a45aba48b6eda5e7382513a6fbc3e8ad54dd6e86aed39b

SHA512
c1adba64663093ec66d5212af5887b2aa13b93d07db7eea0012ee989939dc71d0b455596d47120bcbfae4bd9f196904f4af94c1b3eab0c41dd8a47f9fe52d5c6

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
108B

MD5
25291b3349c0e75660fce68d0f0ba8c0

SHA1
8f12c3fe244cff6dad81bc512e76ba6e00dcbf48

SHA256
3ebf4ddcd7fa3ecc4028502e2c942c7b367276dc4e3f8c119ec83695d49a33ae

SHA512
2c91258792d17555d47d6a771a1a70a65231933403f2d045f0db146795d460e4862e698da4d63552be6529bbce717f45e7a0138b1e55e3091dc3a861af293a18

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\00000000.res

Filesize
136B

MD5
fa190583b317eac0d35e24e346a85f2f

SHA1
14ef85064f3183c8dbe8ca2e995c518fefafe9ea

SHA256
800549730a73ecc33c833f29f5acca97f7334836a8aeabe7d16a64d466c84a6f

SHA512
8776643fac5b408d9d2b1320389c6cad6d13b43ff9277f167b108cd9db6591cea031e97f51e8c93179eab7d1c81548ff5d37d90ca920120b474e8c3d9f697765

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\96971722696759.bat

Filesize
346B

MD5
972829f29517e364b7e7dd12eb95d38c

SHA1
2de1cc8c87567ff0427fc323e41bf2ab340ddb24

SHA256
69c0a07a1ec7d4133b28af7d679601fa8107b5f9fd863cb2c8a3bbfae9ffc34e

SHA512
0219bf033472dbd7167094750f5cdbfc09fb137247fef5a081dd1b29a6402713d2b8b8aa6c7b13aaee6b929f0cd2a4563726108e3b51ecf49454c9c9c8cb1d40

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\@[email protected]

Filesize
582B

MD5
eb9b636afad29e26a950280b0580116f

SHA1
458be88edcbd3cccd7c3b48e6a7bbdc911c0243c

SHA256
2b23dc6a27eb49c5477a9a4550d3d2b9a19f9ef5650f8159b7d076850eb964d1

SHA512
8525215ddd46345e5a70d469ce34360e826eb303f46351dde6ee30d499e14087d08b46381e988d8a51b71eabdf72b649b22d645329acb41e97dbc239f63a316c

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\TaskData\Tor\libevent-2-0-5.dll

Filesize
702KB

MD5
90f50a285efa5dd9c7fddce786bdef25

SHA1
54213da21542e11d656bb65db724105afe8be688

SHA256
77a250e81fdaf9a075b1244a9434c30bf449012c9b647b265fa81a7b0db2513f

SHA512
746422be51031cfa44dd9a6f3569306c34bbe8abf9d2bd1df139d9c938d0cba095c0e05222fd08c8b6deaebef5d3f87569b08fb3261a2d123d983517fb9f43ae

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\b.wnry

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\c.wnry

Filesize
780B

MD5
383a85eab6ecda319bfddd82416fc6c2

SHA1
2a9324e1d02c3e41582bf5370043d8afeb02ba6f

SHA256
079ce1041cbffe18ff62a2b4a33711eda40f680d0b1d3b551db47e39a6390b21

SHA512
c661e0b3c175d31b365362e52d7b152267a15d59517a4bcc493329be20b23d0e4eb62d1ba80bb96447eeaf91a6901f4b34bf173b4ab6f90d4111ea97c87c1252

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\m.vbs

Filesize
225B

MD5
638838048afbc34e5af8a6c3f84cdd36

SHA1
7ac3016fb8734f40f0a6d418135b185c8d030029

SHA256
eef98616d20834f52b2aee9a95544acb07e820162e46186a7c5b5d0740acd930

SHA512
f907d6eed0e97ff630f3d45237683840d63feb06266071c7c503df1c9973360e86c58acf760603786b059506f34d1fe0c0763937b9672682e31400232c5106af

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_bulgarian.wnry

Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_chinese (simplified).wnry

Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_chinese (traditional).wnry

Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_croatian.wnry

Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_czech.wnry

Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_danish.wnry

Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_dutch.wnry

Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_english.wnry

Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_filipino.wnry

Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_french.wnry

Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_german.wnry

Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_greek.wnry

Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_indonesian.wnry

Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_italian.wnry

Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_japanese.wnry

Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_korean.wnry

Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_latvian.wnry

Filesize
40KB

MD5
c33afb4ecc04ee1bcc6975bea49abe40

SHA1
fbea4f170507cde02b839527ef50b7ec74b4821f

SHA256
a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

SHA512
0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_norwegian.wnry

Filesize
36KB

MD5
ff70cc7c00951084175d12128ce02399

SHA1
75ad3b1ad4fb14813882d88e952208c648f1fd18

SHA256
cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

SHA512
f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_polish.wnry

Filesize
38KB

MD5
e79d7f2833a9c2e2553c7fe04a1b63f4

SHA1
3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

SHA256
519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

SHA512
e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_portuguese.wnry

Filesize
37KB

MD5
fa948f7d8dfb21ceddd6794f2d56b44f

SHA1
ca915fbe020caa88dd776d89632d7866f660fc7a

SHA256
bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

SHA512
0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_romanian.wnry

Filesize
50KB

MD5
313e0ececd24f4fa1504118a11bc7986

SHA1
e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

SHA256
70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

SHA512
c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_russian.wnry

Filesize
46KB

MD5
452615db2336d60af7e2057481e4cab5

SHA1
442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

SHA256
02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

SHA512
7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_slovak.wnry

Filesize
40KB

MD5
c911aba4ab1da6c28cf86338ab2ab6cc

SHA1
fee0fd58b8efe76077620d8abc7500dbfef7c5b0

SHA256
e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

SHA512
3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_spanish.wnry

Filesize
36KB

MD5
8d61648d34cba8ae9d1e2a219019add1

SHA1
2091e42fc17a0cc2f235650f7aad87abf8ba22c2

SHA256
72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

SHA512
68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_swedish.wnry

Filesize
37KB

MD5
c7a19984eb9f37198652eaf2fd1ee25c

SHA1
06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae

SHA256
146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4

SHA512
43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_turkish.wnry

Filesize
41KB

MD5
531ba6b1a5460fc9446946f91cc8c94b

SHA1
cc56978681bd546fd82d87926b5d9905c92a5803

SHA256
6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415

SHA512
ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\msg\m_vietnamese.wnry

Filesize
91KB

MD5
8419be28a0dcec3f55823620922b00fa

SHA1
2e4791f9cdfca8abf345d606f313d22b36c46b92

SHA256
1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8

SHA512
8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\r.wnry

Filesize
864B

MD5
3e0020fc529b1c2a061016dd2469ba96

SHA1
c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade

SHA256
402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c

SHA512
5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\s.wnry

Filesize
2.9MB

MD5
ad4c9de7c8c40813f200ba1c2fa33083

SHA1
d1af27518d455d432b62d73c6a1497d032f6120e

SHA256
e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b

SHA512
115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\t.wnry

Filesize
64KB

MD5
5dcaac857e695a65f5c3ef1441a73a8f

SHA1
7b10aaeee05e7a1efb43d9f837e9356ad55c07dd

SHA256
97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6

SHA512
06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\taskdl.exe

Filesize
20KB

MD5
4fef5e34143e646dbf9907c4374276f5

SHA1
47a9ad4125b6bd7c55e4e7da251e23f089407b8f

SHA256
4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79

SHA512
4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\taskse.exe

Filesize
20KB

MD5
8495400f199ac77853c53b5a3f278f3e

SHA1
be5d6279874da315e3080b06083757aad9b32c23

SHA256
2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d

SHA512
0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4

Download Submit
C:\Users\Admin\Desktop\WannaCry-main\u.wnry

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\Documents\@[email protected]

Filesize
933B

MD5
f97d2e6f8d820dbd3b66f21137de4f09

SHA1
596799b75b5d60aa9cd45646f68e9c0bd06df252

SHA256
0e5ece918132a2b1a190906e74becb8e4ced36eec9f9d1c70f5da72ac4c6b92a

SHA512
efda21d83464a6a32fdeef93152ffd32a648130754fdd3635f7ff61cc1664f7fc050900f0f871b0ddd3a3846222bf62ab5df8eed42610a76be66fff5f7b4c4c0

Download Submit
C:\Users\Admin\Downloads\7z2201-x64.brRhh8he.msi.part

Filesize
12KB

MD5
09defc7428cb0394ceae4b7f2505b343

SHA1
5797ca1d481507a67678a5f0a907297708951592

SHA256
a71741e457ee358e75c5b57657c71a3c3ea1be1d5c01072ad6d1170b0b9d2d59

SHA512
6f2c7e3705785fe31487a7934556e48c707958ae9d5fc37905707c8d40b2975e5fc6916b0b1d71e1d1f71dcb52f7eb4bbec8a2f67c212183770e2a2bce8dae21

Download Submit
C:\Users\Admin\Downloads\WannaCry-main.D_SZq-nz.zip.part

Filesize
3.3MB

MD5
3c7861d067e5409eae5c08fd28a5bea2

SHA1
44e4b61278544a6a7b8094a0615d3339a8e75259

SHA256
07ecdced8cf2436c0bc886ee1e49ee4b8880a228aa173220103f35c535305635

SHA512
c2968e30212707acf8a146b25bb29c9f5d779792df88582b03431a0034dc82599f58d61fc9494324cc06873e5943f8c29bffd0272ca682d13c0bb10482d79fc5

Download Submit
C:\Users\Admin\Downloads\cockroachondesktop.SK_JlCuZ.zip.part

Filesize
12KB

MD5
7a97f9e65b98433e6b7490867a89b679

SHA1
7c03e066d7f055640800e678306a57baad4f13ff

SHA256
8049002ba46c09ed9cba0f2dd981893718feb98efebaef97c35e2602f98283e0

SHA512
c3950500ff34f6991d6a00e38216f6bea632a5ee9e551896d96b9c7a78a30566cec2eb2bdba98bf8a33f4627348fbbf24a54b5319b835f6423be58a1f2011dc8

Download Submit
C:\Windows\System32\DriverStore\FileRepository\volsnap.inf_amd64_neutral_7499a4fac85b39fc\volsnap.PNF

Filesize
5KB

MD5
d39a9a06ab6b769d5e0b5aeca817dfe2

SHA1
a01f07c6b57c1e10ac07595bb40ee77b584dfa37

SHA256
d8309bcb6728711bac3beb20661acbae39ec67dd48d8abd0ae9ee064ec25ffc0

SHA512
e47b256605016bea83314e416119ba2c30bc4cd7d42994709add2ba6ac2cd1ce5f638e018457c6a7dd926195092653afa5084b9365034ada640b9a75738f064e

Download Submit
\Users\Admin\Desktop\WannaCry-main\TaskData\Tor\libgcc_s_sjlj-1.dll

Filesize
510KB

MD5
73d4823075762ee2837950726baa2af9

SHA1
ebce3532ed94ad1df43696632ab8cf8da8b9e221

SHA256
9aeccf88253d4557a90793e22414868053caaab325842c0d7acb0365e88cd53b

SHA512
8f4a65bd35ed69f331769aaf7505f76dd3c64f3fa05cf01d83431ec93a7b1331f3c818ac7008e65b6f1278d7e365ed5940c8c6b8502e77595e112f1faca558b5

Download Submit
\Users\Admin\Desktop\WannaCry-main\TaskData\Tor\libssp-0.dll

Filesize
90KB

MD5
78581e243e2b41b17452da8d0b5b2a48

SHA1
eaefb59c31cf07e60a98af48c5348759586a61bb

SHA256
f28caebe9bc6aa5a72635acb4f0e24500494e306d8e8b2279e7930981281683f

SHA512
332098113ce3f75cb20dc6e09f0d7ba03f13f5e26512d9f3bee3042c51fbb01a5e4426c5e9a5308f7f805b084efc94c28fc9426ce73ab8dfee16ab39b3efe02a

Download Submit
\Users\Admin\Desktop\WannaCry-main\TaskData\Tor\taskhsvc.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
memory/756-56-0x000007FEF1850000-0x000007FEF1897000-memory.dmp

Filesize
284KB

Download
memory/756-33-0x000007FEF2A60000-0x000007FEF42CF000-memory.dmp

Filesize
24.4MB

Download
memory/756-60-0x000007FEF1310000-0x000007FEF1367000-memory.dmp

Filesize
348KB

Download
memory/756-59-0x000007FEF1370000-0x000007FEF13BE000-memory.dmp

Filesize
312KB

Download
memory/756-58-0x000007FEF1660000-0x000007FEF1671000-memory.dmp

Filesize
68KB

Download
memory/756-57-0x000007FEF17D0000-0x000007FEF1844000-memory.dmp

Filesize
464KB

Download
memory/756-71-0x000007FEF5710000-0x000007FEF59C6000-memory.dmp

Filesize
2.7MB

Download
memory/756-55-0x000007FEF18A0000-0x000007FEF1901000-memory.dmp

Filesize
388KB

Download
memory/756-54-0x000007FEF1910000-0x000007FEF1921000-memory.dmp

Filesize
68KB

Download
memory/756-53-0x000007FEF1DC0000-0x000007FEF1DD2000-memory.dmp

Filesize
72KB

Download
memory/756-52-0x000007FEF1DE0000-0x000007FEF1DF1000-memory.dmp

Filesize
68KB

Download
memory/756-51-0x000007FEF1E00000-0x000007FEF1E13000-memory.dmp

Filesize
76KB

Download
memory/756-50-0x000007FEF1E40000-0x000007FEF1E63000-memory.dmp

Filesize
140KB

Download
memory/756-48-0x000007FEF1E90000-0x000007FEF2140000-memory.dmp

Filesize
2.7MB

Download
memory/756-49-0x000007FEF1E70000-0x000007FEF1E85000-memory.dmp

Filesize
84KB

Download
memory/756-47-0x000007FEF21F0000-0x000007FEF225D000-memory.dmp

Filesize
436KB

Download
memory/756-46-0x000007FEF2260000-0x000007FEF22C2000-memory.dmp

Filesize
392KB

Download
memory/756-45-0x000007FEF22D0000-0x000007FEF2312000-memory.dmp

Filesize
264KB

Download
memory/756-44-0x000007FEF2320000-0x000007FEF23E5000-memory.dmp

Filesize
788KB

Download
memory/756-43-0x000007FEF23F0000-0x000007FEF2406000-memory.dmp

Filesize
88KB

Download
memory/756-42-0x000007FEF2410000-0x000007FEF2421000-memory.dmp

Filesize
68KB

Download
memory/756-41-0x000007FEF5C70000-0x000007FEF5C9F000-memory.dmp

Filesize
188KB

Download
memory/756-40-0x000007FEFADD0000-0x000007FEFADE0000-memory.dmp

Filesize
64KB

Download
memory/756-39-0x000007FEF2680000-0x000007FEF26D7000-memory.dmp

Filesize
348KB

Download
memory/756-38-0x000007FEF26E0000-0x000007FEF284B000-memory.dmp

Filesize
1.4MB

Download
memory/756-37-0x000007FEF5CA0000-0x000007FEF5CED000-memory.dmp

Filesize
308KB

Download
memory/756-36-0x000007FEF5CF0000-0x000007FEF5D32000-memory.dmp

Filesize
264KB

Download
memory/756-34-0x000007FEF2850000-0x000007FEF2A56000-memory.dmp

Filesize
2.0MB

Download
memory/756-35-0x000007FEF5D40000-0x000007FEF5D52000-memory.dmp

Filesize
72KB

Download
memory/756-61-0x000007FEF0DA0000-0x000007FEF0DD4000-memory.dmp

Filesize
208KB

Download
memory/756-15-0x000007FEF4660000-0x000007FEF5710000-memory.dmp

Filesize
16.7MB

Download
memory/756-18-0x000007FEF6B30000-0x000007FEF6B51000-memory.dmp

Filesize
132KB

Download
memory/756-26-0x000007FEF5F20000-0x000007FEF5F50000-memory.dmp

Filesize
192KB

Download
memory/756-16-0x000007FEF4450000-0x000007FEF465B000-memory.dmp

Filesize
2.0MB

Download
memory/756-17-0x000007FEF6B60000-0x000007FEF6BA1000-memory.dmp

Filesize
260KB

Download
memory/756-19-0x000007FEF7300000-0x000007FEF7318000-memory.dmp

Filesize
96KB

Download
memory/756-20-0x000007FEF7110000-0x000007FEF7121000-memory.dmp

Filesize
68KB

Download
memory/756-32-0x000007FEF5D60000-0x000007FEF5D77000-memory.dmp

Filesize
92KB

Download
memory/756-31-0x000007FEF42D0000-0x000007FEF4450000-memory.dmp

Filesize
1.5MB

Download
memory/756-21-0x000007FEF6B10000-0x000007FEF6B21000-memory.dmp

Filesize
68KB

Download
memory/756-22-0x000007FEF6590000-0x000007FEF65A1000-memory.dmp

Filesize
68KB

Download
memory/756-23-0x000007FEF6570000-0x000007FEF658B000-memory.dmp

Filesize
108KB

Download
memory/756-24-0x000007FEF6550000-0x000007FEF6561000-memory.dmp

Filesize
68KB

Download
memory/756-28-0x000007FEF5DE0000-0x000007FEF5E5C000-memory.dmp

Filesize
496KB

Download
memory/756-29-0x000007FEF5E90000-0x000007FEF5EA1000-memory.dmp

Filesize
68KB

Download
memory/756-30-0x000007FEF5D80000-0x000007FEF5DD7000-memory.dmp

Filesize
348KB

Download
memory/756-25-0x000007FEF6530000-0x000007FEF6548000-memory.dmp

Filesize
96KB

Download
memory/756-27-0x000007FEF5EB0000-0x000007FEF5F17000-memory.dmp

Filesize
412KB

Download
memory/756-7-0x000007FEF5710000-0x000007FEF59C6000-memory.dmp

Filesize
2.7MB

Download
memory/756-14-0x000007FEF7320000-0x000007FEF7331000-memory.dmp

Filesize
68KB

Download
memory/756-13-0x000007FEF7340000-0x000007FEF735D000-memory.dmp

Filesize
116KB

Download
memory/756-12-0x000007FEF7360000-0x000007FEF7371000-memory.dmp

Filesize
68KB

Download
memory/756-11-0x000007FEF7380000-0x000007FEF7397000-memory.dmp

Filesize
92KB

Download
memory/756-10-0x000007FEF7450000-0x000007FEF7461000-memory.dmp

Filesize
68KB

Download
memory/756-9-0x000007FEFAD20000-0x000007FEFAD37000-memory.dmp

Filesize
92KB

Download
memory/756-8-0x000007FEFB370000-0x000007FEFB388000-memory.dmp

Filesize
96KB

Download
memory/756-5-0x000000013FDD0000-0x000000013FEC8000-memory.dmp

Filesize
992KB

Download
memory/756-6-0x000007FEF73A0000-0x000007FEF73D4000-memory.dmp

Filesize
208KB

Download