dharma | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Analysis

max time kernel
63s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2024 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

dharma defense_evasion discovery persistence ransomware spyware stealer

Malware Config

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Downloads MZ/PE file

Drops startup file 2 IoCs

Processes:

CoronaVirus.exeexplorer.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fd4ce0b0.exe	explorer.exe

Executes dropped EXE 22 IoCs

Processes:

CryptoWall.exeCoronaVirus.exeRensenware.exeRensenware.exeRensenware.exeCoronaVirus.exeCoronaVirus.exeCoronaVirus.exeRensenware.exeCoronaVirus.exeCoronaVirus.exe

pid	process
5892	CryptoWall.exe
6012	CoronaVirus.exe
5244	Rensenware.exe
4816	Rensenware.exe
5952	Rensenware.exe
6136	CoronaVirus.exe
6132	CoronaVirus.exe
5428	CoronaVirus.exe
3036	Rensenware.exe
5460	CoronaVirus.exe
1624	CoronaVirus.exe
5892	CryptoWall.exe
6012	CoronaVirus.exe
5244	Rensenware.exe
4816	Rensenware.exe
5952	Rensenware.exe
6136	CoronaVirus.exe
6132	CoronaVirus.exe
5428	CoronaVirus.exe
3036	Rensenware.exe
5460	CoronaVirus.exe
1624	CoronaVirus.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exeCoronaVirus.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fd4ce0b = "C:\\fd4ce0b0\\fd4ce0b0.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fd4ce0b0 = "C:\\Users\\Admin\\AppData\\Roaming\\fd4ce0b0.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe"	CoronaVirus.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

CoronaVirus.exe

description	ioc	process
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini	CoronaVirus.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

100 raw.githubusercontent.com
97 raw.githubusercontent.com
98 raw.githubusercontent.com
99 raw.githubusercontent.com
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

156 ip-addr.es
158 ip-addr.es
Drops file in System32 directory 1 IoCs

Processes:

CoronaVirus.exe

description ioc process

File created C:\Windows\System32\CoronaVirus.exe CoronaVirus.exe

flow	ioc
100	raw.githubusercontent.com
97	raw.githubusercontent.com
98	raw.githubusercontent.com
99	raw.githubusercontent.com

flow	ioc
156	ip-addr.es
158	ip-addr.es

description	ioc	process
File created	C:\Windows\System32\CoronaVirus.exe	CoronaVirus.exe

Drops file in Program Files directory 64 IoCs

Processes:

CoronaVirus.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\fi.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\7-Zip\7-zip.dll.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.id-EF892B62.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	CoronaVirus.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

Processes:

firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\CryptoWall.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Rensenware.exe:Zone.Identifier	firefox.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

CryptoWall.exeCoronaVirus.exeCoronaVirus.exeCoronaVirus.exeCoronaVirus.exeexplorer.exeCoronaVirus.exesvchost.exeCoronaVirus.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoWall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exedw20.exefirefox.exedw20.exedw20.exefirefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exedw20.exedw20.exedw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	firefox.exe

NTFS ADS 3 IoCs

Processes:

firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\Rensenware.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\CryptoWall.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

CoronaVirus.exe

pid	process
6012	CoronaVirus.exe
6012	CoronaVirus.exe
6012	CoronaVirus.exe
6012	CoronaVirus.exe
6012	CoronaVirus.exe
6012	CoronaVirus.exe
6012	CoronaVirus.exe
6012	CoronaVirus.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

CryptoWall.exeexplorer.exe

pid process

5892 CryptoWall.exe
5960 explorer.exe
5892 CryptoWall.exe
5960 explorer.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

firefox.exedw20.exedw20.exedw20.exe

description	pid	process
Token: SeDebugPrivilege	3724	firefox.exe
Token: SeDebugPrivilege	3724	firefox.exe
Token: SeBackupPrivilege	5416	dw20.exe
Token: SeBackupPrivilege	5416	dw20.exe
Token: SeBackupPrivilege	5448	dw20.exe
Token: SeBackupPrivilege	5448	dw20.exe
Token: SeBackupPrivilege	6004	dw20.exe
Token: SeBackupPrivilege	6004	dw20.exe
Token: SeDebugPrivilege	3724	firefox.exe
Token: SeDebugPrivilege	3724	firefox.exe
Token: SeBackupPrivilege	5416	dw20.exe
Token: SeBackupPrivilege	5416	dw20.exe
Token: SeBackupPrivilege	5448	dw20.exe
Token: SeBackupPrivilege	5448	dw20.exe
Token: SeBackupPrivilege	6004	dw20.exe
Token: SeBackupPrivilege	6004	dw20.exe

Suspicious use of FindShellTrayWindow 42 IoCs

Processes:

firefox.exe

pid	process
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe

Suspicious use of SendNotifyMessage 40 IoCs

Processes:

firefox.exe

pid	process
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

firefox.exe

pid	process
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 3996 wrote to memory of 3724	3996	firefox.exe	firefox.exe
PID 3996 wrote to memory of 3724	3996	firefox.exe	firefox.exe
PID 3996 wrote to memory of 3724	3996	firefox.exe	firefox.exe
PID 3996 wrote to memory of 3724	3996	firefox.exe	firefox.exe
PID 3996 wrote to memory of 3724	3996	firefox.exe	firefox.exe
PID 3996 wrote to memory of 3724	3996	firefox.exe	firefox.exe
PID 3996 wrote to memory of 3724	3996	firefox.exe	firefox.exe
PID 3996 wrote to memory of 3724	3996	firefox.exe	firefox.exe
PID 3996 wrote to memory of 3724	3996	firefox.exe	firefox.exe
PID 3996 wrote to memory of 3724	3996	firefox.exe	firefox.exe
PID 3996 wrote to memory of 3724	3996	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 644	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 3792	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 3792	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 3792	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 3792	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 3792	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 3792	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 3792	3724	firefox.exe	firefox.exe
PID 3724 wrote to memory of 3792	3724	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/Da2dalus/The-MALWARE-Repo"
1⤵
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/Da2dalus/The-MALWARE-Repo
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1588 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e431833f-d01d-4292-9e13-37b1c995a811} 3724 "\\.\pipe\gecko-crash-server-pipe.3724" gpu
    3⤵
    PID:644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2380 -prefMapHandle 2376 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24f68983-5073-479d-accf-055c793cbd27} 3724 "\\.\pipe\gecko-crash-server-pipe.3724" socket
    3⤵
    PID:3792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3128 -childID 1 -isForBrowser -prefsHandle 2948 -prefMapHandle 3208 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1020 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2322e7c6-9f0d-4c1a-9a01-def4fd81e7bc} 3724 "\\.\pipe\gecko-crash-server-pipe.3724" tab
    3⤵
    PID:4700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3416 -childID 2 -isForBrowser -prefsHandle 3640 -prefMapHandle 2768 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1020 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a855ac6e-aed6-40e4-bf6c-e23c52183cac} 3724 "\\.\pipe\gecko-crash-server-pipe.3724" tab
    3⤵
    PID:680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4832 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4844 -prefMapHandle 4840 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c23c5ed-0131-4732-873d-0d3df5b24e74} 3724 "\\.\pipe\gecko-crash-server-pipe.3724" utility
    3⤵
    - Checks processor information in registry
    PID:2024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5400 -childID 3 -isForBrowser -prefsHandle 5392 -prefMapHandle 5388 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1020 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {91368758-9bb9-47bf-b756-75aa34bfb5a4} 3724 "\\.\pipe\gecko-crash-server-pipe.3724" tab
    3⤵
    PID:2332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5632 -childID 4 -isForBrowser -prefsHandle 5552 -prefMapHandle 5556 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1020 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb2528cb-efc8-4765-afd6-a265550a7408} 3724 "\\.\pipe\gecko-crash-server-pipe.3724" tab
    3⤵
    PID:4412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5840 -childID 5 -isForBrowser -prefsHandle 5748 -prefMapHandle 5752 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1020 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3071bc52-cf8b-462c-a72f-1670f630d54b} 3724 "\\.\pipe\gecko-crash-server-pipe.3724" tab
    3⤵
    PID:4624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2700 -childID 6 -isForBrowser -prefsHandle 6308 -prefMapHandle 4220 -prefsLen 27172 -prefMapSize 244658 -jsInitHandle 1020 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b5bd769-1708-41b0-a5d2-c3950b904047} 3724 "\\.\pipe\gecko-crash-server-pipe.3724" tab
    3⤵
    PID:2056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6692 -childID 7 -isForBrowser -prefsHandle 6608 -prefMapHandle 6680 -prefsLen 27172 -prefMapSize 244658 -jsInitHandle 1020 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {98d30049-6cd5-4055-8887-7a0ce4df949d} 3724 "\\.\pipe\gecko-crash-server-pipe.3724" tab
    3⤵
    PID:5216

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5788

C:\Users\Admin\Downloads\CryptoWall.exe
"C:\Users\Admin\Downloads\CryptoWall.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
PID:5892
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\syswow64\explorer.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  PID:5960
- - C:\Windows\SysWOW64\svchost.exe
    -k netsvcs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6040

C:\Users\Admin\Downloads\CoronaVirus.exe
"C:\Users\Admin\Downloads\CoronaVirus.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6012
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:3200

C:\Users\Admin\Downloads\Rensenware.exe
"C:\Users\Admin\Downloads\Rensenware.exe"
1⤵
- Executes dropped EXE
PID:5244
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 868
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:5448

C:\Users\Admin\Downloads\Rensenware.exe
"C:\Users\Admin\Downloads\Rensenware.exe"
1⤵
- Executes dropped EXE
PID:4816
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 816
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:5416

C:\Users\Admin\Downloads\Rensenware.exe
"C:\Users\Admin\Downloads\Rensenware.exe"
1⤵
- Executes dropped EXE
PID:5952
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 816
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:6004

C:\Users\Admin\Downloads\CoronaVirus.exe
"C:\Users\Admin\Downloads\CoronaVirus.exe" C:\Users\Admin\Downloads\Rensenware.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6136

C:\Users\Admin\Downloads\CoronaVirus.exe
"C:\Users\Admin\Downloads\CoronaVirus.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6132

C:\Users\Admin\Downloads\CoronaVirus.exe
"C:\Users\Admin\Downloads\CoronaVirus.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5428

C:\Users\Admin\Downloads\Rensenware.exe
"C:\Users\Admin\Downloads\Rensenware.exe"
1⤵
- Executes dropped EXE
PID:3036
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 816
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:940

C:\Users\Admin\Downloads\CoronaVirus.exe
"C:\Users\Admin\Downloads\CoronaVirus.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5460

C:\Users\Admin\Downloads\CoronaVirus.exe
"C:\Users\Admin\Downloads\CoronaVirus.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1624

C:\Users\Admin\Downloads\Rensenware.exe
"C:\Users\Admin\Downloads\Rensenware.exe"
1⤵
PID:6244
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 816
  2⤵
  PID:17128

C:\Users\Admin\Downloads\Rensenware.exe
"C:\Users\Admin\Downloads\Rensenware.exe"
1⤵
PID:15548
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 816
  2⤵
  PID:18896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-EF892B62.[[email protected]].ncov

Filesize
2.7MB

MD5
87b8379a85a581cff0d941ea012fc703

SHA1
6022de5ad0580939a5affc68ebf0ce6d15261bcd

SHA256
343564e86621c644de0550bda925c4fc83879b934726ccba1e3ae1626d3fd4ce

SHA512
6da95e9820d2c240b5d80ef6ee2ac65af50e0fa909095a946573e68da41ffd91f3ac28a93f7f7066d5af8e33c2ec9802b667da7c31550e80581a18205046213b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\activity-stream.discovery_stream.json

Filesize
27KB

MD5
f0a1f9ed70bab5bf2a35301f879ec0aa

SHA1
6287a6123cc6ca2906877209e391411a6982b1bb

SHA256
7b606a457d059a0ec9419a8a69bbd98bd62f5c7d06b531fa9659bdcdbd0d8516

SHA512
3e03c042c488794d38238776356951eff98a8ac8aa59656e1873dd9d9c82bd0831f3ea8e020713af4f98e7e4fb433dd2a048dce1d7365d9d0a542e96fcacd3f5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\03C5414C101F2F03E0251F68E14AC8998D89E1D8

Filesize
124KB

MD5
c8e2435a51c3032df7f302211a922549

SHA1
6efacb34d3041f8ae36d35f6ade690fabd7124bc

SHA256
2c1f975be896779655e9581f60554799c8818724145afb2f467afab5c6c868ce

SHA512
24c7942931af58ffc595c96ecc1be606dc607f90fd7c043aff3ea57cc7d2049754b525a1d4c79e775fa422aa4964b022d45286464937494ee28da0643560ca0e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\067740F68252BECC354D15C656C6286D001C3D12

Filesize
100KB

MD5
dba4056f7fdd374294ded21bcfd16d1c

SHA1
e1220c3a4691227b347d5b1461739daf81c0334c

SHA256
1a8b406cf25476805912935eb6476cecf9135b7f8b60b02aa3b34adfce810014

SHA512
7d4aa2cab5cfa88c192fad4ada8c56afdabb806d92a3a4385a8b0b8a697f70ab1e205c098962eb23592fd248e19912c09bd55530e6ae498e6ec276861673f521

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\14CC450048B26323976C3F9913B909D1CF763966

Filesize
169KB

MD5
b3a0bf58e861fa85caf1224f23c390bf

SHA1
df763c432ef8ff26df378a763ac16388cf5e0e76

SHA256
80b4cd438af9e769a283cdced44a809bc5b5b25ec4c7eeac6412a1d1802ea08b

SHA512
02145912b8ff8320035d9fa2d5ac13f7911a6d04e6cf44771d81f7b5ec90fb68e6aa9c554c51c0bcb67243198fd237d0f548bbf11cf9f97e9956fb3fe52cefcb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\2492994A253B970917AF5CDF605580B1C2DC16A0

Filesize
791KB

MD5
b9cce0d3caae4aa790c96ebf0e45a726

SHA1
1153603061cccf7e8eb1097f64bcb2162b5253ae

SHA256
4f65bfe5e01e9b1cfc3baf7f0352ed10a9cb0c9d4416cdc7cf4a8152e2a08589

SHA512
8196af95e15b9fb4eb5286c85042a8a87208760635068994f24222a020d9aab2b6b4005db41ac2817ff69fa3034e6e67c713e15aac85cbb4e247225af180e163

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\3499E0CDB4968FF402067428EA75B46BFF8FE5DE

Filesize
149KB

MD5
1789fdff5614a188017333918e1818ff

SHA1
c06bc512d442f2a3fe97fc94b40478945276057e

SHA256
043c2e9d28e61905c9c447ea0382fa09e360b5be8edf57235de1c6f8d0bc2b5e

SHA512
5d4cae5d7eafffbd4ce58aa466943ab08a23fd85a3c130d693328c38c8e412a15dd889ab7d8d3c76ca53f2bb24b03cebd6efb90baa6ff912ad39653dc11f55ed

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\4BCF7D608B2663D7D1515223C0F13E5D72484770

Filesize
80KB

MD5
9195fdefee82f76ba3297b5f13aed82a

SHA1
6be91d855808fdaad9eb14a689d3026ce862774a

SHA256
5a9d6755d91bf9c3ef5c0570b54258821b3a707789511fbb6f43ae078da25151

SHA512
31573e01788091114734f4769d28a7475262552138e2f857386e34c519172d37a1a137835ec54e83911f4e7d3b3f5503fcaa7c011723594bfb07822874c223a8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\5BB66A8F6778DEB9D595D468945EFF9C7D66B934

Filesize
68KB

MD5
4eb98c485061bd9e21d064db31fe4242

SHA1
254b3a89c8bae391c1e234615e76ba646c69cf94

SHA256
a4d29612c8df8aef3adb8b70f7d689043dc96ab571b01a5808b03beda941c238

SHA512
9d18d270460c79af28ed482c0e657c68790fb8600f93577104b827dcb1f2e7f37e7eda7656a26c01e0e20b0813d0cd7519979d31286f1897799a916551d045ae

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\705EEC7711E1081A5A4278AA905A36700F726042

Filesize
22KB

MD5
94efad2248b498525dfb4eb2a43f437e

SHA1
2f765cc8b6c2d34d9019d6c7b0b671dd9a3a93c1

SHA256
ba9e1f90ccea464dc6773457c33ae77aefd1eed37a472963b45e2af98d0f774d

SHA512
5bf5b8d6f29b773a78dae3d8ca2e6e7a173bfa7bb9a73309b951622125cc3ad31e6e2560e7e40a481974a28e5f3256844b1231719a7c2522f23d8990b902cda0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\7A55D2D1E17B7F574CA16E74F1211A1491FE9B3A

Filesize
163KB

MD5
0b024e75150ddb95339c5ca8277cd73f

SHA1
8964910553c1332d173c7c8e55a3ab1edde67453

SHA256
d6719aaf8e0dd65f07bf9a99937cd03fc4c6b5e8e6c29f95127544389d0c6c51

SHA512
e719b8a17e15252f7f3e0ff5bf3e103ddc8c05d1cadb176200515af4bdc7d54abf96ff045ad664bad79de6edeb43e9e322f53a6eddcd63153ec91236eb821612

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\85248FDBF15200EBE736EC349D37880DB1104916

Filesize
249KB

MD5
886cb2d14725074ca487af953e9e29aa

SHA1
3df619cc3db1c2e880e73fae617eb08a34da221a

SHA256
7a89cd9d99794e22df3009ac1f697dda95184e031942d6bc7e008207300adc65

SHA512
a2816c7bf0d0c2bfb7cee755ca261d482304a0b68d59d5b8abb4520321475aeb67cd544a947231e330f6360730e9b6eeb5e102340d00ffe42dc154ecfc4d2042

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\AF6E7B7DB9908D7B867517AC33D094ABD56E38F7

Filesize
81KB

MD5
ddbd54f3490ae86340bf59a1eec00b31

SHA1
862ecd415fdb07980957192ca1c70cd1e3c7ece9

SHA256
36dc0a637375e025796e42124d24d922c80d417d5bd4066e91e9806f135bf825

SHA512
483d19345a6ae3443cb11ab06b539a55970f43ef88fa0c01d56502bd89bf2edbbdc7e09968780646a3dca8e9d2ab739628908b64a6e566692657ac1332de4f2c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\BF0923D6C9AC3F4148AB74C98E937ACD57DCEAD3

Filesize
97KB

MD5
b92f55317517eba227232e9e60375605

SHA1
ee0be93f18574c0387d49858e7e3b58773487d90

SHA256
c87fc9f3cc93639a4cdad83b90e7f8f44e7558832058f23691a2259c90424087

SHA512
6dc11c4c95b7b1aea8ad2e19cc4db9eaad87754fa17138ded2a2d5a226722a72601f1462a0125d309a87f8216361b9b0e6b979f71f9688cb4067a19d7926a900

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\BFEF5B7F3B00F0A81ED1F7E43EA7F8DE07A9D010

Filesize
104KB

MD5
cefe57010bd9296876d79c44481f88e9

SHA1
8d9706b07042c47f3bceb677f5012cbf98aad96e

SHA256
66a4733a0fa4daf0b0e01d8cbd631eea0b22875b0ef44191116412a958f361a8

SHA512
204e882b8f3eff401bd1496056e31c49017925a184f148787430bd9a92e8cb1ef37d4f21bdba51b5674d30f694659dc613af723a8f82bd973322f3f04873531b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\C4014B3C0BC5B7AF8F3DA85FBDB4F9E4C7B072C6

Filesize
123KB

MD5
d50cb5eed8d87165f70f50a8cd6d12c4

SHA1
9a4322984eaa9b17139d33fbb3b68cc6d2f18a87

SHA256
1911f681268dd1d0e084e9609d0797395ea569640d5118ef10a0b20472eb0e3b

SHA512
7075243b3bc1bbb184e0bfedcebc5a6330645f1e82ebc2751e3fa99adfc282dea2da63997cef4a656aade7c6d2f176d0eca112b2560b65d74ef5e6179a558eb0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\C88FE6FE8ED0018995E76FB6B4CAEB37655B5835

Filesize
2.1MB

MD5
261af348ee8e41c6544d61fd0dd400f2

SHA1
e08ecce641d1096ca9e140e2277078057a92b600

SHA256
ba38cc8897889dc5c9e3829e840f3a416cd5d9799c76c567c21db61732e5ee78

SHA512
e2c014c51c6d1a4a783a42fc6c75e7968118201afb2b0be64d7edf452fd3edb4d00035293c6299336bda5b2e7fa102d7b023222d54c4c18ab4f568e4f5c21f8b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\E6C22A3DFCD18E3C6145370266896FF76AE3F7EC

Filesize
92KB

MD5
1a748caffad1ac70f3f4a6d404e52374

SHA1
504b7023a95288114b9b06db5e4408d022e6bc92

SHA256
a9a21188f8a8673539795fe1e0ff71e31b2b59a1d4b2bf89c1960f9b6f2ae05b

SHA512
fe175f269216806697717025973e58ae3be78d18b3858410331dd65b2edb942747fd8c36e8344f9020eba75ddaad1d8fabd1c5cba3eea3acc285f4eb7982995b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\ECE281212C7D34C2D33214DAB8505B450499A76C

Filesize
86KB

MD5
d31483761eb93d92d1fdf24d1ce51f98

SHA1
3d92c883c44f2d1900a30c9b47684c9564e73f87

SHA256
860750d5d2b3045f615fa4c45266864d59d283ee0db91950e679099232693196

SHA512
ca844a89e4d339329d53d00480021162f837e81536824f443c322c845bc00f2d0f6ae44eaa3f5c4a488019b0f925855cf7a4db1bdb9af6f55847dfa9b47c551e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\F5A1FBDEF4E6F115791D6C8EF1598942067B8080

Filesize
79KB

MD5
aad63e6046872b23984cb3edd57db9d1

SHA1
3b5faa877beb30d93118ef755a5ae21856ee34cc

SHA256
7b28b339f87b18584e9c926b92846369f28fbb05c7cc353a1b524226331ea68c

SHA512
fe1c9609119978efd39dadedf4c0a08e411a994f80195415254b6de0127f43d2cc99d5b7f6be33870d44a8eb0b4bb16739ab8ac1389724e5185ddb10481d6f75

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Filesize
1.0MB

MD5
055d1462f66a350d9886542d4d79bc2b

SHA1
f1086d2f667d807dbb1aa362a7a809ea119f2565

SHA256
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

SHA512
2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\AlternateServices.bin

Filesize
8KB

MD5
2650310088d1a44c332a858045bd55ac

SHA1
aa645db04818d52737c566d45766400e246ee8f9

SHA256
f9b94b954e329dfb4cf64e3b8079693e9af4330d1d961162211361ba05764337

SHA512
cf053f84d8c04395e0b329dc72b4e12df1a30aade4d2432f806d72f5a4d461ce7e463f4256c10f735d8ef1cb6970a183cd4ee13ab56df1e75129283af36eef55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
ac103464a6c96d956a6008881614f488

SHA1
24e9794b9b7c8b65695bf4e98bd3e378e2674251

SHA256
49af47364ecf4a7236998cefcfe3ab78cab717319afb1a1df346e1d2e12cac61

SHA512
24475b4238db6f404092d3814965eb73dfa133b1ec95501f5446323d937d2519973945bdc1b183d122ea5fd31dab6f2a71be312fcf60f3abb8e8e13855beb64a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
d450f2549769ce302d055a759bba3316

SHA1
6dd4a97ccc3437d70c01dee82dc4f97c91902bc9

SHA256
bed2d96f66b646b4b33850d59a50f97ff26046965ef4d23605fa2e3f9786e424

SHA512
815767dc94fda1e9e6b6ec62cefb581911a55c1cf348355b76cf4255f42b4d9c434c7620b3470cebc5da2635aefc055bc1bc6cd0b267dbbc78e437265d74ceaf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
eff69fefb4a8f1ee26b4e63ba72ca424

SHA1
300355760446c9abfb110d6d070f4f3196d43ed5

SHA256
267d750a79e6537fb16d557eecdabb82eb2aeedf755be8d0d0125525d568226e

SHA512
121e4b8e65d4a21d144129af3088d3459d2ed1c8d15046a89a65fc30d091c63f727767559ea53c5fb0d35093d8a7f6c977737aaba4e4da829d15e9318e8baf2f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\pending_pings\5af7e17d-b8a6-4846-b36f-f8a0abc1e78e

Filesize
982B

MD5
a9c64820ffed6d2d84594c44f225becf

SHA1
6cb283a26e1a2bd0c3b3ada57a1b001aeeb5e07a

SHA256
53b0ea80cf410e2a5ce8dd1515ea11f83c4043a7a5a3aadf809358a125de3f20

SHA512
ed15f9942fd9d9c67879d400af14609bde595be1f2880d7a0a9c6c3edd7bbc6bdc2c863de3d038861ff569ad5998ca2b2b0c17ef7a40a3c32740c5b0b7a1e274

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\pending_pings\5fb633a2-68cc-4dc7-a820-81b7c444176d

Filesize
27KB

MD5
a3432e883491e3fd1e412bb3f767c74f

SHA1
3e0c0d54918db7034f4b70cf353d5b90f51a6c28

SHA256
41e8284786ef01fac03aeebcf300486ae3bf2c4ced18581e948d7e8f60347633

SHA512
df74045ae8cfa26d493879b0f3daeaabea8ce491945422cfac7bb551aa2124bf1e8e183c8ae2782ad4098da590d50e663b572ba6ce23279fe06269178eb68534

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\pending_pings\b795d3e9-bf1d-448f-970d-337c54a8069b

Filesize
671B

MD5
4e75f64063686a573c58a687aeee035c

SHA1
d8b6f2400a62e3b7db7e63a241c3a6f8b8bd2aaf

SHA256
58000b0f484d8b77d22b611a4f740d6745c914edc615009a0446aad4169125c7

SHA512
46b7e2ab65efc0927bf5f656322cb9a08b0546e612a253c68ebcd3a7a6c5351c61c12c066b9a9b45db7f7654b03ee05d7a223ad732dddfd6e114737759b88adf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\prefs-1.js

Filesize
11KB

MD5
2c613173cdab96e626c26a5b7ae4ab92

SHA1
fe25bb249b57b5daddb9bff2b146f4a0cf499003

SHA256
2ae96273b994ca00fd43123ae602ae5bfddf8dde6b524f4941ef304afbfe7006

SHA512
2f00fbeb9696eb97e15f3f5441b94c36493b19e308902ab788a49d53e4ad8398edcf3fc7a8cd75e714044be9effb52deffb6607fd56e64a0ab73b796aa269f99

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\prefs.js

Filesize
11KB

MD5
a66ca9cd5f3bc1a70998a1f0f2175467

SHA1
83a00a58f709d7409af3a724854c01e862dba7c3

SHA256
1f10cf66ce960ca95a4524b60ea0a4831533fd932625be7e6a628e677591ba70

SHA512
50b5894735fa52ca20c6435c58a0e26a4ca42266288886f9630e3ff43717e27e673f2e2067c97798248fba043697474ad2d4899a0eef538c4b543c3cd448b74d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\prefs.js

Filesize
11KB

MD5
c88d21071ed7d30d2413a4595c7a9b1a

SHA1
3fb53bcd28d7964ede3327073b3ad1636dc85b5e

SHA256
0cb0e09691491959cf7146a186eb6ac42f3586fe4123b22726d7c7a3d9b2a379

SHA512
5c429141a34285dadd61dbb261a916aa0802f0c58e77669134af011fa525c08e14a07110cbdf680c508f7a1d7d51d564fc7e8634abbe104dc87b59681808869d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\prefs.js

Filesize
11KB

MD5
bd992d09533890fa0e87d5e0b4ba03a0

SHA1
cc349f420daa6a824afa2fefa579c54db1e4cca6

SHA256
de7da39452e10cd211b2679cdce1283963c1e4c30755ae8a44b0a744a791d473

SHA512
555217525eee4fbabb87126a266fbb3ccab7c9e7daeb236e1627861837d03de2caac023c2ef4eeaea3c4e478638e92d1cf7bbf71d9d89bb8f2e7970e2b847b9d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
c45cdbf99836bcd2abc6e93f3acaff7a

SHA1
d2afacdf198e794ab6a0375936db2c0310d1baf8

SHA256
26c822d9e3553ce91c0dd34444520f99cd810bd5a43bb6afa15936c35ec978b4

SHA512
6c56cd476da88eea230766fd233af51633c2a37aa71df98684408f9700906e067f49833b2cdecd7b97a011c6497cd3aad0411103fc7ae710efd9f7e80ad7c9d5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
13e6f316d4f02150a073b3f42d8c8305

SHA1
5501e0d1b2c821b34691ed792cd4e6141fd7571e

SHA256
e9ea09ed3aac74b9a37869a4aff8a37d68fe74450fa4325d4f092696b9913aa9

SHA512
d11ff83445af301d4452b55bbfd52aa2f3dd4113eeff68d081fabacaaf0ccfbe8e3e8c286dc32193f01e06aa39a6e742a30ae5a3ccee24f7950c86854dcc778b

Download Submit
C:\Users\Admin\Downloads\CryptoWall.exe

Filesize
132KB

MD5
919034c8efb9678f96b47a20fa6199f2

SHA1
747070c74d0400cffeb28fbea17b64297f14cfbd

SHA256
e036d68b8f8b7afc6c8b6252876e1e290f11a26d4ad18ac6f310662845b2c734

SHA512
745a81c50bbfd62234edb9788c83a22e0588c5d25c00881901923a02d7096c71ef5f0cd5b73f92ad974e5174de064b0c5ea8044509039aab14b2aed83735a7c4

Download Submit
C:\Users\Admin\Downloads\Rensenware.exe

Filesize
96KB

MD5
60335edf459643a87168da8ed74c2b60

SHA1
61f3e01174a6557f9c0bfc89ae682d37a7e91e2e

SHA256
7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a

SHA512
b4e5e4d4f0b4a52243d6756c66b4fe6f4b39e64df7790072046e8a3dadad3a1be30b8689a1bab8257cc35cb4df652888ddf62b4e1fccb33e1bbf1f5416d73efb

Download Submit
C:\Users\Admin\Downloads\SuspendNew.mp3.RENSENWARE

Filesize
699KB

MD5
ac419945bc075b4fe9b2790a548f0889

SHA1
d8c25acaf3ec1f6ac71965edf2c9ce0d5295832d

SHA256
44959109696a045f78b7c2fa7d704528336560d82322cf680140665846a22280

SHA512
125e1741b3d50c17019d80d4c894a751d9c862d62f936369091e0ac7c888a910b65ee4b9ef0d8756bacf77bd42144e60ba975b7bf2371ade28022340ec83cc8c

Download Submit
C:\Users\Admin\Downloads\UseMove.mp4.RENSENWARE

Filesize
282KB

MD5
e3a4806b3fb7ddd6ad0c362f69170aba

SHA1
c07db9c3ff6f8d6349b67c95b346ab9c60bd77cd

SHA256
12483aa985e82a292d3a0bf3fa8647d1682cb3f87defc7b3c870fea471fd4aed

SHA512
3cfcf93105f6778ebd2ad8dd4230d358af7db40c6eb2756184c92af0674be6f171c43bace8d8102014a88cbbbedc4cd0eb595c0270b01d9cb980332eff0265c9

Download Submit
C:\Users\Admin\Music\RegisterTest.txt.RENSENWARE

Filesize
537KB

MD5
c783a2bf588a2ee5f2910ebb817670b9

SHA1
e4674117fb1a3975f74880aa5f88aa9287e9b332

SHA256
fb97d99a2b86ddd70c748c98bc8f168043a886afcca6aaedebda831f523c4912

SHA512
1c2c1f2ba38aec478c7da335fc609b7f906fbafc85e06dc3cb71cf3dfce07b3ea0c9484875bb1877d7b29a0d8498068776a465573a9d1786299884253218e6f5

Download Submit
C:\Users\Admin\Pictures\My Wallpaper.jpg.RENSENWARE

Filesize
24KB

MD5
2416ce120e969c5016c8d01842b36299

SHA1
0a4ad1f1940257106c774bfc547b48ccc73b39a6

SHA256
ae37bc94eb019f2dc40f67bc9d82d336947a4c9b0542713bddfbbffa4451a449

SHA512
2aa102acf8f137fa025044ccf3e104ccc9f5929deb9e8726d50387bda84922f46094329d5374152c095dbf030fe79e4bd1f67c21de6a2b5fcb77e73c25555683

Download Submit
C:\fd4ce0b0\fd4ce0b0.exe

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1624-1041-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/1624-8177-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/1624-7807-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/1624-8177-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/1624-7807-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/1624-1041-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5244-986-0x000000001BEA0000-0x000000001C36E000-memory.dmp

Filesize
4.8MB

Download
memory/5244-987-0x000000001C410000-0x000000001C4AC000-memory.dmp

Filesize
624KB

Download
memory/5244-987-0x000000001C410000-0x000000001C4AC000-memory.dmp

Filesize
624KB

Download
memory/5244-986-0x000000001BEA0000-0x000000001C36E000-memory.dmp

Filesize
4.8MB

Download
memory/5428-7806-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5428-7542-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5428-7806-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5428-1035-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5428-7542-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5428-1035-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5460-1039-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5460-1039-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5460-7545-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5460-7545-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5460-8166-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5460-8166-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5960-970-0x0000000000320000-0x0000000000345000-memory.dmp

Filesize
148KB

Download
memory/5960-970-0x0000000000320000-0x0000000000345000-memory.dmp

Filesize
148KB

Download
memory/5960-969-0x0000000000320000-0x0000000000345000-memory.dmp

Filesize
148KB

Download
memory/5960-969-0x0000000000320000-0x0000000000345000-memory.dmp

Filesize
148KB

Download
memory/6012-976-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/6012-1042-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/6012-1042-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/6012-976-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/6040-977-0x0000000000920000-0x0000000000945000-memory.dmp

Filesize
148KB

Download
memory/6040-977-0x0000000000920000-0x0000000000945000-memory.dmp

Filesize
148KB

Download
memory/6132-7544-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/6132-7544-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/6132-8167-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/6132-1033-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/6132-8167-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/6132-1033-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/6136-1031-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/6136-7842-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/6136-7543-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/6136-7842-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/6136-7543-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/6136-1031-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download

pid	process
5892	CryptoWall.exe
5960	explorer.exe
5892	CryptoWall.exe
5960	explorer.exe