wannacry | 905bb2585fdd9626b300e917ec0e4f89dd5fbea6381684efe5008551c5cc5902

Analysis

max time kernel
329s
max time network
646s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16-08-2024 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hel.txt
Size

244B
MD5

da0f814f2dc31ac1076cdd89a44e8d92
SHA1

5ab7fb0c68a2cdfd5c8571c168e260982daae757
SHA256

905bb2585fdd9626b300e917ec0e4f89dd5fbea6381684efe5008551c5cc5902
SHA512

782a6a4744f20c13768c91bf429e7245b43f40e5c14d22077207a6ca9d30330a1b333b2baeb8a08613c9b0f031ee338aff1befdae2081dd17c166e8679a49403

Score

10^/10

wannacry bootkit defense_evasion discovery execution impact persistence ransomware worm

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Downloads MZ/PE file

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD4AD4.tmp	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD4AD8.tmp	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

Executes dropped EXE 6 IoCs

pid	Process
3420	Monoxidex64.exe
2464	姳刊輚葉硉痗熍矜晻戼嵓鐖鐩辑奌嫪.exe
3688	taskdl.exe
756	@[email protected]
3436	@[email protected]
1544	taskhsvc.exe

Loads dropped DLL 19 IoCs

pid	Process
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
3420	Monoxidex64.exe
1200	Process not Found
3484	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
3484	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
3280	cscript.exe
3484	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
3256	cmd.exe
756	@[email protected]
756	@[email protected]
1544	taskhsvc.exe
1544	taskhsvc.exe
1544	taskhsvc.exe
1544	taskhsvc.exe
1544	taskhsvc.exe
1544	taskhsvc.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2644	icacls.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
98	raw.githubusercontent.com
95	raw.githubusercontent.com
96	raw.githubusercontent.com
97	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe
File opened for modification	\??\PhysicalDrive0	姳刊輚葉硉痗熍矜晻戼嵓鐖鐩辑奌嫪.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSOXMLED.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3936	vssadmin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	firefox.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\salinewin.exe-Malware-main.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\MEMZ-virus-main.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Monoxidex64.exe.vir:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\AppData\Local\Temp\姳刊輚葉硉痗熍矜晻戼嵓鐖鐩辑奌嫪.exe\:Zone.Identifier:$DATA	Monoxidex64.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2820	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2120	POWERPNT.EXE
1448	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1544	taskhsvc.exe
1544	taskhsvc.exe
1544	taskhsvc.exe
2816	MEMZ.exe
2276	MEMZ.exe
1164	MEMZ.exe
692	MEMZ.exe
2816	MEMZ.exe
2104	MEMZ.exe
1164	MEMZ.exe
2276	MEMZ.exe
692	MEMZ.exe
2104	MEMZ.exe
2816	MEMZ.exe
2276	MEMZ.exe
2104	MEMZ.exe
1164	MEMZ.exe
692	MEMZ.exe
2816	MEMZ.exe
2104	MEMZ.exe
2276	MEMZ.exe
692	MEMZ.exe
1164	MEMZ.exe
2816	MEMZ.exe
2276	MEMZ.exe
1164	MEMZ.exe
2104	MEMZ.exe
692	MEMZ.exe
2816	MEMZ.exe
2104	MEMZ.exe
1164	MEMZ.exe
2816	MEMZ.exe
2276	MEMZ.exe
692	MEMZ.exe
1164	MEMZ.exe
2276	MEMZ.exe
2104	MEMZ.exe
2816	MEMZ.exe
692	MEMZ.exe
2816	MEMZ.exe
1164	MEMZ.exe
692	MEMZ.exe
2276	MEMZ.exe
2104	MEMZ.exe
2276	MEMZ.exe
1164	MEMZ.exe
2816	MEMZ.exe
692	MEMZ.exe
2104	MEMZ.exe
1164	MEMZ.exe
2276	MEMZ.exe
692	MEMZ.exe
2816	MEMZ.exe
2104	MEMZ.exe
2816	MEMZ.exe
2276	MEMZ.exe
692	MEMZ.exe
1164	MEMZ.exe
2104	MEMZ.exe
2104	MEMZ.exe
2276	MEMZ.exe
692	MEMZ.exe
1164	MEMZ.exe
2816	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1448	vlc.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2136	firefox.exe
Token: SeDebugPrivilege	2136	firefox.exe
Token: SeDebugPrivilege	2136	firefox.exe
Token: SeDebugPrivilege	2136	firefox.exe
Token: SeDebugPrivilege	2136	firefox.exe
Token: SeDebugPrivilege	2136	firefox.exe
Token: SeDebugPrivilege	2464	姳刊輚葉硉痗熍矜晻戼嵓鐖鐩辑奌嫪.exe
Token: SeTakeOwnershipPrivilege	2464	姳刊輚葉硉痗熍矜晻戼嵓鐖鐩辑奌嫪.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
2820	NOTEPAD.EXE
1448	vlc.exe
1448	vlc.exe
1448	vlc.exe
1448	vlc.exe
1448	vlc.exe
1448	vlc.exe
1448	vlc.exe
1448	vlc.exe
1448	vlc.exe
2136	firefox.exe
3220	wmplayer.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
1448	vlc.exe
1448	vlc.exe
1448	vlc.exe
1448	vlc.exe
1448	vlc.exe
1448	vlc.exe
1448	vlc.exe
1448	vlc.exe

Suspicious use of SetWindowsHookEx 34 IoCs

pid	Process
1448	vlc.exe
1048	mspaint.exe
1048	mspaint.exe
1048	mspaint.exe
1048	mspaint.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
756	@[email protected]
3436	@[email protected]
756	@[email protected]
3436	@[email protected]
2464	姳刊輚葉硉痗熍矜晻戼嵓鐖鐩辑奌嫪.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2572	2120	POWERPNT.EXE	39
PID 2120 wrote to memory of 2572	2120	POWERPNT.EXE	39
PID 2120 wrote to memory of 2572	2120	POWERPNT.EXE	39
PID 2120 wrote to memory of 2572	2120	POWERPNT.EXE	39
PID 808 wrote to memory of 2136	808	firefox.exe	44
PID 808 wrote to memory of 2136	808	firefox.exe	44
PID 808 wrote to memory of 2136	808	firefox.exe	44
PID 808 wrote to memory of 2136	808	firefox.exe	44
PID 808 wrote to memory of 2136	808	firefox.exe	44
PID 808 wrote to memory of 2136	808	firefox.exe	44
PID 808 wrote to memory of 2136	808	firefox.exe	44
PID 808 wrote to memory of 2136	808	firefox.exe	44
PID 808 wrote to memory of 2136	808	firefox.exe	44
PID 808 wrote to memory of 2136	808	firefox.exe	44
PID 808 wrote to memory of 2136	808	firefox.exe	44
PID 808 wrote to memory of 2136	808	firefox.exe	44
PID 2136 wrote to memory of 2044	2136	firefox.exe	45
PID 2136 wrote to memory of 2044	2136	firefox.exe	45
PID 2136 wrote to memory of 2044	2136	firefox.exe	45
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1800	2136	firefox.exe	46
PID 2136 wrote to memory of 1932	2136	firefox.exe	47

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1700	attrib.exe
2892	attrib.exe

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\hel.txt
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:2820

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2176

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2148

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2536

C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" /n "C:\Users\Admin\Desktop\PopFind.potm"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2572

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ResumeConnect.MTS"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1448

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\RequestUnlock.wmf"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1048

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.0.1295208825\1853410909" -parentBuildID 20221007134813 -prefsHandle 1216 -prefMapHandle 1208 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fb26e01-78bd-4223-8e8e-a03d535f1ff7} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 1280 f4eaa58 gpu
    3⤵
    PID:2044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.1.2037371749\1664843716" -parentBuildID 20221007134813 -prefsHandle 1468 -prefMapHandle 1464 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {02c0a99f-512f-4f95-8c2c-e517da4994aa} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 1484 d6fb58 socket
    3⤵
    - Checks processor information in registry
    PID:1800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.2.1755099464\2137643709" -childID 1 -isForBrowser -prefsHandle 2080 -prefMapHandle 2076 -prefsLen 20966 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {192a5309-a539-4dc5-a1fb-b31e3fed4866} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 2092 1a19f758 tab
    3⤵
    PID:1932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.3.1305005840\2041715360" -childID 2 -isForBrowser -prefsHandle 2376 -prefMapHandle 2380 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {17fcb071-6ab5-47c1-b38e-a98e6c6bb2dd} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 2368 1a2c8558 tab
    3⤵
    PID:2900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.4.1937802904\568980260" -childID 3 -isForBrowser -prefsHandle 2940 -prefMapHandle 2936 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4295dcd0-e4ac-4060-a2c2-6f9f0276ab0e} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 2952 d68458 tab
    3⤵
    PID:1120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.5.6801971\1206881001" -childID 4 -isForBrowser -prefsHandle 3744 -prefMapHandle 3728 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5f905ad-f27b-420b-96b1-9df2014cee89} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 3772 1cf43e58 tab
    3⤵
    PID:2460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.6.1433740461\653514178" -childID 5 -isForBrowser -prefsHandle 3880 -prefMapHandle 3884 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5fa4ec76-64f6-4fb2-8811-422d6fadfd14} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 3868 1e4d3e58 tab
    3⤵
    PID:2512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.7.1700934275\149450011" -childID 6 -isForBrowser -prefsHandle 3964 -prefMapHandle 3960 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aba5e3ad-3137-4327-9a07-654f87c6ab2a} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 4048 1e4d4158 tab
    3⤵
    PID:2636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.8.5151793\1609663372" -childID 7 -isForBrowser -prefsHandle 4524 -prefMapHandle 4448 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a4f801b-a53a-4c34-a2b7-30e4cd494f4a} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 4436 234b6958 tab
    3⤵
    PID:3060

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:3220

C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
"C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
PID:3484
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:1700
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:2644
- C:\Users\Admin\Desktop\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c 258441723810265.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3192
- - C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3280
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:2892
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected] co
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:756
- - C:\Users\Admin\Desktop\TaskData\Tor\taskhsvc.exe
    TaskData\Tor\taskhsvc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3256
- - C:\Users\Admin\Desktop\@[email protected]
    @[email protected] vs
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3436
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      PID:3680
    - - C:\Windows\SysWOW64\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:3936
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        
        PID:3288
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  PID:1960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "oipzgxjd460" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
  2⤵
  PID:1692
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  PID:4028
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  PID:372
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  PID:1108
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  PID:2764
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  PID:2456
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  PID:1792
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  PID:3204
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  PID:4160
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  PID:4468

C:\Users\Admin\Desktop\salinewin.exe
"C:\Users\Admin\Desktop\salinewin.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3492

C:\Users\Admin\Desktop\MEMZ.exe
"C:\Users\Admin\Desktop\MEMZ.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3480
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2816
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1164
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2104
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2276
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:692
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  PID:2528
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2228
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://google.co.ck/search?q=how+2+buy+weed
    3⤵
    PID:2768
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2768 CREDAT:275457 /prefetch:2
      4⤵
      PID:3868
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://motherboard.vice.com/read/watch-this-malware-turn-a-computer-into-a-digital-hellscape
    3⤵
    PID:3404
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3404 CREDAT:275457 /prefetch:2
      4⤵
      PID:1112
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://google.co.ck/search?q=g3t+r3kt
    3⤵
    PID:4060
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4060 CREDAT:275457 /prefetch:2
      4⤵
      PID:2688
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:344
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://google.co.ck/search?q=internet+explorer+is+the+best+browser
    3⤵
    PID:2056
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:2
      4⤵
      PID:1632
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://pcoptimizerpro.com/
    3⤵
    PID:2932
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
      4⤵
      PID:1932
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
    3⤵
    PID:184
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:184 CREDAT:275457 /prefetch:2
      4⤵
      PID:2760
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://google.co.ck/search?q=virus+builder+legit+free+download
    3⤵
    PID:3980
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3980 CREDAT:275457 /prefetch:2
      4⤵
      PID:1936
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://google.co.ck/search?q=virus+builder+legit+free+download
    3⤵
    PID:3328
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3328 CREDAT:275457 /prefetch:2
      4⤵
      PID:1620
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+2016
    3⤵
    PID:3716
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3716 CREDAT:275457 /prefetch:2
      4⤵
      PID:1308
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://google.co.ck/search?q=internet+explorer+is+the+best+browser
    3⤵
    PID:2584
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2584 CREDAT:275457 /prefetch:2
      4⤵
      PID:1360
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\System32\explorer.exe"
    3⤵
    PID:2472
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://google.co.ck/search?q=the+memz+are+real
    3⤵
    PID:1576
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    PID:1540
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://google.co.ck/search?q=minecraft+hax+download+no+virus
    3⤵
    PID:1780
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://google.co.ck/search?q=dank+memz
    3⤵
    PID:4200
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\System32\explorer.exe"
    3⤵
    PID:4296
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://google.co.ck/search?q=dank+memz
    3⤵
    PID:4540

C:\Users\Admin\Desktop\Monoxidex64.exe
"C:\Users\Admin\Desktop\Monoxidex64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- NTFS ADS
PID:3420
- C:\Users\Admin\AppData\Local\Temp\姳刊輚葉硉痗熍矜晻戼嵓鐖鐩辑奌嫪.exe
  "C:\Users\Admin\AppData\Local\Temp\姳刊輚葉硉痗熍矜晻戼嵓鐖鐩辑奌嫪.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2464
- - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:752
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      4⤵
      PID:3164
    - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        5⤵
        
        PID:2564
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2564 CREDAT:275457 /prefetch:2
        6⤵
        
        PID:2940
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\hu.txt
    3⤵
    PID:1968
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\it.txt
    3⤵
    PID:3532
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\ka.txt
    3⤵
    PID:1652
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\kab.txt
    3⤵
    PID:2176
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\lij.txt
    3⤵
    PID:2288
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\ms.txt
    3⤵
    PID:3408
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\ps.txt
    3⤵
    PID:3652
- - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml"
    3⤵
    PID:3556
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      4⤵
      PID:636
    - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        5⤵
        
        PID:3372
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3372 CREDAT:275457 /prefetch:2
        6⤵
        
        PID:1380
- - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml"
    3⤵
    PID:3416
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      4⤵
      PID:3700
    - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        5⤵
        
        PID:2020
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
        6⤵
        
        PID:3724
- - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml"
    3⤵
    PID:2656
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      4⤵
      PID:872
    - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        5⤵
        
        PID:3764
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3764 CREDAT:275457 /prefetch:2
        6⤵
        
        PID:3836
- - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml"
    3⤵
    PID:1248
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      4⤵
      PID:2012
    - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        5⤵
        
        PID:1992
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
        6⤵
        
        PID:3736
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:3720
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm
    3⤵
    PID:2376
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:2
      4⤵
      PID:3848
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Common Files\System\msadc\adcjavas.inc
    3⤵
    PID:3896
- - C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe
    "C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe"
    3⤵
    PID:3204
- - C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe
    "C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe"
    3⤵
    PID:1808
- - C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe"
    3⤵
    PID:2756
- - C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe"
    3⤵
    PID:1152
- - C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe"
    3⤵
    PID:2432
- - C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe"
    3⤵
    PID:4068

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\activity-stream.discovery_stream.json.tmp

Filesize
38KB

MD5
ffba2ba56c0e2682b6ab60b53167eced

SHA1
e4b8ef5e1667d68cd616d1b224fccf99be16cecf

SHA256
ce155c5d0918379817fa6482a6ded26da8645c758ae8377e50507cf0ac63eee3

SHA512
8a25c12746efc8aeb1548fc4c06b1fce174ae887c4ae3da9ac8815f664d63f69dbe8fa28043493f6482f426cd29d34e72c80ec07ae166e4227d309b01a287891

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\doomed\26744

Filesize
14KB

MD5
73a8ff401db4d25a9ad425fb09e7d21b

SHA1
5682395c51bd533239fd9ab4240e87f1b7687a24

SHA256
e34714b9ece4131ab35d9a2154eb2460f1b90a486837b6a101fcfb5c7d409449

SHA512
08047f2ee1c0ea9b77ffe2ad396cb0320aae599c4fdf3a9bcf8d83c7a5de0d4eb68b05adcf374668868d476f63404332666e4b69a65148abb3a1db2f0a70326d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\087F96B189611952C6B30E20692EACCCD08B35EE

Filesize
96KB

MD5
129bf5ef3b34409278105b7dcdc38db6

SHA1
611e3ec3f5f7d7307f74971da403f449e94cf826

SHA256
b0a9f48ee62ed6867d3a3813a97eecd272b0e591de2d75457f88b3e44d19d530

SHA512
c43fd1b31f8632e1c170111629fb413690afa85764bd1f251aaf5c87ef757a49df63a22ef0ac925cc59afa5d3678608accec1d056d2bc2e2268887c5e2f292c5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\0A14640657965B8513D3F26C8B0E6802EF353192

Filesize
32KB

MD5
06e4f006ce5c5ed5b5ab828a3b11a82e

SHA1
18b07e2b77ddc2f377cd23b726a72ad61444b3d4

SHA256
f147e484e63022079eb2acd4dfa067050b2faf3434adca08383354511bf5c2e2

SHA512
9d51bacb7e43a03ac9f3fbf1352ae9c46f1877f3e82d805e8e24ec7284105f74d7c9e3f52c9294072bedcb2aafe9798daaabf3b1c82b33e2f3e6b7b2ff5a4b5a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\0D2FCEF5530165A1D25C0E404458F2BAC00BAA9A

Filesize
18KB

MD5
7b7899872d94315ca64dd97dbab7c19e

SHA1
9c7e04e24a697801f9f97799db44222e4c95d551

SHA256
9ce00ce20a56d744b81568be8f90b09e021efc9cacf4a32c7f0c0d6a0d40f1bd

SHA512
118c4b0cb6c9e5704042cc75861cce77e7f9fd7d04cb8b0b6bd4b26acec3985c08baef724d74abff8f1814ccb9bec437f41cc9625b8442b6cce60c0dac93bb2b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\0FC0D2E39B11CB3765F534386C8F9B92E09CA1E1

Filesize
66KB

MD5
0ca9de1b332e96655aa4e3f4005d0dfb

SHA1
b96d17a24f077420976f6636cd2942573b3c4384

SHA256
e80fc03087e53b813db29e0c62a8bd031637097a8c31b1fb0e1df518b7633416

SHA512
1375c195c5076ce6c6bdcfe195da834b3fd389286366535c346a1b7d58c5b1d733ead57f2aedf21fbc2348653d52538e2e9b96e97c6c737a2e8afe30bf0ebf0f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\166C7CD42D77DCA59102CACBFA6286C8B1656A3C

Filesize
19KB

MD5
0c5df72cb53e6a389ad664ad6fef2d6d

SHA1
2e958260af3e4433540ed88b655bf4b3ec74c7a4

SHA256
13ed20188e69116470b49abd7535f3435953716600f5b32a1edc1802e542c1f6

SHA512
5233aadf8a3b545860eb575c5848021f7efa710faf16767cf1da7bdb86737d71a742756f9c19f20eaa643b2384177c54d26358ded1f2e77c8c3947d2d60c6f85

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\16D3E6A057A124E8E3BC96689FCEB5904949EBB5

Filesize
45KB

MD5
689d4fb8f225f46d0321bf201f88fb15

SHA1
2164e80651ed38219c858e6de05cbbbb7065e1c2

SHA256
592b3213dc280132dcbaacb18154289b5e1a776b32be2d97a3c932e1ba59da61

SHA512
d5cd24588ae00246b94be1d64dd348c292fd449cd354c6b5817b9da165f1e0dc320fa3403c97f4c530b9508a1480cbcb64688263115def4532eb4b252ad7335d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\2492994A253B970917AF5CDF605580B1C2DC16A0

Filesize
63KB

MD5
d5b764d453496ac2eb894d4ffa71357a

SHA1
899eb8f30b201f04b79b8300bbf30a13c71fc397

SHA256
a0fe72a0af76e64ce9b32c2cc818c87a6aad15baf5cb3176071082933f77a88b

SHA512
275f80eaebfa3e0ad60fc79fb717467494955d3e81af9d54ebfaf3fd79cf9d6599853d6206f0870c58014b557af3cbbe8ca9428ffc51fd73c3c57a2b514c7f58

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\2842554DB98F3F407860E172D9087A5CCA96CB21

Filesize
32KB

MD5
012a872f4fa8c1a383702ee253ffbefd

SHA1
6b4d913eb78d0faf2660b3f54a577b85d45452fd

SHA256
a5a49964796169dcea8ce2503477eaeda926c262d8f5254423c2919a73bb3758

SHA512
865ccdb527e09e319e19511c75fe3f98ee213ea48db7f2505fbf5fe161db5ed6048dc42c807950f012ed67d825e515af587a34fe8d3ab14d5824804cc46f29ea

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\30AC9E9C28EC1FE2B05598F46EBAED7EC52CEEF8

Filesize
18KB

MD5
3aeff2373a8fc4cf39dfafca772bc010

SHA1
b8b83f05065ded63e91962fdcc783dbab6774dd5

SHA256
88aecb411d020e8f5537acac90938859ddf49a949c27a198e1757c4767b0560a

SHA512
b87b7bafbace2805c531cbf869d7a7911f82265893ad782a3e7474cd4ae8a1b4207f87674ad1f39589c5c66390917330e0926b169408aa9c9c2ead2acf733336

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\33366673A001DAE58C4FA732FD14D01603D29259

Filesize
72KB

MD5
0f5d6f489cafd41b237c5d89f9648eff

SHA1
0b43d406324c7cda1210c140f553863c20b5fb61

SHA256
54951dc739942c181f7ceacba2fd33b5bb83a656e7617f9a79f39aee52aec04e

SHA512
214d0bb15f3367663aaa1ca26ee5cf34c438f3f69b0cf02af5cf423325d7a22c6f930f56484f009a346ee10dca363f5adc1def5de607e04989ea918a6a2ca4bf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\333F6657EB02E4E81EF932E9611E5C1AFEA06660

Filesize
187KB

MD5
368b95c895a70895eab257be59033d89

SHA1
e45be8bd95cfd34b296bb3e12e553d1181c46821

SHA256
bc321c3e4d6ccf9b0331d6eef872440133676f95a4835a40c0a1e3d6c0be05a4

SHA512
8c0375f0fd82df8501ec1ace1b8a0cdb5cc8f0335b0114f43a5aa2d8c0b7f0ad921b90c24a8dde39fed67b0b9ff1f627ce1b96803aec46b99288a7d5c9472a59

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\3499E0CDB4968FF402067428EA75B46BFF8FE5DE

Filesize
80KB

MD5
8e8e7af54c0067a2e6c4dd2a6d953fb8

SHA1
e9999306fda5526bca413bde430b9c480fd87e77

SHA256
29164dd94925bf92c5ee8f20991c1128550e28ae8e109532fc116f8817bb1496

SHA512
0985b439121b9cfb81fffcd2dc1b08f1efb8abee3febf940087c4932874b9c1794140c19ee8b56e322076d911d5ce43941baa93b6f4ea2c681d4e75d7d9f1832

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\3AD23E86A3343C363347EEA965A69627350C7329

Filesize
258KB

MD5
c05883c5f802c89058b41d5243a82c46

SHA1
e8710aa1f5b813622e0b21dca3326e18f70abc60

SHA256
c44ff4f193046490322a87e2a3b4b62be24f8e7a311e8bb73d1d53a63c4d1ca3

SHA512
e90f3470f787f3b5bd8bc8fd25996495ba3d54f4dc8c0be2f69884f18d093b4083e6fc0ce541a6dc0e7d8da2c7b571c0edf01652e429dc1e4c734770ad96684b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\3C2A744CFAE6CA56F7BFF7905B0136F689288CEF

Filesize
59KB

MD5
3773e969d8cef9131c2af5da5d722126

SHA1
523fde7b2266dda586bb4063b28f916d3e8c26b3

SHA256
6e78bde8706688966522d4a3ce26af5650e98c43be946fafbcdced30f9b1400a

SHA512
727a949685595acc6f62604268003c13527bc0e8736821ef585306ffdd5730f6bf24fb2a76ed476b0b14c94337abd9d3a24f8a5af270d9306ddfede257fa0dfd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\3DDA16BC6DDABAD758EAAD1BB9028434BF62D323

Filesize
53KB

MD5
b67e51a00771d51ffc0395d8cf3b72c2

SHA1
9716b0b7d3ce6e2a5dcd53db8f6bfc5c6ed2bb44

SHA256
20da76bf8ab32b7ca704dbfe8c44432d24214865d79ebe3aebbd2c5b8f338135

SHA512
651969debde747d521dd83847b940273b0625148f1a0dbe50685a8f0afd2e073901bba2769dd17a6fc6974f8fb342180e37342e49a1f89833027baf3ac3c7b01

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\4263B1A2D70C7C417487FECC88693B6E7E40E2B7

Filesize
64KB

MD5
c8adfe17c2dc8c1821574315042552ad

SHA1
724f64829434de4960bfbae51488c0c7dde3647a

SHA256
fae4d0d87c84e276b200247d87eb5a5371d79b847a2fbcea78743bc22137d641

SHA512
25021d3f89c5f0c8b61a66adc5666abd5e40f754b340e137604f22e869f9db2ff5f3889e62eb20e0f61b7d02f678253624446df6083709f1a8c55852ae7c24b2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\4581E80964B1526EA2613707C014EA4C804C59E7

Filesize
57KB

MD5
1411fdd309971d8c3af34f42134ec445

SHA1
60bbe76d1c9c7a7dc151c77833f6853a7dff2fb5

SHA256
5e4f5c94ca66265ac444f418eafa3ca42c7ade659fc69d2251370cee94baf865

SHA512
b3883751d02abbe4c5463ba602ba9b6f522bc46675904e8f57b64c76c03414adffff88795599d289cd7dc6fcbce0c5c2b813c1a65224213f7479fd3125da17ca

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\49AF65C60E9467DC868F8EFFBC6F0E1FE2D6093D

Filesize
52KB

MD5
71a13af3599300623c1b85474893fecb

SHA1
9f4bcb51d9891b26beaa3291810c8c6e73e83ddd

SHA256
76a65f3992fd86f93c76f1b14726f25875612bfc874016d0e108327d7ce3c315

SHA512
b14104ce2431eeaf095d4bb1b78f2dd3dee884c51563e512248a93d7e871951071c8a4bf046cdca34e21c1786d433af90ea8bce7cb3e087c85658f35a76f8279

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\4BCF7D608B2663D7D1515223C0F13E5D72484770

Filesize
14KB

MD5
ff9b7c7c4a455813231eab3a1e4b186d

SHA1
d2e1f1dd029063c4248fb6ecba215e6f3be18f9f

SHA256
410388f9866bd26067a9ac46404ea95d8c0dfbbfc4e2a55388c5669da1d27eb4

SHA512
e48dff351de1dd73819fd9bba87816d845656f19bf038a8251a84eee1b3627d2cdd215882503f9899e5522cf0740a5e29bba59cd6723d518c07c64e098a01292

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\4CA2E679CEC293F142684E37B6B4D5F01FB00E81

Filesize
68KB

MD5
089410e8aabb28c1aeefc334c1f9c829

SHA1
9509ad04f2095722a94a8d1717c60688244de8d3

SHA256
00491a1edfad1e3644582a35da4834b6d7ce7a203eede2588c45890d1d175560

SHA512
bc7c8abbdc7eb45f1449a0ebc8c7ac1d8a0b9b8017c84975f3d0c33ece640189e00d3d1a8e231b918d0bf81364a98676b048238528236d5ab5c5be7a23906618

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\5525EE441B366A3C02F463D77DE1E3C20C75154F

Filesize
33KB

MD5
1b9a9798cd29d9308284160604fafe5d

SHA1
ccaf562b37fae86d5098648327da94052609c20e

SHA256
dd646286e14fbead9da99b906aee2c2eb3f15431217d5c10c63145fda4cead91

SHA512
e9ea47e7f1db4528a32c5ea1932b31ca6719af9f74af510de962f69f45d32d357673d6ff019eb7679950a3fcd30f4acba0d5cb2ab39ea1461e29cd35bdd8f827

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\569310489AA355180F229B54E68092E3E2C0B048

Filesize
76KB

MD5
a1ce254e9f0c47732d1be56908141147

SHA1
e3a2efe73d327c85311e28e9d01f6a19d14e09e2

SHA256
69d532df794b134a6b8e358daa7aef69a7c5fdd46be58fdbff1638563b0e7bab

SHA512
5949e29d0f8605497912b95bedd9c881e1f07bbcc45ade65bc31487e30a66ef7473364c7316dd0a5ec86e7624cbacc429c03bd1f2f507716deb98999a2382e15

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\594A37D74B576C00BDD5DE5CEE5353E7EAD1DCC1

Filesize
15KB

MD5
c928d33d74197e4debf63c9404129a7c

SHA1
639461d841290613c57fc44eee0d2c7d9b41edfb

SHA256
82286d6aaf6a554a0531011cf8e3bc02f1d705a6440daeb79d2cc9f10179de81

SHA512
1812c8c8f10564a02a24acd8c1de56ec96dff1713d1142c53fd441f09e818cce5525b82b8c8455ee6d40be82783c6cff1658cabb5b0386b51d23e1d76b88d01d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\618D9AB1809CC9B5842D1F113F88DFAE9C6C3098

Filesize
45KB

MD5
7a061331ff51204978f77df9584a1f45

SHA1
a02661635a68bab1b4d5317ecab37f25688ee7dc

SHA256
f616d8d1479f4cab7c051f42fc296f8174691fe1aff68ae217c5a7e171c14376

SHA512
0cab62050d0870c4fa3b00f4a0f106b9d358e34b8e6e80eb9f152ec698c19652537b110ee6b0aac3f2ac71480351f3c8100a19cf60809246fddd08a3fd5f4282

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\6B4DB52338644A6A772A175E61E5FE1628EBC513

Filesize
67KB

MD5
341d2e1bd10bded49976b860cc7872ae

SHA1
d33e7a2d49c01badc37596b275ea92cbe6239c89

SHA256
3bf7d950e38ec32176b496637af14f6048b1e0bf2daf3e8dd18a0a9be7007aa0

SHA512
86d98be59bd11e94e4c1555fa70db0919e725567d928a93159b130ec53b992373e6f3ffecf56c84fac657d02d80fc7e2d7375b34d41e0c2e4d9abaa4211d7d9f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\78F46BFEACF3898E8940DFE6C8421DE8908450EE

Filesize
45KB

MD5
f4824ad973df69ffca8c8bb0f917489d

SHA1
a99d81d06044f9c571bebec70042c93411951fc1

SHA256
adc4f658770891646dd6e51e4331ddbae80c80d7cd8e593a575bf26b11370d9d

SHA512
c7ed05ee49229336c12f7a5a711fc13d69c56e43565c0eed6f8539c5f3b5ccbf77467a6685b96a13537763aff344283c74391dfb9830c29a529fbca424a0ecfc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\79AA3703A952AF8FF4E8A6BB1DA7C486DDD36E48

Filesize
19KB

MD5
2a4081c87c40ad23813c1a72b39a0206

SHA1
591efaf210ea33f5efe922ef287449d0b741e9d4

SHA256
d712e0ba90e5f119a68574e3d87b50d0ee41b58e41d0f106db8d66a318abd175

SHA512
60f100a769536b5a7f6748c7e7401d8da651d08bc72802e14e8e1d524724cf3f99e3643464b10d0167c75af7de11aec1d4d33d9782740e0f2f7ceb30fe6b9121

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\7A55D2D1E17B7F574CA16E74F1211A1491FE9B3A

Filesize
94KB

MD5
ccce8267809327c234b64efc60405c93

SHA1
7756f3132df875c1d7284baf0dac929f669bb590

SHA256
7d5af3e063612bd8dca216c5f5dc5c86214784e37d49b5f4bc60df8689a33ff5

SHA512
991e7456b0732f02cf63638384ca4e95c830e0f04065c91a7874399c786ef001645db29fb052fc92f410ee0caeb7d577b385867a9798f343a3dc80ef7c6a42c7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\7FD2E447348A399199F0E593753118D660C52C19

Filesize
15KB

MD5
ac93bd84c257997c8f6f04c02751e6ee

SHA1
c72f17a573d783f0bd799b0bf4e145dda2342274

SHA256
d2970b48505777eee8148efda285c5431c6366fd991e4dcbaa90aa9890a86710

SHA512
74884014af596d879d1360dd90bb1c1f9da8ea3c6a9efcd70905e29dade648a4ebe222c8776de98e2058924ba9f48af4a5f663dbee60a32415d4b7e0624210f5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\821B77C1CC752EB45B4B98EB8D30FE39A14BD939

Filesize
42KB

MD5
0ebf8da539bd5a3674d6d59125d935de

SHA1
27fb1177a431dc87e4bf9c6f7af53d7edec4b2b0

SHA256
9cb0e0ace54c80e01983af883c76b00be9bec07df49f338058d9cd12badb5856

SHA512
967b09c1272a30a42e39588b6cbe1e0e258be95fabbefe98d41615bb6f627fc082d1d5508f1de8051d3515304d26a3396af557b56afbdd9582d86af05ed91cf5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\8454EFF624D79A4CC127E4294128135A83B7DE26

Filesize
523KB

MD5
74922005babdeac9a3c5ae0b0e8a19d4

SHA1
e1b0e3ab1d7e1ca806e47a137d90e70b9af45feb

SHA256
1bb5aea8ae8ea78a65aea8000e1fb03d4c63a499d577561897cbd622d1d4ff7e

SHA512
0c2cbf92f6c3571b9d13f8fe825b8c7800484f645226ad994404d84d42660cc87727ba1ea64ea784f67b3636b0579f1edd1902e54520e0fd54a213b10dfc5759

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\9695EF6C5E0CE18BF6742C5C0EE08F02BAE83E2C

Filesize
68KB

MD5
e261a7aa46a9868719889bd56ea700c9

SHA1
e2a0f8972145eb57304bf21767be6d23e535ae18

SHA256
5b93e27ead07fb0e6cfea84a421906b66f38c94b02217754f488ae39db579028

SHA512
2895cc9eb2c77147a6fd9791cbf9b3c6408ca9036068e5e36600410a19a1c93574e4e652ad8fa65b517bb0ad512d80e7042fbe2eb8c865918ab49c22e7ea75f7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\98D70A04175F12872A9CDC60C5E95AF55040F134

Filesize
71KB

MD5
4bc481706706955164e60c432b7dd8b0

SHA1
e4a72c1303c42bd4819c85553158fef594565613

SHA256
cdf3af4efcce601f1ed68e310c61bf5cf2a322adf8b1c9bc8d64c8cbbad2adbe

SHA512
b253595efb765805be8206072531780642a1d85c9a3d245a04432f3d2c8c018607ac982fd7a9fb2a1c07dcac66d8dc1548fbf404168089ae34d8364a223ab45e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\9A163BD740F6979C863FCC91748292FC05AE55AA

Filesize
43KB

MD5
8d6060efb17294f87a2b551524139b2a

SHA1
e9063d1b94a949aee990eae25d24d71eafe481e9

SHA256
edfab1cabaf4a162a030d3fd346d14f8828dbd0f49056a1e11efb801e7c2b786

SHA512
7849e37acbb7f14441960c09c532fa5e198f4ca41be9392b373793e75b2c3963fcc47d5d8576d75cf3941e7623d5b65d89320a927bc1449f3a90270bf68a2deb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\9A4AA513BF56A7AB641F6E9EB6E3B4567F7DEF5D

Filesize
16KB

MD5
b597e2522da63b0c5974eb2cbcdcf9fe

SHA1
b0fc720b59bc0261fb94895b1642378295a90209

SHA256
7ba55f7e74a4b120983e0cdbe1c05a03f4129d3d297bf237a5207866ecbd6025

SHA512
efe61717b575cd95248139f68670a8432757b8fa62473c5b02c0ccb3d21858a373514f2f61a28a0abe5d1f817c5afa81ad91e2779542754e2f7ac3ca80323849

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\9D8812F6A558D1927D5A858D18A6FEBD8A1B6869

Filesize
46KB

MD5
c8dd8e14e75692947e7733c042f6adce

SHA1
5189e857591f2bdc538a6cdfac576bb686efe1d1

SHA256
f5db5518696f30725bd7ec116681085ba6c41ee1bf5cc7f68cdad540d5f846fd

SHA512
03d15e5968440f82db0e1f9bd014e83d3d4c89cf33960730d145213d6011734e5e9237b9f5684f4e090ea26dde4e14a2a8bf38ce2ac0031b0d2b3a1ec94550f2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\A6C74BC2260EAFF823C7AED38BBA607C962CCB55

Filesize
39KB

MD5
da86e5728e5a32e5a8ca7574b98bb8ff

SHA1
d7a8150e4499173337c755e2edfb732dc4ac9519

SHA256
8ca7aedbf2c55282a264779c6a233d80add0305c21c64da00dfbcf10eb0ac801

SHA512
d093e05ae826f9197a0aaf3ab1b023847bf6d883678875412f0b64cb0f0ae97f1fa5e173d14a356e7b10e20c4f7de4eeb45912651ba962dc825cc7e3d0523661

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\B4F692A321DFB9D3604DE8BE72864C7F0AF5BC36

Filesize
94KB

MD5
88e4f79514788e4c349fe86d9e286a9a

SHA1
a18464c48056913e66120ad38c44f58ad9333634

SHA256
40b670e2b05a42bf994cf6ed39282e3dbff019833756c74fe926229a042a0c60

SHA512
b316820c9a970186bfd67c15790d9b155ed44557694350e622cc6ca52b1014a6ff4974806154e6331bd3e11045c08a17ee4298518fa7c96fe8864809e3df5ca2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\B5F57F18B38F075423434044438291B3FD84AA31

Filesize
54KB

MD5
b8b8bc10553a6cefbd3c6729b9296827

SHA1
7876be39fb62d67f9dc0d4b12b186377f5dba41b

SHA256
01f874f568d117534ac31809ea6a811ad4f45782a44a3207e8239c9ca3ba183b

SHA512
5c154b81e3a03255e9d8c2978f5037bbb45562e30e05f68204a1c00a27fe64c4513e2843b19fde869f7c760fcb502921691896e534338ad775819c46a636736c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\B79C3BEEB139436E6C4884D0258797D7B385B05D

Filesize
23KB

MD5
9ddfab2cefcffaba7ab7b51be01c8c42

SHA1
7431f22ee3344125761ffd5db4b76440c86bd31a

SHA256
52446764bc1e9865ff61e0a1bd2f83c5de97084ffd3e53522f0aef004efcd9fa

SHA512
f6f7a8ac80ce74cda5f443db8fd21bb0897a9f0e2b8222de2961d95d4388cd6ec1ad8ef2028eb7de83aadeb6041bff4efed613655916b9bef697c8ec85bbae8f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\BBD71EB7C6FFDB728EA9C264F063F7938A56C418

Filesize
48KB

MD5
5c0e0f679ff9f40e57c92ffb1d81d63d

SHA1
c753053cbca9f7a33f861b24c37235a92d365715

SHA256
8a3aa5c508884938e6a7980dc099f9d0c2a6d2b6e6e46caacabca6e22f55055d

SHA512
9dd1a9822dbed2e5b8101ef6e8bd2ab43e01b8f1977c7383823d540ace85e1faa747eb0ccbf6bc194e16de39621545cbe8872c094e33554b361967f778916d9e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\BF0923D6C9AC3F4148AB74C98E937ACD57DCEAD3

Filesize
50KB

MD5
367faec784f6dc89f3c3f62ca92bef57

SHA1
616fb82f17182211f8698e4bc7b246c8af90cc56

SHA256
292a2d68c2ac4c98d8f24d3f0da39147b1b7f05e1d12c08926ed2b966a29b133

SHA512
0efe1e068a40fd1485e834cadc05631a4dc33093b69516c6878bec76ce65302df60154dbd1dc6a9009cc0b72572029979ad75c3652971fe482bbd364609684f9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\BF33B2172A45F162117FDB9EE56832A88383312C

Filesize
17KB

MD5
62e3170636602316d6ae0a5e95fcf44d

SHA1
0ad2e1ea61b6fb3607c97c0ddc77649c00a6dfbb

SHA256
c5713dc6299be81d1390f581b1b4a6e9356bbb3b4dd8218903f2286ff35ae51a

SHA512
061c777f1ce05499dbae65c1c9bcf1e4fa26ac2aff8d1bd8b2249c8cbe2108d96e54d4e5adc3f16b3bbd01a5752a05464d4d8ad69a4e18d756245c6435607215

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\C7F3BDB645B2CB752401A31681C973E76B91554F

Filesize
60KB

MD5
863824aa7beef88dc90f81152db0d477

SHA1
418f8f596de1bbc1cce43695ab3167b3a950821a

SHA256
7f07c274547425c4f8b3ff556447dc9f1e831cae977253603434bb155f478e3c

SHA512
a53b934345bfc4458e0c5304b827792e585c8de5cdd01bcaa96984a66fe2b85b5757f58f473f55e12900a059cd250bb88eb39b3faf018436e8be41f590dfad7c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\C88FE6FE8ED0018995E76FB6B4CAEB37655B5835

Filesize
147KB

MD5
4e1339e43b80b546e97ce2d1a2a7f156

SHA1
96aecbbe21cc5db198f027ebd9579650a6cdef56

SHA256
ae489b49d11e93e5114a16595690847c675cec1194aef2bba931224f6cb1e48b

SHA512
8dca730b52d93952c0fb6ca0db12d4865dc2982d47f03c2e56f653d186711aa3dc8fb4fb89c0e7e13591441e1d4421597c721f5cc44abe76072f45c77c033935

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\D207CA89781848E7ECA4C658F22D4AEF1B168DD3

Filesize
209KB

MD5
1d53ebada1fc998490e1577ff4b7bb20

SHA1
c7c527e14e76e64dd0b103b84e977d02957b26bb

SHA256
0698ead136e20801de458bdfdf1eba3f44e7a743aa8c558ab0e1fed051c354ba

SHA512
6ec3cef6efa2ef531e137fbad18d7bdb5c23729b2e5ac45064a5d63d2de9abeecf157fe9ca6f95d86cdd251bd794b2e6159eed6487baf232d6ee345e3cd5bcf5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\E46AC26CE1CFDEAC46577B910A1E38F95ABD3ADF

Filesize
45KB

MD5
7736213901fd7f1fa716f53035b5d46e

SHA1
af665f0e462de876a5f107b894cd336cf6f5d675

SHA256
7fdfcd5d81a17d300052fc9f0589b191c4d985ceb426e8679fb3170165f1ba46

SHA512
d4e2db624554f3a76a751981dbbad567d58c7ae16cc442daaa3250fe76e1cad4ba16e636e49e2a89dd33e25ac1fc3aa3c5cfeea5c1d1c18b65e78a6cf6b13e7b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\E69BC5C9882C0F17590B0275ECC3087FCBA6C549

Filesize
58KB

MD5
f75cd896088b1dce559646dc1fd82342

SHA1
dbd9289769c877c0a0734fe1a43f3559eef074e0

SHA256
0ef7642a0645e13012c00b6ff961b88bf5c3cd3e1897e06844eec9281fc06f0e

SHA512
7b89ed3f9e53d89c0cc06b681e7cf70b3a87afdfeba1e064d6623e3de84ad9c39cc31100a8ba74411b5c0cbb1d0cf875ce03358c517c1df5b28f3f9cd436fb64

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\E6C22A3DFCD18E3C6145370266896FF76AE3F7EC

Filesize
14KB

MD5
8de58f209c4d6da81fc66b593bdfe03c

SHA1
3665cf93c601df56a39d6131ee452cb4d9981ed8

SHA256
33dfaf0a50f8cb1fb99b69a19b3bda847f79ef0e996b84674d6d222b1195ec30

SHA512
eba4fb26f7c0008a31ef6e28c0842224399830d6f4990eaaa9867ed6808da1eb2532ad60612f4afa6b668610b51b7bdbd768ddb9e317f76b1ddcda1bca927a70

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\EB7DD385477F8D3CCDE2B439033C907AA695EA66

Filesize
32KB

MD5
40b1072eca0ab05a7d1f0c35d33e8efb

SHA1
68ea3a9d17ca60087a65e803a73fcf82a05db931

SHA256
db54fdb3eaef55b48b4c101be5db26cd62cc22482aa36313e474ecb8992143ec

SHA512
550504629d746f60e678104f179e28e8335d5431b3590a2fbc7b0daa3a47deb5e271febd7b002fa1b34c1710c496c551984caae34850e832d8ae03b5954ae46c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\ECE281212C7D34C2D33214DAB8505B450499A76C

Filesize
38KB

MD5
8dc9d76ad749a3fdc20fe488c87d466f

SHA1
fbc9d6d86928e841dfd74335038f51ccfb67a1f1

SHA256
5cce2bc84fd69abcf3dc9d1d8a21a62101d7d75692f117ea95fa8ce6ffb30b75

SHA512
a57e2acc4068292553de95aef9461057604abc9ac86b2abdef2a2a66e8753c2707d175ed546586e040d63a4fc2dbe6571de630f3b089207c60a5fb91da202d4d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\F5A1FBDEF4E6F115791D6C8EF1598942067B8080

Filesize
62KB

MD5
1d3c2f76361a470edbf59acbf41efbaf

SHA1
967b09219f77466a8dfd9b89231f2c61c121a1e3

SHA256
468ed044a1ac101e72ee9dacbd6afb544fbd11db9a7ce2382e4c11727b09702a

SHA512
8f3592d0686adb55c528aaaab4cadb99e24034521ca02c12bfc1ea970ccce1f823d1df7abb73a283263e3fa5369ea6bf5998c85fe2468e8664b802e8ee29af9e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\F8E551FE6EF3E6467F170041C4FF2EFDFD32BFF4

Filesize
70KB

MD5
f2b8fd9bd724310c707c0cd2c86a4465

SHA1
f1186ddcc66edb6060629dcc00f4b5c5fcbbc954

SHA256
77f393a8d8725b8b9ca160c28a4bcff7be5c481840ca57c65e71c9a02882e956

SHA512
7b0ba0a000dd51303bee54c8645a7ecf4344114fd9eda0066252166277a165a3be26ef88cecaa1570cc30a7d479bf33fe3605046053ea4fcca1e71163d73a345

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\FBE15710F23A8E7EF7FD3D6A4385AFF0D22B7450

Filesize
15KB

MD5
1b5546772398e311d8ef12a5f78fc12d

SHA1
0f43e29760cc3be705bed76a6bddfa19f39dd79f

SHA256
1e087b1d002132bbd2c319e631f7c1512c48df1e95415526548ac36862b05e8f

SHA512
f9452b1c0065f17f347d0ffa615334c8e65fe945ed7317b2c1758e6d0152fd0867690823a502082f66b4a0559230fba05805b2e10c206248378750fe6ec38c8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\姳刊輚葉硉痗熍矜晻戼嵓鐖鐩辑奌嫪.txt

Filesize
260B

MD5
07c10d04c00ac1c64a2a5efc6aad64dd

SHA1
3f3058ea2ebfb62751899b212ecaed297e41fffe

SHA256
691082e4666fe1a1d5a9762cc18804991e4eb6b59b685506da98269e34462ef0

SHA512
e4257e1ea30b1c8c3d1a12f2b5cc7f4c6879f860389c12ced71c6271299244104e9f34f18b692d7ca3669349ec6603ac9e45d71719697b865812afd089bb1f42

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms~RFf795457.TMP

Filesize
1KB

MD5
3dc5c979b9719637e9d6a53ecc070438

SHA1
6bdcdd6a6f15410c9bdd02bca228c58eb921598c

SHA256
8f21ca84ee54925834e339707d815ff45dc3e9cd6074e1cf0af5ae8baf3e4d23

SHA512
b7e9beda7c63e414a4693c5f90d784c01fe604f54eda060337f066cafa967bc51dc9e2407bb1574bfbbe0710291ab826b231ff29c6b670d1572864c762de4779

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\AlternateServices.txt

Filesize
465B

MD5
21c976da37f18c4f8af8f6b7bb8421ed

SHA1
a453bff578bbd57a63c47cb6c256fbcdf309422b

SHA256
d16183b2a00dbe47ae41486338426aaff4dcb18271d58ea29672c498570a55d1

SHA512
26322d1f420497265a1687c1c52ac88b4a64bb2e7c29ad063611e5a6e4935af7d189e93cf76cdccaaae67f10293357fd121ba1c4d8e360892bd90a8a4fe2b80b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\SiteSecurityServiceState.txt

Filesize
603B

MD5
bec21ca8206b8ddea5b19122481b1b50

SHA1
62647ccf9feaa8356d71da649ad23339460734b3

SHA256
61557fe18c90d960a316dd80b9bce3b190cd3ff440320c0ab3d680a31ad8f712

SHA512
d2519a41d688327cc583d418f054acadf4c0785a6cbf6ab4f979c386f17aafa2faa703fb77187f7e270cf2a2d29505b23b761f8ad2790a17bb8a00d346ad83d9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\cert9.db

Filesize
224KB

MD5
edd036eb846c55238c945d08a1944678

SHA1
afcb68eaea408c50c3046d21988e2406c643a9d9

SHA256
fb48930ad27e9a8a9fbd79beb299768e614762a907bd3f16f7e7ab63af009ee8

SHA512
d127ab42d9f117281bbedde9e920ff5f2e824380bc0699e8a9b3465d84953531e2bbf614209253e28ad4172455b69b2031fdd90d24b3b3d1c69e446dee7c9151

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
50ebcc68387ea9869c462e74997ca42e

SHA1
c39e37b0074ffa38858be5887c6561faaa53521a

SHA256
70b95984bc4f9a8264a61d1b6d08815bee4462dc187694c04a86727184ddc0a3

SHA512
e2c7f924d42cb5d77db826e06f1007443699137f3e21cd1470bc788d9decbfaf4717b5d20d535988a3c39949a923e7dd100d71410f03908208e2e06b797255d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\datareporting\glean\pending_pings\0bea97d7-fd8b-46e8-b76b-5c803d3fb08b

Filesize
11KB

MD5
252f410c11fbddfff815c56441eba417

SHA1
cf719c9f13284c2f4aa07ca319544f407d093535

SHA256
1fa0b991688c798ac0de237c8b08a284418d77a505ec77b45fdcb05da4f0a0bf

SHA512
12e5409b8ecde20258c4af3a1d481583e6ce3a45004f59836b91196d1b03cac73d36d4a3ebfff87ec13320a7c192588eb96677e05bb04a9ceafca7cb89a5e7b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\datareporting\glean\pending_pings\cdb652ff-3b03-4c13-a9e3-79cb3c98998c

Filesize
745B

MD5
75f4f447d2c322f4a5f3fdae412520bf

SHA1
26eb1d382057bf30b54033b2f78d26a97331fb91

SHA256
77dfb3bc96394bd00aaf520e595d97502cf5345312ad913765b4629f90eec6b5

SHA512
81009488627b3fcb1b8e1c6df6a487f612bd57e5585545e06d985c2b7f5128fca5e419b55dae4398c2fd3559fd4cb8dc78245f794b7f3099805c7b65ecec9f1c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs-1.js

Filesize
6KB

MD5
a3fb0fb3cd1d9c3b812fb19a1432917c

SHA1
76b570b39bb8fd625506649cb486b54e637b4321

SHA256
39050b91a9019d645948ec78328b995520e7a02eb2264dc20304652fe2412121

SHA512
6b0fdfbd61d5db0850d61996131d53cbe217730c4877934628e010e52c53c904fe0565cac150a2eadbc453b568db198d138110ae1a47fcc5ae30a046544a8f03

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs-1.js

Filesize
6KB

MD5
d85278d0d537f45ccc55d0d22a18ee20

SHA1
16a8e6003b3d987815d866e6884944f5b99c3567

SHA256
d2ebacb5e3ca9bae2db9e501e2d84da24e55e0b3b901d3590f27b7cbce070493

SHA512
ad4b1966cc0f0ef28329366d2d423335444271a0d574a0cfbb1c5f3aee75d5b94adb1565e1028f68063eeb48e2872c12d5339911c010e023ae2b01f3dd6c4ba9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs-1.js

Filesize
6KB

MD5
0a65d32680bc6501b12905c2b52d7544

SHA1
041eb3ae79c6816c5d536ce1ec6f8e51b6c1f7fb

SHA256
86a14c1301977cac25e7abd66a22b40adad45fbfc04faaac5f517ce276e15b09

SHA512
2e589090db3a844e76e7d13ee622d92a6b2706428511fefccc9d886c248ca977b2728d166062bd6bafe0db92f33eb8e6bc3905f4506a4d18c66fd37885c8dabd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs.js

Filesize
6KB

MD5
9406a4570c083256fbd7ed228a289e3d

SHA1
c63d79be178eadded623bd6f7e9d3d191a3cf9ed

SHA256
9da649a09b1af69d5983fde2ba5c95badfcc2620360b7d1f52f650c0a9773fe9

SHA512
bdee89ae27a8247f59ba02ccbf0193267b159461ca1aa37e704565ff696b0148725d6af5afe020258e0abe2e0b0559822de8a2df45a7cb42f05042ad79ea750d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
6637b299d2eb766b67789e4083e18216

SHA1
eab3ec8ece8acc8b2752dd95fd412ba757d89dc0

SHA256
f3c83d568fbabc1609336a5887ccc47b384c8e38a454e05166653e67d638982d

SHA512
27a7f26798eea6fd476e0e2b0103341f1a9434ba1b5b90f816337e90b571f70be0e5c7e929075abeeeed6ace7504e50a8202a04ed4264ec67b534f47c22d19c5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
6174dfa113ef022536ce9b24f5bc8ab6

SHA1
8d039fcb78c807ff3b303139714b86ef758ae697

SHA256
51a9d3e365e80d2cd57b7896afc6ca0b5d60500a646bbef1686f79e53f622b54

SHA512
4acf018fda708bad4f1f8513f9eba8f44a841d8a1201500691fc4d0a0f5526dc02aaad4dc67df706935205b9ce0ec5b62435fa7d2ef4f2f1627d3d3b574c2fa1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
b231a09be0c80e3c53f859dfa6010dc2

SHA1
a51d149a7b94dc0b469d80f60ab3ef78b921bc90

SHA256
f205a06d7ee9c94c2525833b5ab1818dd5762dc39166dc8587039d33cc2ed073

SHA512
272d7aa0adb5cc72679f6c116938ba1cff5009b77e2212734f89b526af4f0f4179513574c7e0d709a2bdfe8aeade761c7934f237b9d0bba44f5cafb23057ccf2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
871e6e24e1a92221ccc9303df43a3233

SHA1
777f81b360397093adb8969b86ce3c1585480b57

SHA256
5e7fdb2959652cb807bec40eec5da91f252b619bf5c00d8ee6e84319980035df

SHA512
d6f7d425115edad19f6fcc95b391ef304aaed0da72f7727f83fe8ad81d607d01b302e11f3e44cc844ecedb3f293ffbbe961cc7a46521d264c0312adc4bf36108

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
3d0f898503d626be2655adbd575f5f64

SHA1
83a037ec665458cc1a3a42e7282c7a3fde0d32c6

SHA256
32a4d8d3f1b0b2f6bc58396347818b1b9c21e7227c845657f9690b7b7814ea7b

SHA512
67ff6119a4c121ef90e36be479823fe5f75bfe98847f9331dec5ea78f327c698c23ba7c69265cceb150bb135981a2f75e5ba442ea011445fe94ec93c1ed17022

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
e37648194c9a56141b5cfde9cec1db68

SHA1
b8c021a8fae46e546f68b8ed1847e8c2e7d7a1b6

SHA256
7a54126dbac953b6375c98ed6e8a73f500c1b813175f15a5da388ee97f4e6802

SHA512
3dd10fe5cd3e2ca6cf27c0252af19f7aae3b772d45843094fc0aad38389ab7b16eda5e5f000cb5eb0cee3bba5798965b3fbb044efc99f818d18f7af7ade4fbce

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore.jsonlz4

Filesize
3KB

MD5
aedd699566b5b96bf7bc76ac1a81875d

SHA1
8e66eef6c9d6a098adb31c0402d75928dbad45b9

SHA256
9e3ae7bfa1e7235abf746c2854dd6856e90e7f9acce423ab6057198c8b12e7cc

SHA512
ef56b13b3fafc6c2ec5c5c3fa5100e0adf90615e28a0f47decfca829bdc754cddce9ffda450779c700af56542f2c3cd6024d4da02d060181459ba5a3e58809ae

Download Submit
C:\Users\Admin\Desktop\258441723810265.bat

Filesize
318B

MD5
b741d0951bc2d29318d75208913ea377

SHA1
a13de54ccfbd4ea29d9f78b86615b028bd50d0a5

SHA256
595dc1b7a6f1d7933c2d142d773e445dbc7b1a2089243b51193bc7f730b1c8df

SHA512
bf7b44ba7f0cfe093b24f26b288b715c0f0910fa7dc5f318edfc5c4fdc8c9b8a3b6ced5b61672ecfa9820ffd054b5bc2650ae0812804d2b3fc901aa06dd3ca14

Download Submit
C:\Users\Admin\Desktop\@[email protected]

Filesize
933B

MD5
f97d2e6f8d820dbd3b66f21137de4f09

SHA1
596799b75b5d60aa9cd45646f68e9c0bd06df252

SHA256
0e5ece918132a2b1a190906e74becb8e4ced36eec9f9d1c70f5da72ac4c6b92a

SHA512
efda21d83464a6a32fdeef93152ffd32a648130754fdd3635f7ff61cc1664f7fc050900f0f871b0ddd3a3846222bf62ab5df8eed42610a76be66fff5f7b4c4c0

Download Submit
C:\Users\Admin\Desktop\@[email protected]

Filesize
472B

MD5
9a76c398a1f75c50cd1e1680100756d7

SHA1
43e608da24681ce9e6736ba666fda1a1880801d0

SHA256
afc2e6c3c6fa33eb30d411df470acdabae712e8e28cb80ea3170205747cb4b22

SHA512
70205bd3daeed38db9d834bf8de189ccaa1cadf1eb5438e1274689da31fa5ecb047f467c2c47b5d8965c9278425de7e8cac1a63b90bc0426e1f0b59ad0c598fa

Download Submit
C:\Users\Admin\Desktop\TaskData\Tor\taskhsvc.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\Desktop\b.wnry

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\Desktop\c.wnry

Filesize
780B

MD5
383a85eab6ecda319bfddd82416fc6c2

SHA1
2a9324e1d02c3e41582bf5370043d8afeb02ba6f

SHA256
079ce1041cbffe18ff62a2b4a33711eda40f680d0b1d3b551db47e39a6390b21

SHA512
c661e0b3c175d31b365362e52d7b152267a15d59517a4bcc493329be20b23d0e4eb62d1ba80bb96447eeaf91a6901f4b34bf173b4ab6f90d4111ea97c87c1252

Download Submit
C:\Users\Admin\Desktop\m.vbs

Filesize
197B

MD5
94bdc24abf89cb36e00816911e6ae19e

SHA1
87335eea1d8eb1d70e715cc88daf248bb1f83021

SHA256
e9757f002a632de82ff9bd1283f90bcff2eec4ce6926f8b7e37879ff0c518660

SHA512
3bec73a3c6360499bb280aec0562157cda47c8ed11e3b1280c4fb8a457ab48dc1f3aea42d6a0d5c2842d60ca09436da96ef7136c0652d2b5c613fae87799ac0f

Download Submit
C:\Users\Admin\Desktop\msg\m_bulgarian.wnry

Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\Desktop\msg\m_chinese (simplified).wnry

Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\Desktop\msg\m_chinese (traditional).wnry

Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\Desktop\msg\m_croatian.wnry

Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\Desktop\msg\m_czech.wnry

Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\Desktop\msg\m_danish.wnry

Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\Desktop\msg\m_dutch.wnry

Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\Desktop\msg\m_english.wnry

Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\Desktop\msg\m_filipino.wnry

Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\Desktop\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Desktop\msg\m_french.wnry

Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\Desktop\msg\m_german.wnry

Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\Desktop\msg\m_greek.wnry

Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\Desktop\msg\m_indonesian.wnry

Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\Desktop\msg\m_italian.wnry

Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\Desktop\msg\m_japanese.wnry

Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\Desktop\msg\m_korean.wnry

Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Users\Admin\Desktop\msg\m_latvian.wnry

Filesize
40KB

MD5
c33afb4ecc04ee1bcc6975bea49abe40

SHA1
fbea4f170507cde02b839527ef50b7ec74b4821f

SHA256
a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

SHA512
0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

Download Submit
C:\Users\Admin\Desktop\msg\m_norwegian.wnry

Filesize
36KB

MD5
ff70cc7c00951084175d12128ce02399

SHA1
75ad3b1ad4fb14813882d88e952208c648f1fd18

SHA256
cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

SHA512
f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

Download Submit
C:\Users\Admin\Desktop\msg\m_polish.wnry

Filesize
38KB

MD5
e79d7f2833a9c2e2553c7fe04a1b63f4

SHA1
3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

SHA256
519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

SHA512
e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

Download Submit
C:\Users\Admin\Desktop\msg\m_portuguese.wnry

Filesize
37KB

MD5
fa948f7d8dfb21ceddd6794f2d56b44f

SHA1
ca915fbe020caa88dd776d89632d7866f660fc7a

SHA256
bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

SHA512
0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

Download Submit
C:\Users\Admin\Desktop\msg\m_romanian.wnry

Filesize
50KB

MD5
313e0ececd24f4fa1504118a11bc7986

SHA1
e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

SHA256
70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

SHA512
c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

Download Submit
C:\Users\Admin\Desktop\msg\m_russian.wnry

Filesize
46KB

MD5
452615db2336d60af7e2057481e4cab5

SHA1
442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

SHA256
02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

SHA512
7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

Download Submit
C:\Users\Admin\Desktop\msg\m_slovak.wnry

Filesize
40KB

MD5
c911aba4ab1da6c28cf86338ab2ab6cc

SHA1
fee0fd58b8efe76077620d8abc7500dbfef7c5b0

SHA256
e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

SHA512
3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

Download Submit
C:\Users\Admin\Desktop\msg\m_spanish.wnry

Filesize
36KB

MD5
8d61648d34cba8ae9d1e2a219019add1

SHA1
2091e42fc17a0cc2f235650f7aad87abf8ba22c2

SHA256
72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

SHA512
68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

Download Submit
C:\Users\Admin\Desktop\msg\m_swedish.wnry

Filesize
37KB

MD5
c7a19984eb9f37198652eaf2fd1ee25c

SHA1
06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae

SHA256
146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4

SHA512
43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

Download Submit
C:\Users\Admin\Desktop\msg\m_turkish.wnry

Filesize
41KB

MD5
531ba6b1a5460fc9446946f91cc8c94b

SHA1
cc56978681bd546fd82d87926b5d9905c92a5803

SHA256
6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415

SHA512
ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

Download Submit
C:\Users\Admin\Desktop\msg\m_vietnamese.wnry

Filesize
91KB

MD5
8419be28a0dcec3f55823620922b00fa

SHA1
2e4791f9cdfca8abf345d606f313d22b36c46b92

SHA256
1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8

SHA512
8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

Download Submit
C:\Users\Admin\Desktop\r.wnry

Filesize
864B

MD5
3e0020fc529b1c2a061016dd2469ba96

SHA1
c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade

SHA256
402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c

SHA512
5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

Download Submit
C:\Users\Admin\Desktop\s.wnry

Filesize
2.9MB

MD5
ad4c9de7c8c40813f200ba1c2fa33083

SHA1
d1af27518d455d432b62d73c6a1497d032f6120e

SHA256
e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b

SHA512
115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617

Download Submit
C:\Users\Admin\Desktop\t.wnry

Filesize
64KB

MD5
5dcaac857e695a65f5c3ef1441a73a8f

SHA1
7b10aaeee05e7a1efb43d9f837e9356ad55c07dd

SHA256
97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6

SHA512
06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2

Download Submit
C:\Users\Admin\Desktop\taskdl.exe

Filesize
20KB

MD5
4fef5e34143e646dbf9907c4374276f5

SHA1
47a9ad4125b6bd7c55e4e7da251e23f089407b8f

SHA256
4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79

SHA512
4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5

Download Submit
C:\Users\Admin\Desktop\taskse.exe

Filesize
20KB

MD5
8495400f199ac77853c53b5a3f278f3e

SHA1
be5d6279874da315e3080b06083757aad9b32c23

SHA256
2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d

SHA512
0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4

Download Submit
C:\Users\Admin\Desktop\u.wnry

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\Downloads\MEMZ-virus-main.zip

Filesize
8KB

MD5
a043dc5c624d091f7c2600dd18b300b7

SHA1
4682f79dabfc6da05441e2b6d820382ff02b4c58

SHA256
0acffde0f952b44d500cf2689d6c9ab87e66ac7fa29a51f3c3e36a43ea5e694a

SHA512
ee4f691a6c7b6c047bca49723b65e5980a8f83cbbc129ddfd578b855430b78acf3d0e461238739cd64c8a5c9071fe132c10da3ac28085fc978b6a19ee1ca3313

Download Submit
C:\Users\Admin\Downloads\Monoxidex64.exe.vir

Filesize
330KB

MD5
692361071bbbb3e9243d09dc190fedea

SHA1
04894c41500859ea3617b0780f1cc2ba82a40daf

SHA256
ae9405b9556c24389ee359993f45926a895481c8d60d98b91a3065f5c026cffe

SHA512
cfdd627d228c89a4cc2eac27dcdc45507f1e4265eff108958de0e26e0d1abe7598a5347be77d1a52256de70c77129f1cd0e9b31c023e1263f4cf04dbc689c87e

Download Submit
C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.YYnpaQIX.0-master.zip.part

Filesize
3.3MB

MD5
017f199a7a5f1e090e10bbd3e9c885ca

SHA1
4e545b77d1be2445b2f0163ab2d6f2f01ec4ca05

SHA256
761e037ee186880d5f7d1f112b839818056f160a9ba60c7fb8d23d926ac0621f

SHA512
76215a26588204247027dcfdab4ea583443b2b2873ff92ad7dd5e9a9037c77d20ab4e471b8dd83e642d8481f53dbc0f83f993548dc7d151dead48dc29c1fdc22

Download Submit
C:\Users\Admin\Downloads\salinewin.NtXJXrSG.exe-Malware-main.zip.part

Filesize
12.1MB

MD5
c8bf514a334eaa148cb3c6135c2fb394

SHA1
0e47a89c3729db5a6f195c6abb04e5129d788df8

SHA256
9127560918eaefe69f1959bcb7f7e13b7e3a7ac156b564922829faaec9b96f67

SHA512
9879a258f429ef492cf495dbddd4f2b9c9fbc061e325aa8ad870ed05049b7ad595b26d223d20c55fc99f403fc9b5d0235353d71bf5d9a39ee4462838feb247ff

Download Submit
memory/1048-18-0x000007FEF5DF0000-0x000007FEF5E3C000-memory.dmp

Filesize
304KB

Download
memory/1048-19-0x000007FEF5DF0000-0x000007FEF5E3C000-memory.dmp

Filesize
304KB

Download
memory/1448-16-0x000007FEF5810000-0x000007FEF5AC6000-memory.dmp

Filesize
2.7MB

Download
memory/1448-17-0x000007FEF4230000-0x000007FEF52E0000-memory.dmp

Filesize
16.7MB

Download
memory/1448-15-0x000007FEF5E00000-0x000007FEF5E34000-memory.dmp

Filesize
208KB

Download
memory/1448-14-0x000000013F8D0000-0x000000013F9C8000-memory.dmp

Filesize
992KB

Download
memory/1544-2064-0x0000000074140000-0x0000000074162000-memory.dmp

Filesize
136KB

Download
memory/1544-2073-0x0000000074420000-0x0000000074497000-memory.dmp

Filesize
476KB

Download
memory/1544-2134-0x0000000000860000-0x0000000000B5E000-memory.dmp

Filesize
3.0MB

Download
memory/1544-2138-0x0000000074200000-0x000000007441C000-memory.dmp

Filesize
2.1MB

Download
memory/1544-2061-0x00000000744C0000-0x0000000074542000-memory.dmp

Filesize
520KB

Download
memory/1544-2124-0x0000000000860000-0x0000000000B5E000-memory.dmp

Filesize
3.0MB

Download
memory/1544-2065-0x0000000000860000-0x0000000000B5E000-memory.dmp

Filesize
3.0MB

Download
memory/1544-2063-0x0000000074170000-0x00000000741F2000-memory.dmp

Filesize
520KB

Download
memory/1544-2062-0x0000000074200000-0x000000007441C000-memory.dmp

Filesize
2.1MB

Download
memory/1544-2128-0x0000000074200000-0x000000007441C000-memory.dmp

Filesize
2.1MB

Download
memory/1544-2076-0x0000000074140000-0x0000000074162000-memory.dmp

Filesize
136KB

Download
memory/1544-2075-0x0000000074170000-0x00000000741F2000-memory.dmp

Filesize
520KB

Download
memory/1544-2074-0x0000000074200000-0x000000007441C000-memory.dmp

Filesize
2.1MB

Download
memory/1544-2101-0x0000000000860000-0x0000000000B5E000-memory.dmp

Filesize
3.0MB

Download
memory/1544-2072-0x00000000744A0000-0x00000000744BC000-memory.dmp

Filesize
112KB

Download
memory/1544-2071-0x00000000744C0000-0x0000000074542000-memory.dmp

Filesize
520KB

Download
memory/1544-2070-0x0000000000860000-0x0000000000B5E000-memory.dmp

Filesize
3.0MB

Download
memory/1544-2077-0x0000000000860000-0x0000000000B5E000-memory.dmp

Filesize
3.0MB

Download
memory/1544-2090-0x0000000074200000-0x000000007441C000-memory.dmp

Filesize
2.1MB

Download
memory/1544-2086-0x0000000000860000-0x0000000000B5E000-memory.dmp

Filesize
3.0MB

Download
memory/1544-2097-0x0000000074200000-0x000000007441C000-memory.dmp

Filesize
2.1MB

Download
memory/1544-2093-0x0000000000860000-0x0000000000B5E000-memory.dmp

Filesize
3.0MB

Download
memory/1544-2105-0x0000000074200000-0x000000007441C000-memory.dmp

Filesize
2.1MB

Download
memory/2120-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2120-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2464-2069-0x00000000045C0000-0x00000000045D0000-memory.dmp

Filesize
64KB

Download
memory/3220-394-0x00000000033E0000-0x00000000033E2000-memory.dmp

Filesize
8KB

Download
memory/3484-1199-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download