wannacry | 5bab1750446140021b6d2bf1ed3e14306c60127df9bd51b3ee74e5b4757525f9

Analysis

max time kernel
256s
max time network
257s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
20-12-2024 19:03

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Shopkeepers-2.18.0.jar
Size

1.9MB
MD5

e7e29bb96d27ec5b6503831f9122f8c5
SHA1

cd2f816e660d29989323514d3220bad68409df16
SHA256

5bab1750446140021b6d2bf1ed3e14306c60127df9bd51b3ee74e5b4757525f9
SHA512

26ea972608f4c172bd336492757a124a233ad913ac0177dcb4a92da74366e6a1ea2276d6456bbe4c40dfb1d7638a52ffb2db6e79bb56b53625c4aa0b1405545e
SSDEEP

49152:D8tyYqzzYPSKQoTZArORsBy0vos3KXL1MuhxtS:D8A1zm7kOp2p6zS

Score

10^/10

wannacry defense_evasion discovery evasion execution impact persistence phishing ransomware spyware stealer trojan worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\winnt32.exe"	NoEscape.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NoEscape.exe

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	NoEscape.exe

Downloads MZ/PE file
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDC4D2.tmp	WannaCry.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDC4D9.tmp	WannaCry.EXE

Executes dropped EXE 14 IoCs

pid	Process
3812	WannaCry.EXE
3140	taskdl.exe
5604	@[email protected]
4612	@[email protected]
5040	taskhsvc.exe
4760	taskdl.exe
1936	taskse.exe
4344	@[email protected]
1232	taskse.exe
4988	@[email protected]
3620	taskdl.exe
1116	taskse.exe
4476	@[email protected]
2464	taskdl.exe

Loads dropped DLL 8 IoCs

pid	Process
5040	taskhsvc.exe
5040	taskhsvc.exe
5040	taskhsvc.exe
5040	taskhsvc.exe
5040	taskhsvc.exe
5040	taskhsvc.exe
5040	taskhsvc.exe
5040	taskhsvc.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5176	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xinwmfpie312 = "\"C:\\Users\\Admin\\Downloads\\tasksche.exe\""	reg.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	NoEscape.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	NoEscape.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
332	raw.githubusercontent.com
285	camo.githubusercontent.com
286	camo.githubusercontent.com
287	camo.githubusercontent.com
333	raw.githubusercontent.com
334	raw.githubusercontent.com
338	raw.githubusercontent.com
288	camo.githubusercontent.com
330	raw.githubusercontent.com
331	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 3 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	WannaCry.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\noescape.png"	NoEscape.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\winnt32.exe	NoEscape.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File created	C:\Windows\winnt32.exe	NoEscape.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\WannaCry.EXE:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoEscape.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "33"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings	firefox.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3120	reg.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\WannaCry.EXE:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\NoEscape.exe.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5040	taskhsvc.exe
5040	taskhsvc.exe
5040	taskhsvc.exe
5040	taskhsvc.exe
5040	taskhsvc.exe
5040	taskhsvc.exe
3852	WMIC.exe
3852	WMIC.exe
3852	WMIC.exe
3852	WMIC.exe
5468	mspaint.exe
5468	mspaint.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

description	pid	Process
Token: SeDebugPrivilege	3424	firefox.exe
Token: SeDebugPrivilege	3424	firefox.exe
Token: SeDebugPrivilege	3424	firefox.exe
Token: SeDebugPrivilege	3424	firefox.exe
Token: SeDebugPrivilege	3424	firefox.exe
Token: SeDebugPrivilege	236	cscript.exe
Token: SeDebugPrivilege	236	cscript.exe
Token: SeDebugPrivilege	236	cscript.exe
Token: SeIncreaseQuotaPrivilege	3852	WMIC.exe
Token: SeSecurityPrivilege	3852	WMIC.exe
Token: SeTakeOwnershipPrivilege	3852	WMIC.exe
Token: SeLoadDriverPrivilege	3852	WMIC.exe
Token: SeSystemProfilePrivilege	3852	WMIC.exe
Token: SeSystemtimePrivilege	3852	WMIC.exe
Token: SeProfSingleProcessPrivilege	3852	WMIC.exe
Token: SeIncBasePriorityPrivilege	3852	WMIC.exe
Token: SeCreatePagefilePrivilege	3852	WMIC.exe
Token: SeBackupPrivilege	3852	WMIC.exe
Token: SeRestorePrivilege	3852	WMIC.exe
Token: SeShutdownPrivilege	3852	WMIC.exe
Token: SeDebugPrivilege	3852	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3852	WMIC.exe
Token: SeRemoteShutdownPrivilege	3852	WMIC.exe
Token: SeUndockPrivilege	3852	WMIC.exe
Token: SeManageVolumePrivilege	3852	WMIC.exe
Token: SeImpersonatePrivilege	3852	WMIC.exe
Token: 33	3852	WMIC.exe
Token: 34	3852	WMIC.exe
Token: 35	3852	WMIC.exe
Token: 36	3852	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3852	WMIC.exe
Token: SeSecurityPrivilege	3852	WMIC.exe
Token: SeTakeOwnershipPrivilege	3852	WMIC.exe
Token: SeLoadDriverPrivilege	3852	WMIC.exe
Token: SeSystemProfilePrivilege	3852	WMIC.exe
Token: SeSystemtimePrivilege	3852	WMIC.exe
Token: SeProfSingleProcessPrivilege	3852	WMIC.exe
Token: SeIncBasePriorityPrivilege	3852	WMIC.exe
Token: SeCreatePagefilePrivilege	3852	WMIC.exe
Token: SeBackupPrivilege	3852	WMIC.exe
Token: SeRestorePrivilege	3852	WMIC.exe
Token: SeShutdownPrivilege	3852	WMIC.exe
Token: SeDebugPrivilege	3852	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3852	WMIC.exe
Token: SeRemoteShutdownPrivilege	3852	WMIC.exe
Token: SeUndockPrivilege	3852	WMIC.exe
Token: SeManageVolumePrivilege	3852	WMIC.exe
Token: SeImpersonatePrivilege	3852	WMIC.exe
Token: 33	3852	WMIC.exe
Token: 34	3852	WMIC.exe
Token: 35	3852	WMIC.exe
Token: 36	3852	WMIC.exe
Token: SeBackupPrivilege	4464	vssvc.exe
Token: SeRestorePrivilege	4464	vssvc.exe
Token: SeAuditPrivilege	4464	vssvc.exe
Token: SeTcbPrivilege	1936	taskse.exe
Token: SeTcbPrivilege	1936	taskse.exe
Token: SeTcbPrivilege	1232	taskse.exe
Token: SeTcbPrivilege	1232	taskse.exe
Token: SeDebugPrivilege	3424	firefox.exe
Token: SeDebugPrivilege	3424	firefox.exe
Token: SeTcbPrivilege	1116	taskse.exe
Token: SeTcbPrivilege	1116	taskse.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
4344	@[email protected]

Suspicious use of SendNotifyMessage 52 IoCs

pid	Process
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
5604	@[email protected]
5604	@[email protected]
4612	@[email protected]
4612	@[email protected]
5468	mspaint.exe
5468	mspaint.exe
5468	mspaint.exe
5468	mspaint.exe
4344	@[email protected]
4344	@[email protected]
4988	@[email protected]
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
4476	@[email protected]
3880	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 3424	3716	firefox.exe	86
PID 3716 wrote to memory of 3424	3716	firefox.exe	86
PID 3716 wrote to memory of 3424	3716	firefox.exe	86
PID 3716 wrote to memory of 3424	3716	firefox.exe	86
PID 3716 wrote to memory of 3424	3716	firefox.exe	86
PID 3716 wrote to memory of 3424	3716	firefox.exe	86
PID 3716 wrote to memory of 3424	3716	firefox.exe	86
PID 3716 wrote to memory of 3424	3716	firefox.exe	86
PID 3716 wrote to memory of 3424	3716	firefox.exe	86
PID 3716 wrote to memory of 3424	3716	firefox.exe	86
PID 3716 wrote to memory of 3424	3716	firefox.exe	86
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 1760	3424	firefox.exe	87
PID 3424 wrote to memory of 4956	3424	firefox.exe	88
PID 3424 wrote to memory of 4956	3424	firefox.exe	88
PID 3424 wrote to memory of 4956	3424	firefox.exe	88
PID 3424 wrote to memory of 4956	3424	firefox.exe	88
PID 3424 wrote to memory of 4956	3424	firefox.exe	88
PID 3424 wrote to memory of 4956	3424	firefox.exe	88
PID 3424 wrote to memory of 4956	3424	firefox.exe	88
PID 3424 wrote to memory of 4956	3424	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
6032	attrib.exe
5400	attrib.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Shopkeepers-2.18.0.jar
1⤵
PID:3792

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1884 -prefsLen 23839 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8b3dbc0-968d-43e4-86e3-e42c33d34dda} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" gpu
    3⤵
    PID:1760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f5b0c36-194e-4a08-a8fd-be1bfe2b785a} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" socket
    3⤵
    PID:4956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2972 -childID 1 -isForBrowser -prefsHandle 3024 -prefMapHandle 3036 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9efa4e48-334a-4957-aad3-9fab2135e44e} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:1628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4068 -childID 2 -isForBrowser -prefsHandle 4060 -prefMapHandle 4056 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ad44366-4eba-4ec8-aa1d-2f7929498d9a} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:2024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4948 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4956 -prefMapHandle 4952 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92a3ee3c-1ca8-41c5-87a9-8dc218b8f244} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" utility
    3⤵
    - Checks processor information in registry
    PID:3020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5612 -childID 3 -isForBrowser -prefsHandle 5600 -prefMapHandle 5604 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {333ef838-a126-4bb8-a73e-ed87071559b1} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:3796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5808 -childID 4 -isForBrowser -prefsHandle 5728 -prefMapHandle 5732 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {70771cb4-4e27-4c99-aef5-e701d00ef505} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:1216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5980 -childID 5 -isForBrowser -prefsHandle 5988 -prefMapHandle 5992 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {127c7436-a63a-4ebc-a78f-b1c8dedce4c4} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:5080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4344 -childID 6 -isForBrowser -prefsHandle 3784 -prefMapHandle 3780 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2f7a395-d1b0-4562-8a4b-1e57e06ce8d3} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:5116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6300 -childID 7 -isForBrowser -prefsHandle 6364 -prefMapHandle 6360 -prefsLen 27450 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c388d408-2927-4b0b-918e-9620c9fd7fb9} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:3732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4784 -childID 8 -isForBrowser -prefsHandle 6524 -prefMapHandle 4636 -prefsLen 27450 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cddbc84-a11e-4bef-a7bb-5dfc6d40d5b4} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4636 -childID 9 -isForBrowser -prefsHandle 6772 -prefMapHandle 6768 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {556e3130-1d95-406e-b929-e553587eb042} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:5768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5752 -childID 10 -isForBrowser -prefsHandle 5776 -prefMapHandle 5760 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dcea3eee-29cd-471f-b546-dd954edd2cdd} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:2452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5376 -childID 11 -isForBrowser -prefsHandle 5820 -prefMapHandle 5836 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5bf170a7-8268-49cc-9919-455a3f4e3922} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:4588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7024 -childID 12 -isForBrowser -prefsHandle 7016 -prefMapHandle 7012 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55138095-b982-4c93-97aa-78fb273fd986} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:2460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4752 -childID 13 -isForBrowser -prefsHandle 5740 -prefMapHandle 6836 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3feca264-87c9-498a-849c-5430351dc107} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6868 -childID 14 -isForBrowser -prefsHandle 6524 -prefMapHandle 6516 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {677c1cd3-c945-423b-8ebc-711df32c03df} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:5192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6936 -childID 15 -isForBrowser -prefsHandle 6044 -prefMapHandle 4188 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58a71e4c-718d-4d8e-b559-60e2b59a9860} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:5720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1376 -childID 16 -isForBrowser -prefsHandle 6612 -prefMapHandle 6628 -prefsLen 30533 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b34a97fd-be97-4432-8610-c881db861973} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:5816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2592 -childID 17 -isForBrowser -prefsHandle 6032 -prefMapHandle 6028 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3eacddda-a486-4fc9-a3a0-4ac56345845b} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:1472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6828 -childID 18 -isForBrowser -prefsHandle 5616 -prefMapHandle 2664 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64e400ca-a7de-4fe6-9352-a574a1605f74} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:5732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6336 -childID 19 -isForBrowser -prefsHandle 5664 -prefMapHandle 5652 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ce09b5d-a73b-4e53-ac09-2df830a922ed} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:2748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6212 -childID 20 -isForBrowser -prefsHandle 6904 -prefMapHandle 6732 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6eabcafd-cf81-41c7-b91c-4506e437f236} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:2284
- - C:\Users\Admin\Downloads\WannaCry.EXE
    "C:\Users\Admin\Downloads\WannaCry.EXE"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    PID:3812
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h .
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:6032
  - - C:\Windows\SysWOW64\icacls.exe
      icacls . /grant Everyone:F /T /C /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5176
  - - C:\Users\Admin\Downloads\taskdl.exe
      taskdl.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3140
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 202041734721574.bat
      4⤵
      System Location Discovery: System Language Discovery
      PID:5792
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript.exe //nologo m.vbs
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:236
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s F:\$RECYCLE
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5400
  - - C:\Users\Admin\Downloads\@[email protected]
      @[email protected] co
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5604
    - - C:\Users\Admin\Downloads\TaskData\Tor\taskhsvc.exe
        
        TaskData\Tor\taskhsvc.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5040
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c start /b @[email protected] vs
      4⤵
      System Location Discovery: System Language Discovery
      PID:2408
    - - C:\Users\Admin\Downloads\@[email protected]
        
        @[email protected] vs
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4612
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4064
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3852
  - - C:\Users\Admin\Downloads\taskdl.exe
      taskdl.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4760
  - - C:\Users\Admin\Downloads\taskse.exe
      taskse.exe C:\Users\Admin\Downloads\@[email protected]
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1936
  - - C:\Users\Admin\Downloads\@[email protected]
      @[email protected]
      4⤵
      Executes dropped EXE
      Sets desktop wallpaper using registry
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:4344
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "xinwmfpie312" /t REG_SZ /d "\"C:\Users\Admin\Downloads\tasksche.exe\"" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5128
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "xinwmfpie312" /t REG_SZ /d "\"C:\Users\Admin\Downloads\tasksche.exe\"" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3120
  - - C:\Users\Admin\Downloads\taskse.exe
      taskse.exe C:\Users\Admin\Downloads\@[email protected]
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1232
  - - C:\Users\Admin\Downloads\taskdl.exe
      taskdl.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3620
  - - C:\Users\Admin\Downloads\@[email protected]
      @[email protected]
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4988
  - - C:\Users\Admin\Downloads\taskse.exe
      taskse.exe C:\Users\Admin\Downloads\@[email protected]
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1116
  - - C:\Users\Admin\Downloads\@[email protected]
      @[email protected]
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4476
  - - C:\Users\Admin\Downloads\taskdl.exe
      taskdl.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5612 -childID 21 -isForBrowser -prefsHandle 6896 -prefMapHandle 7076 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a68f566b-bb07-4f72-9fd3-bc66e979a39d} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:2256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7628 -childID 22 -isForBrowser -prefsHandle 7612 -prefMapHandle 7604 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {224f9da9-9156-4d2b-b376-b49bbf0d368d} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:1188

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4464

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\@[email protected]"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5372

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4544

C:\Users\Admin\Desktop\NoEscape.exe
"C:\Users\Admin\Desktop\NoEscape.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1252

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39cd055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\activity-stream.discovery_stream.json

Filesize
19KB

MD5
932845433857a01ef468fee189d68ab8

SHA1
c37f4d053046c683c04c8f3b625f8e8679a7774b

SHA256
d78b98ce0c16544b135503f82c7c58ba5a2beef052a274ad5ced344c269247ee

SHA512
92eeb2473f78fbf498ce85dc009485d6312285523a11fcfae693207ee119080eb92494eb255197cae96acd0c7500ab833788f96fc36df06e706f2d75bf3c52a3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\doomed\15765

Filesize
23KB

MD5
40bfa96724a81a583c371ce3dd62bd5d

SHA1
b993d961136afa285817e48a66141dcd7db8e1d0

SHA256
067bc8049c60f914165ac684229048904c1451a671b8cbfb10dda6efafd51631

SHA512
85d7a0783117b9fc993d171ebfbaab1ba4f9b0946a6ea1d7d6873d054df1f4fee0241e3ca319728e7887b09a1d3fb0da8426b70a264c62a3ab93d82d6a26260d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\00B6EC13AD08A41642087AC350A7848C47384E25

Filesize
515KB

MD5
b3db5aca00c156defb06efd9765254ee

SHA1
421bc3156d051a5c0b9eef64b0c5e85bb2f7f553

SHA256
e3815f62747708335391a5e6f08b88dc014050b4fe282df539aaeff00bfed04a

SHA512
77783622350e81c84ee91026b7c0c55096f0d3c72811941242d48934f235b96cdff02820601e0a62cf69d2a46bd9d69171fe79a7651cb080e8ed54048d731eb5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\016FEED2129D34C8D0D8100955D0997AF73BA7C9

Filesize
445KB

MD5
fc44adb0bfc3df8349bdd165e105c262

SHA1
0280b2d1a5345904e21454ea1c6736c3ff88aa78

SHA256
fb2d9d302fe9cb0e43cf8483a91af00e4403a616358063dce9de1d829d899b0b

SHA512
0d4afaa46026c2145107257810bd0dd1cc335c1b2a03540a6b0973fcbebf2ae905258221b7657e774a9307d80ead20b9dcdf5748791f76dcc81686c6e6d249f2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\0496E33B07BB9340090B6FF9A653DA5443DBD403

Filesize
224KB

MD5
ad253bdd575195264dd89e8778a40823

SHA1
a52da4865c77954177f78a02f1f60c369b4f73e5

SHA256
17304872a1f578bab02cfd31b2a7eeb051980b8f3c44ecc01c7a15272276b986

SHA512
40dfe04cc6774c332297f485220de7205b04a4b8d0a6889ac736ebfb86dfed89ddc396a4586b55ad4925e17a3c2bec5c06c5c0ad1f7abcfff2ee0d573d362222

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\04AAB183FD7AAE2AFB402E06522E7641ABAE9B37

Filesize
75KB

MD5
e2adc487b79b0d251f67838815e72719

SHA1
3bcba88cf0cb2a652407e056155fb0139f3eaa1d

SHA256
0b40a0c22dd2b502dbf2065400234b40d0891d6b58dda53499a13dc1a144dd1a

SHA512
2bb9e0ed6d0122d8c8d91468976ff88c825f2d3d63627050e6bfd9a0f0bdfe44895f8d56e699dbedf2ad1ba5366151e6bdcaf5eeee3f78871b699f584f325bea

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\0A7224DF3067FBAB83E102522C23E35389518D27

Filesize
34KB

MD5
15693e822d4c1902c08ed7d2c4af705d

SHA1
8bc10a71719ad756632d292a3388effbd8a3724c

SHA256
eb3aaf47593c256dc6f1674a33aea891b0bc3159bde87ccbc973f97e30efcbda

SHA512
2ac883dab3e95b0a773565a6612ebf73e7293608fa8b7b5c14a01856add169809ae6e20932d46ba59f0ead591c561bc1e38b4aef109a83703342f0d1fbd1dc99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\10FEBECA475E5DA7924C49753C3BA5793B0A1F6C

Filesize
1.2MB

MD5
0e5dc65f06d57c83e052e73336fc7920

SHA1
5c3506e3ce3e4fbd98361bcf7ae66cf0a4f3395a

SHA256
a4fd6301c71527849ba8f9caf1faf49e6411204d2ac6b0746b9e372cf319a086

SHA512
e7e25a5afa809280b4e7f4ce0bd85e8a27a530c2810763b2bd4d1d22c278ded8fa8b7840fc96cbd2c033d084e8f221617dded49060e6b1701b5d1c01d39bb59a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\15E209803B15EDDBC85739055F66C4132E8333BA

Filesize
49KB

MD5
30df7c9560ac8cefe9b396a88e9f8591

SHA1
983db6eec5c119bec492ad3948de2ae50c190690

SHA256
1ea6997995c0ca8a9718271287a8c7b5922b0ef609906e04515621bd736d1057

SHA512
404040044a16a224d32467b098bb0734465b37239ffda62e0274d0642184c98e1fbe1050e3e94396986c5e8b8f3b77c281ebc104205b7b66fb7642b9a8ea11c5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\181ABBECB37245BB6E2952CA955F153D2ECE4C16

Filesize
19KB

MD5
f96e087969242f0df595e19af0ebf5c9

SHA1
d91c2ed8c22a4b21c21455fceb7253fb897de154

SHA256
a7d8234f107a01112b599e6f039c40c2ea25a1fbece1c2c7ae11bc9fa8e88a06

SHA512
5edae597c092ac6c5f3ac0317b82b9a92780f89a938dfb050951cc5dded5a057ebcfea2d439c5428f9354391f50f55b3900c2c3858ac6d3e127a4bdc4dd7673f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\27A27AA38EDFA2A5330DD4EDD1BAAA54EF35EE5A

Filesize
113KB

MD5
6798d3c248fb3ced689909ee2961066a

SHA1
11064b723e47e1088bf3f05142f14a6f151feaf8

SHA256
8c266e421a0b62d43cc9f2a66291bc46ec844bdf085093c517b963227e6fec99

SHA512
22c5133937c2ceaee04abf991b37332920193df07d6c7878ac051c0d3c3122812c16b46a67bbc848e6ef2c5c4acd81beb8e4c700bb3db63cbc49bf310726b556

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\2D0D21BC9A9240A79FA1C05FD669EF8D50CA1B19

Filesize
52KB

MD5
c935c6a3c797d340c872ff89f9b813c0

SHA1
9461b5e8c2bb2ac82098019460e84ba5466a7ac7

SHA256
ca8d2e1a02bb5e7bbdee79f6b9d8fd40081646899319e6c7d037509db1473251

SHA512
ab63a3851b92db661a8fb8360b14f3c80b4ea708454bd9eb20a69dbd0c56e1d12fcf8c060491320769f80ba2a3873eb568fa09d82dab93411e49bd73664304c7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\351651DD4DA76FCE7C093867F5F77A621B5F48FC

Filesize
159KB

MD5
b22f0e093f7ce948b8c4549666718184

SHA1
f3d94b64239e047a022f7614c2cdbf0c0f72cdc4

SHA256
38622c77b24f4555aa98f33c1156b130d8059ea056ca65eb089301c2c499dbc4

SHA512
542bbfa680922bf9038a06860d064719685ffed818438a2f05cd6fcf5656d7a3cb4412608fcd24eb8d7caa799d724154758ff6a733d912e90870bf13a2c1e6cc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\40612FD695C06D894CB46EE1CB31A7943DD2D6AD

Filesize
1.5MB

MD5
8f5e64ad5423803258cbf9ac2ba6cdb9

SHA1
a4620f405a11e02789364bc3716d5d2230a726a7

SHA256
7417e31a35823aa3c107512466cb6d068435ac82350e945adb3502a77c9ed671

SHA512
1d06ab54e4672b655394966c59a2b80b31249f6a4a72b8d48c14ccaa57833cd9d7a7de8ab43c8f62014e0544ff7ac5ad5ae2e0ee4db1f6354b89e88000b195c8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\4AEE8C0882D57FFFF46D91F226FABC9AAAC5C50F

Filesize
47KB

MD5
2cf603df0cb1e23002d430cc47589f00

SHA1
9943870e4b1f6138952848681e9184bb477a5237

SHA256
7e3b7adb683a42b546f0c6fb7d1468d7a12eab460374423aee503cfeccccc5ca

SHA512
f19f203b40c27cc9f37c7b8d9a171003929470a0a42598721e9781f3adf92806a1e38294fd0c8d9429f3891ad7d4a7b6e3752d217c23c73b16e8078b2d9d28de

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\4C331DD86A3F295E4866F9799205B1A16BC1F808

Filesize
147KB

MD5
cd7f1945d9e5709e2fdd363f6ee5bcd6

SHA1
b9befcd8ac08f0c4e4fa1c8a6920cb5420f39d1c

SHA256
b396689489f170f10686abdeeaab7de97b30777504988c27d667dd5e0a4bae03

SHA512
c79fa5bc3a3f8eb080471caa44c255758122b147df40ccfd1302dc5a8feffc9460d7080581dbe08bc5a0a9ac30afa684dd7b14ca0d1d683f4006f81587fbab1a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\4EF464361884FF27DA877BFB59D10EA2A4BEB579

Filesize
132KB

MD5
575d7c87c62941c1346ab750be82ab34

SHA1
98a12b3d197a0861982b1600595d670e03691cbf

SHA256
d7026bccc8958d33090bf01766980e76f4de7b422877874a0a830c0d1bc7ed2d

SHA512
10d3a9b72a85436a2b868d60b48cb678f1f40eee7815aa051948f43f9bbd3a5b9eb601202f01188f5097d7f4cf604e1b096f7c7e6d1846356fc54f2b58682dc7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\551D93FA10BF38BBC90158991B84CD7F588AEE8A

Filesize
18KB

MD5
6eca208ff488b909c63ea506c52973ad

SHA1
01b671e6bd7680245bc0ee87a865bfb58fad7aa3

SHA256
167cb087ec4f4a6434689d2de005e462b83a2a21d6cf4f0e20cf4efcc86cb1ad

SHA512
7416ee0aa68435b40a0c832e02e60d19ae29a569e2d4108ed22ff703cb0b7308bf26d789393b9ac9b21bb9f013a711c4c1320c4deaeddb5cc589e432a938292c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\561DDB3A593C433209B375B74BF2706DF3B9CC58

Filesize
80KB

MD5
b0c6c5f776eb9cf416f31c3309efff5a

SHA1
da78517da40911b9ad14c85ff968dc42b8bd7a92

SHA256
111db4a9a863a987ec631d4bacb12f2db59c08815eb267ecb1ff896a2432da53

SHA512
211366c672bce8bdda3c875f9cf02054bd39edcfcfb86dd5c3856b660c1a280d2da55cef9bb0b39666eed6df5e35f25f72f77a94a37220b2e2fa9898c196e33e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\6320D2EC1C48123798B9E56A3892928213639453

Filesize
19KB

MD5
66d77bd88ec67f2e8f4ee029e3bd330d

SHA1
213a7aec1ff74cdd54ca5e803a1e7b5ef7ef6046

SHA256
494095a04a38f51760d826c9bad336ff063689bff54192d0624439502560d2e2

SHA512
8c5e1cf963ec02a12940d6606e2914c32f7be8a515c051178dc7f81129a24420595a269de243a9befcb4d6116ffd5f0daa0ec8022c9858b27d1c8487f93d0ec3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\643973A72CB665816E627CECAEEAC7166A356FB8

Filesize
19KB

MD5
925cfea071f22cbd7a866e6509440a08

SHA1
4cf329408b25c17a8fbf32ca913fca2fe24be773

SHA256
3bbfe1cb3cbddf08d00b4d58f9f97578a927e97130e6f0138b9d3a70b090382d

SHA512
664be1ee7297104e15b86769e1c11706d4198833e354cf6aa49de702a748f6bdebf92e83db97d717b935c3ac7baae60054659d75344f1e26fe453019497a5732

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\6562DA596159EB1B2950D153B925F60042F3C758

Filesize
71KB

MD5
eba83e8826fd6860e7cb70d9fec76a71

SHA1
a769f3cdba613053d415117f16e0a1334efec83a

SHA256
d7545ac830dc18b4fdbfe9768cbe080e22c3b13f67cb03848b3d9dca3db9f8c2

SHA512
95e20c4aa0d8906ee4a945c6b8d7659322b5048f988cd6881574906870d049ab96ff9961c883f13bf94cf264d94c38dcd9b80697bb2c97df8b61656ec00a5db4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\73EAA0767ECF1BFF6C0396D2598362046273B2CE

Filesize
30KB

MD5
e8d451d2c05c25132b8c7a3258395de9

SHA1
d7b28ac4a80e79f6cf31ee4ef0a19e296a3fa0c0

SHA256
53f13176ff7ceab9a60153e81382037b14c97093e9a4e767c8d2b259eff477b7

SHA512
95dfabe91672c350f4cd69d6e18f72380d6890e4e324c956d07864b705d4af6672c2e1145a8d1cf40544e518165aab90195083e2fd19ae93979d17fdf754976a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\75FFB2861273903EFA00FDA5858803308E462C58

Filesize
1.5MB

MD5
387bbcf7fbaa68ed1049e585629b7956

SHA1
270a701afe586e0313bb4093a398c813c684dae7

SHA256
f25caaed6c76febeb50f3f4c662af5f019146a68529ed1465bc2ccf6d534c9b5

SHA512
649ffdeb038f2ac83be583c7630aff61ac2a21d6f21e240ec3b61b42e678ce4e09b83a00165035b931295388cef01e70a80e21ce9f50cdf527a830f71179527f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\7666B2CBF25732113681A8482DF62584B90EC93B

Filesize
48KB

MD5
b60d47669627fcdeaecb4914e6a54732

SHA1
e3f36f50a13729cb6cbf34e17c6c0c8a8c21026e

SHA256
fcfc685661d1b1b8a40ac5822eb86eae797c8d92f9c9f02211ec1837c23ccabe

SHA512
7feebf77bcb6cfd0eed415956e286f122c99c25fc6a2fba3d1ebe37ae1b6e67af60893e200b8d0f384e783dd6bf8758028a3bb79d70cd2fac04136b5112aec2f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\7A78C7658D1D35B39F7BF510D3475E43926EA081

Filesize
415KB

MD5
176606b165840875bbb2ac7341d53dd1

SHA1
9cdd898df3111970cacefea85d70c8a3554e177d

SHA256
5a600050e68efc2e016a1f25896c12d1b92dc9a52e7acb45bcc1738b33d0fc72

SHA512
11770f35e2145c781fa43b126423691edfe15cd9139ed3a391a616fd2a855132c537a4fc17d5ed07febf09e8acc3cb3ed3bb4f13339b125fa990eb197d180f5a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\7F3A484677000408482D1D455B325DCF594B645F

Filesize
848KB

MD5
99e88d8dea4279e31e3fb95493b10e2d

SHA1
b8291eda978871ff603f40e31597ac1c4949c90c

SHA256
5ab199bedd6bc92419b6cbd89475b1dd372780af4f658070eee4a3ae7b39a0e8

SHA512
138f69d9405f84d79c17cff469a481631bab2480478e70b36cd68cde4922474fb9c1be4c0cb42af44d2ece2b64df8d465184959a202c4f0b720bcd4852808d00

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\8048F9094051A9BF5ADE74D58C9BF33666D8B433

Filesize
54KB

MD5
40954159103820be452c5103b9fc3380

SHA1
b98e6d2545fa89bebb17ef4b69c319999f0f0a7b

SHA256
fe8d33c701c0e4c57f368253e9a443f377c0c49b815b8239f00013b83a17052b

SHA512
4776fc4adb2cc26780069911390387ff304051214487925076c1f0cb314a61d195e2c11eebc4d491e246803e824b8fb8981e0bd97ebb1de98604365d2cc1c39a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\851783008654FCA03BEA58F2D7D727BCC8293156

Filesize
58KB

MD5
49255455a55b9a231cf7edf1c3fdf537

SHA1
8996f32c6094db86a783d5bb4e28e5f7f4160090

SHA256
b7e14c02e37c988840a649ca9074b6a2368797b8199ae5d3c325b604181ed0b7

SHA512
44a41317f5d2f50d4ad3880f97a1d64fb0e8ce85c900bdc010df568a32cea3612a4b320920d6b0bf472ce3c3dc3439f853c5fcb07a6209e722f9575ee284f74c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\859DFEC5E8E73C65E5187D3324FC1BAAE71297FD

Filesize
23KB

MD5
c5d6d767ce626831d13cd93e52abd4c2

SHA1
c31d416ddb310faf512249f3bab2bc1236a0bffc

SHA256
121170284b680c9b268d8099c5e5b768081439805d6a986b194e4a1c7fb24623

SHA512
8a72260235055122d3af51120683d93023301f24be536c66bdc0dc0a46c51dd8319e42aed496011e8fd0f8533f96a5932bde0ffe8c77a6d26660a7affa5aba03

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\887ADB71D0BFE428C74644D287855807A60E5005

Filesize
416KB

MD5
874150babdf0440dd9d62cadbf95d778

SHA1
77c814ee41bb585525029cf6a92b23fc4a0a1620

SHA256
9c2c68087a0a667f8ccd68373373262a695ee5d2ea4305c8858c68c6333e1855

SHA512
62d9cf395e40778da597b2951d38d82b598909979a9218fa35b816aa22b22607aacd97bb9c54510181db02562d6f84a54e1dc3ca5458c4ebd5b822583d6c9ce7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\8C78F722A1DC1B3F9C386F44623F7B02EAA33CC9

Filesize
2.6MB

MD5
fff8e55f86db1d4a6e8970f6e77a9235

SHA1
3c42756877f4e56d6dc0ce0df06323a87629c650

SHA256
a126c05f26563e7ee82e27cc6c0fbbc5235049a5bacd9702cd942d1197589753

SHA512
7e10a25649e9fdd2792019b56c3a9b74dad701dc19627634dbd5dff2ee41d0057989edcf16aa744e8ad5f882ec57c39fdf72416d5f98efb097e1da96b77f78c5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\8F552D2F1676DEE34E94C522364E35945B961EDC

Filesize
1.1MB

MD5
43a69f16f99e9f15c896ba48d6f2602b

SHA1
aeb50c4b8fa7c581ca6ffb0873ff192e8861fd03

SHA256
73ffa3fbbc59feba9a5d41cc370aa7d6c0e2bb3bc0b194c2a192993b4572397b

SHA512
9a8912e3dcd00b0c0fab8bdfa6fc15d0e6310b5b24ecba70fc7f2c08a4344b83534c73817e57530717d6d73f7a32985a2d7d6e0ee39f7bdd75f8827a20726eb7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\992F689C39C2A6DDB6CBE5743D0CFFBE1E524A1C

Filesize
64KB

MD5
830cb9b547dd0b45bd76e4dd4b96d1d2

SHA1
1434ce9cff5144a3ff3089d8eb9594a5ae1ce6ce

SHA256
7e79e6ff8aeb6964c861390c3a1827ff05a449eafa22f78554283b759da89e9c

SHA512
07630a833225595c284e53ef814fe9c62419402c0b71a0cc90b72271fecd65b442616b674b299f39e49cf845ab61097fcee417e0903b3f7fa1485327b263ba06

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\9CAEFC368E358F95F747EC87AF0224F3C41A490F

Filesize
19KB

MD5
ba0bc7000ebf8b78e00d3b5a0eb4aaab

SHA1
6ca5d83c01129f344aa3e4046c386209ee976628

SHA256
f4a12c6cbf433acc5cb8f5d9fca7f0ddd35e684a0fadbacc14e95dcbb8cdc295

SHA512
7aa7e7771534921c461b144b9d6b32ea2f9b10f9c93ce14990c8acb3612bf7358bc933085953b039afb267a982ba4d96f1518a2fedd0b6631564fde86beaadb2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\9D79DA052032BD1AF9C4882163351BE91C1B7FDD

Filesize
3.9MB

MD5
f26d61a0cd5800f4fe028a46ae82f7df

SHA1
755560359ff3d4b2523821b224099e6203a3b8fe

SHA256
c4ebf063cca40b86c69e2cd6f19a209e2fd3320557209ebff3a7187feb44cbdd

SHA512
bfb833ed49322323913042440f547fccfb23453829073d93929aea6bad6a2247622c528f2d6716560fbf9e26a6c0cc65aaed74838b742bfd6b81b686fdfaf631

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\A5BF9F1187650D5824FA3BAEBC5AC6323D92BC6B

Filesize
209KB

MD5
bcfcdd514f454ef7315fa9802ab6bff7

SHA1
78039ba2c0a1ac83d5fa654e077f366f15313900

SHA256
0db4b93cdd08434b5b813fcc98fb3e30a0dc6ff525f5e983b3dcc0f460217715

SHA512
8f37bfe60f2d05aa981759d1d796436dead61a5de825d8e052c93f78e58f178c15b774182168e3812043e552543be56ec762faf06f32c6504b1f2d7fc212dc6c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\AC3933CD6406CB7DCECADA484B1E7A874093E682

Filesize
26KB

MD5
652b85d0bb9d36fe54b3b88ff9c4c3a9

SHA1
74ea9bd66e1edf753a9dae7b68d31aaf171c7c2c

SHA256
635d3959ef1239782dbbdcb62d796fbca989ec8acb1a3afb585187e35da11fe3

SHA512
5f566813c1ee70e36c5c980a84d6961c8c37feafd1a391136eeed457bf2577612728eb9c29cecf09701fe9de17f10ef5e699af9e7a011e10853d4ea57877ae17

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\BA30A8866A8313A16394DA2599448520494928BB

Filesize
30KB

MD5
5056a0ba542a697b33f156685603170c

SHA1
5e240221b3a0ab6fcc3a0d9b5ccdfd7e0a57b331

SHA256
82da40f0d4737f4452255f67749ee4892f4a5d78774fa15abf0940e4939df557

SHA512
60b12d6c01857e474ec600d8e9b9381a317e98f2a196191b4190f02df58280fff171dbc8af6c982bed44b9c5da0c6d8cebd44c6399e38f8f3342b3391a980cc2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\BA8A48E44F01990E1470A2B661339739C411FB27

Filesize
21KB

MD5
6a7e11641c9ecef893f6f04a2c75888e

SHA1
cd585966c676eeef5e677109baaffb20e93fdc7b

SHA256
0fd4fd27dbb99ce9d477daa9e8fcfdc6c9c0722082d54c6cb52d899d0909321c

SHA512
5fb496c8debf1adfa106bc6e3de61b5e0890c80f7c142af6de148e4c747ef4dfb66ae34137b01317a3cc628cd9871283e027ea81c14b306c8b9b3d70395680b2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\C02983ADC988C2AC89B4BE109620C0FEC1A381C8

Filesize
72KB

MD5
e30e313fa07294c33f9f0b12c35ef634

SHA1
d7efd06671728b698686617d7a04dbbf39c8cb9f

SHA256
f149d1524914e1a1b1c4b558f04a77d0fd15efc6551b96514ab9ef948a0e411e

SHA512
13461d05e10c68e5273866068401cdaeeddaeecf07e4e6e574487bc928eed710a73e18398d586bb0c8a62c4a93fbc2da5bcb29e4087ca0b9bf1cdf68c823e69e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\C269F936701FABF62A6BE4CC8C25BDB4BC297D31

Filesize
251KB

MD5
cd10a51726d37d3c88eacd1ef2006e25

SHA1
869b48e6e872aaf182bf919262d5940748117ce7

SHA256
68b4b70c5a916cc5c59fc14adcfbdc4066e3db60d2d5569ab6506db8db08652b

SHA512
1ca0a53b444258542c413ae0e183812d8a429c4ec10240f50a527deb1a54ea20225743003082c2cd49083cef869d7f3f18fe72d86c5415b9179d71ee963936df

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\C7F27F1B728D8DB7CFCCA0B5822E7997A8F337CE

Filesize
57KB

MD5
c3d2d2928cf88da5c31f129ca62a3128

SHA1
a0f4c3c9f898f25af648b24ff57d7ab33f820d4c

SHA256
d8b8b22466c49c443ce242c9894941e250a349268fffc37a33855b0d82481f4e

SHA512
6dcca2721dbe16417f3bafc40cea2642986e421b591d5227ef323a6a785e1d0896a8c0501324388c2542eb9b9246f425ff76f3543547d0a65e64e390df5912b7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\CA853AA64AC019E75A6E0465BBD76241D3901473

Filesize
59KB

MD5
a5640877909e3208ea12f4e97d1fc523

SHA1
0eb643ca3f319bb870dab64e3137287b16d4f4fd

SHA256
01eb72313d462b33d9aec19046d5803d16bdf19beb9c94e32d7fa4b4465d0ce4

SHA512
0e597f76ca12ca9b6bc819b4f7ca12ddfef7bd310130397ecef52fb48eb4ef7e067a8fe5f7ffbb1593a798a183fe583eda4305dbc7f71c6864b4829ef1691d8a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\D947845403205EA7F2B4DF066D1698C80C704952

Filesize
190KB

MD5
4c64f375b6c2dabf98bda992f0f418c2

SHA1
2a0fda5f29508a7d520667d47fdd658980ff9abd

SHA256
78ee6aadbefa0dc9c4e516e4f3c13c0d9aa3bfdd26e08a81d3e1c44d604c7328

SHA512
4d4d8fc2e26e73a9b451472d5f6279ab595bafd3005ab603325183a9cf21a556ead80c61ddcd97a4778b0d6ab5470c67e21759bd3f6002527f26815ed8c7eee3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\F4A59BC60C0DE4CF799FF2FF7BFAE72F73F40A5B

Filesize
490KB

MD5
0dea2f6b67a69b34de6040565e3fa989

SHA1
bab964cc4b0ac92a01fcce19062262513884ef2a

SHA256
df3cc13f299b3a7dd57503ee26144f4c3603d00ee9f5aecb6ba73c3e5e9b649b

SHA512
cecd3f1ed6ec112008336c559dcac620fa8accb3a5f12a6b1237357cf89d81716ba340bbd295774b261320619d05bf932b3e155062d61f2b4eb766d8eafb246a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\F8B82472EDA03B67CBD6127712BF7FA650F4C099

Filesize
103KB

MD5
3d921362d2252375125431b06c7f195c

SHA1
6d8c90fd26b84afa69ff2d1f3271f155b3b7593e

SHA256
cfc366c34e5115e2c4c073802a75eed5bf72b76c4b6211f469ea1931bae376aa

SHA512
7369f0f9e273b85e7b25710d734b913ed9892e14284e8ca655d7d888efd206091010565de8783163cba8526992dbdee57517ab0faa23e67bfe811cc6925964ee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\FA36AC6472C9E16E9C08F1F31C7C38800A0F54A5

Filesize
21KB

MD5
bcd20394d55372d7777f3fe2d259c5be

SHA1
4d5c207ae28a7fdf7aaa5d850124176f97ef94a5

SHA256
a2aed6d015b79e5ec285370fd96cb0e46c4caa1153aebfd94dcf13fe81f6e37c

SHA512
b13607e8d825e414e484e891d6472284c210895de8b84563bc4b27a2beebfb9e65299f6ba520ca069ca3df0786870f3b6db7b33fe89c7fe63fda8d9074c8d6d9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\FF25F81B25FFA53FD57E3032734EA56F6D0AB513

Filesize
79KB

MD5
7448fbf22ae7596f8d549a28fa9b7de0

SHA1
6869aa607b98651613cc12087b0455754ab7bb35

SHA256
6cc5f031c3da450f0ee844cd3c44132c472ef647c15cf62b597a5adde54e702d

SHA512
b947c315137404a72867a4da71dd7a34fe6487a9c1bcf577cfdf286be451d5d7feccb175898d18e074fbe48b19da5ec5378f8cdb58c58a3b038221b00df46bf5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\jumpListCache\h6twZoXqDr4Lzuu5qpxSGxu3Car7ZNll+_If__YmCr8=.ico

Filesize
965B

MD5
c9da4495de6ef7289e392f902404b4c8

SHA1
aa002e5d746c3ba0366cd90337a038fc01c987c9

SHA256
13ec8c9e113de6737a59d45ea5a99f345d6cba07f9a820bb2297121b8094790f

SHA512
bb72f0cc815e7b4c44959808b153aad28dbced8d97e50f83ef90229d19ea1c4b3fffff650bf49efe562451fcae0325cdbdffc1a5c4ec5d2c7c70ae9d1a0d8a16

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
18KB

MD5
1d86bba13e877064e4d8f4d1821614e5

SHA1
8dd2363a1fb6f120cbc3cd734f0229c332c50abb

SHA256
f24c3842e38e84d7601326e4a5f5161cee8f3de1aba47d2c28df7f95adc03764

SHA512
9dfbe0333a1d22675436d6004920b3d250dd1cd448f710a559df1eb943740f3fd4028c501a4b458aff63c8d03e86d8550b8178c47f395bed2ffefd09d02b2596

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
9589ce87ca91c3a0c444836d93a30089

SHA1
8ba445f154d09cd8281adc2d49bebf66fa760d7e

SHA256
eddc1bb7440261523f24aade3e01c3efed57ae55c40df694f0ab97366f29a425

SHA512
010b5edd12b3f08d6eda8388404d3d167457fcb8dd4ad4d8de7e2df2b4a3aa16dbd9ab394ecf01d467d03a3d0b40c4b9d08d61ac8fde89a873690cb44e0cf5d6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\AlternateServices.bin

Filesize
11KB

MD5
6ec2110c58cabd9120448394b9627448

SHA1
3d03e3bba589ece56f52a08d718f0468ddbb18a7

SHA256
f461aa1de69e2aff2751aff657ec0cd0a4a830549f83b147edf252a08424a070

SHA512
c01467b96ebbe2a0b3fdf7dd938e9634ed1e365d498dec9ffdf25d9541b64586358de7729c7c8847e3493647a0b21a4c8dd994a28c5347588ae701d55f46c466

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cert9.db

Filesize
224KB

MD5
46291b4a8e72438d8423452994a76988

SHA1
afc1c2507b9fdf76ae9ce1cf3196435702ccedc8

SHA256
bb7db06818ea03bafd8b6f71dc56e3e7645dacdaee87df6ad1c58c6c42eb54bd

SHA512
2018345cf896edd2cd0ea09c31336c1c3ec903f5796c647aea2b62e8a0650bff8a3812a3837956420b8cbd109fa27adba6e4159cdbc6b1207967e6cad0a03f2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
8c4ad546a7be9f9f744edb0a0ab1080d

SHA1
53f6763b9be7bb58b0ff324dcba0189362895972

SHA256
bf9f6fb80db834039a95eb4e93d5b2570dd4577878164383113720846d5c5868

SHA512
4be991fb51076c7eda58372e37e0bcbcb220871d5dd169833a6e2f4d70fd0aa66c5e800a4b863011fe1eace2d6c681e450adee2fbffa7afe0974b814ff6427d0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
b9e19f945a375a2aec66f42c641b7a59

SHA1
6f6e270e00b8acd8350415c53d0d0cf3ae09e6a2

SHA256
1d223cb4b2e9bfc0e75930b8d6740d6191f0befbbed1eb444ad3b3888ff2f894

SHA512
d4a9700ff73285b7ba08e0e07a11fab879ecb26355565cc450991baf8c241af7e5581e9d95fd9a1a5d2841b5241d8cb5c9cf6eda9dca01b84647a9d9bd923995

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
336f57c3f334a333f430ffe5e8452152

SHA1
2b0d5c8b5e7cf2fe1bc712ef94a6608657b4dd97

SHA256
095761b9566b7227ea5d9116ddf78a01f785ec6c4bb23ecc55849ab233039bd0

SHA512
9ccd61f1c0a70b5ffe437497e20a0ca3ecb751f41adf91c2b8c51a89524eb57f9329f3ae7e80a1b2e7af463593695a29eebb1ffc294e531f2f3e8668b1f7d644

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
ed47e119cc3507a9a0c0a53845aa5ce9

SHA1
c0ef47f14a5a24d4459bbf54c241b8f390d20cf6

SHA256
48e953f32dba0189b7b64fa0bac470d00e5c22b026519d64178b2537271eea2c

SHA512
55f0aaa4c72c56099fa8e41f5181756d4af49603dd5f0e7e24eb418a00ed5d78e7b293d5ce210568777f2caf997906a1bb2ee5cf0e86c9904660ae937cea0811

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\events\events

Filesize
4KB

MD5
833af2453d738cbc882ba3853d8a0a2c

SHA1
aed5f05d7faef7fdd1d85d2a53d188916f3e7d07

SHA256
ab5b66f77c5d3c9cd230b0452d5d3bf8d424ae05103e2b376dbd204b6fbedf96

SHA512
6c5fa0dd056d14d66e05ff8ee257a2c347d59b0954c997e888427dc7579c97d19f3e015d84633f2c9975769608dac3a1f9b430acdc1e0ae17c5a79e8c0d6e20a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\events\pageload

Filesize
5KB

MD5
dff21b175aee8b2b1d536c4ecbfca04d

SHA1
c4333216bdbe83fc41cf9db820298192f7a6b44d

SHA256
3095f10a0263cd86a990ea1ca9ccc38fdf29e987f49ca2946c537f1483017ddd

SHA512
faeada9769b199778d183913aac8378b6470a904e3c52286ffd9c88e8d2ce8a92aba90d60b8c8d8032c3d8a0d3d6bc2a167d4ed552fa4f97a3e346d0b7508c59

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\pending_pings\0861a1e3-035b-4f5d-b69a-02137c334280

Filesize
27KB

MD5
aa9bca536b2b422f7b85a937fd7ebc67

SHA1
fc9627291be9f839b85f24fdd085260f8cd80272

SHA256
eb78b43503b74e564d60affe2c5f3a3328abcdcfd3027e0146cc004ef7a99d2c

SHA512
fc07a0c7dc44a1c1f2ca4117dc5a2457847498e607e5812b60784bc595c46446ca7c6355bfc04f383256ce784331a4f90fc4bf453f14246a9b0c2b993b5ca813

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\pending_pings\496b78ef-515f-412b-83e4-da2c9b9cbef2

Filesize
982B

MD5
a52c2a05eee10a5aae7b9df9c00ebcff

SHA1
95fedf1c2a7e3a928fc0c557812e85fcec4c6f38

SHA256
aced03b91d2255baafde5908603f2493e8c1f1561a3e9b745a506d25a5ac6c05

SHA512
31a7a486f4082921581c337d5aaa3307893779ec9f662ca697525a14f643aa9b814339934945e2bb1576890aef92b27e9bb57f25defedb5f6931293fa81d0d86

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\pending_pings\69fdcb30-e08d-41c2-af4e-9f0a29cc7d7a

Filesize
10KB

MD5
30e63a928f15f1bc04736c7ebeef924b

SHA1
e81b22b201be49691d693705d0bc9900fe0ccaa3

SHA256
6fdabe6b1d210b0601069b1b90ed4cb9bc9ed5c345fd545dd37bc3a9013c0316

SHA512
bba7150e70c8b8797315e0bd483c5eca0b49ba788682bec12bda7b17388d15debd748905a3e4beb251480522373fe4d2d57e2b95217dd03dc72241dd71f28709

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\pending_pings\933d367d-868b-413f-880c-5aba5f2f4606

Filesize
847B

MD5
b203cda190d7cd77389cfb8129d4ab29

SHA1
29f5e198a31698fbff6ca3eec7d96f5cf87c1730

SHA256
7e82fe46275b7a21a2bbd76bd86bd3b8d1c8f86a7e627e7e95b5513cd8a1df25

SHA512
a8ac570f3ab08d8b16c2033293c491ba7e39993e730644af81d945d22f97de134c326d41462b533da262c11eafe5643ccd9118a86a28250a717450313e59a0af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\pending_pings\a26f875d-27c1-4d91-a248-c2312acc5bd4

Filesize
671B

MD5
ce0069cee759d4ad90a85963c5527f55

SHA1
d03718a35d4e8614483330f741dc4522c62dc481

SHA256
319de8b8b00b2fe8c6005fbf1ce2a9f41df127b634ec6d8f503b0febbe654994

SHA512
59155f91aa2e18a22784eeadb2b90a329cb860b05487898e8526339cb87877acac24a47e23ac09b2c0897f795fcf766748040a7ebbc1bd9f15f1003f500ab931

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\gmp-widevinecdm\4.10.2710.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\prefs.js

Filesize
10KB

MD5
363e5a9c373b4d6efac95ef938f6d78e

SHA1
56c08dee1585583e98c89d597d999e3edef65891

SHA256
350133150d0f0d534ae1cb08cb662c11897d6fbf6f37c3b5fd6343ace513b33c

SHA512
97ac92c3adff321f5bf538f51f3016856423593eb2c8ceb8d9a5c31c0649fa5fb3ea71b9585af035c8ac70f787a50353bf52107ca165a4d01e870d0e0f8913f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\prefs.js

Filesize
12KB

MD5
be07b0e5431f36cceea08eeb0fffbd34

SHA1
20c3a2d6df5ca7c360385dd3787ac96f9f4c20ed

SHA256
d9ef3e2c76f528a0a44cec7a6671cd775a845b58878fd018208d37b1e8e53183

SHA512
1ff97501f790db8f1340ae28650dbfb7520f465b714316471764a67fa0d691cb1989acd65d40af1663fd166f20f11487ec7e29b434aed7347ddb762994855512

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\prefs.js

Filesize
10KB

MD5
cb28e1d7c382f715100b5faeff6ef261

SHA1
6b6103344e65bde37716d67618bf54264aa39e25

SHA256
7c9af9d342842729fc4f0003174a0a33062ff272d19c7c253ff7290e4639dadf

SHA512
8fdd86924f566500e6cd06de21be318f4fe26160fd3cd0e314aad441329c9037d684ddfde3f116b7f5360a3f804992caf4cd0e560eb401a314ba38c1b1f7360e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\prefs.js

Filesize
11KB

MD5
f678935727eaf8294f046d3609c532f7

SHA1
1f8afda98db3107f04dc42565be6ee795eaf7263

SHA256
300f53f7598036e47b931c944564137a136a889aeed8b0c28ede9199db9ec41b

SHA512
44a1956fd55753e06531bac5325597afb2ca28144873fcf9a8c3ff141b5964fd9635cee13f345129c9e97ab5a1ac05b82229f178bef7ac8fd3ddf9d9a8847a0e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionCheckpoints.json.tmp

Filesize
288B

MD5
362985746d24dbb2b166089f30cd1bb7

SHA1
6520fc33381879a120165ede6a0f8aadf9013d3b

SHA256
b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e

SHA512
0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
14KB

MD5
68d393bad75ebc73b8d0494e6ca5e9b4

SHA1
ff0560ab49537d1eb7fb4daa242c8b01999be9fd

SHA256
484363635d03e8dc874ccd35d3e7990159d33c4b563c037a1e0725b2e06eccf1

SHA512
4dd8931a1448c6b21089cc390f8e03e99db6df9ab7a90c4324901cb458203d5724c19abe980656051a6843e670e5fbde505505a74d64659cdf0a1c9c1f72330c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
77f155f41c53723d5f2ba7d4845e73bb

SHA1
8f274956ea0819f9df5e54d70b015fba006ffc37

SHA256
39f2d16437ea9334a4ed363b727191653a1558ac4f37e750d7c6c0ea306ae4fe

SHA512
06bffad060cfa8b153ae44e519e183ea4a520aeb0aa71a5f76996efced7b3a7ee73f0dd6862f462a2ea6c4661f926f660776a8cf1846b263f4a46845397ea8da

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
41KB

MD5
b6d23817c05252d6e21c90697fc5b2a2

SHA1
31a8d6c18dac68615037a30d2073ab09ca7a83d9

SHA256
ca1de7e5b526292492df76254d0c9701e4c7c8040b55250ae888d61f55d90876

SHA512
08009d2851588f06fd2b4bba8be5e38891639a123610100c37fbfbbe80b8dcb36922f5dce1e6e6069e913e1db8ee71d4ff020cea4b490803b27c5ebbd782ee0e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
11KB

MD5
8e6f444ee5d092ac61a63d4af9ef08cf

SHA1
2090c42447749589cc645e947f79f0b3bfc6d19d

SHA256
6f1b2e36b429b87254b5f847c568f3d8521632e359fb61c0923c29d0e1f6133b

SHA512
45576a1ea2c19e971937c7729829a6d3bfa2c9bdf6a59a3c6a03709e8792e473ffaa71d86bf9426d462eb24462136ed55b3392b809e38580bbef2ad84e50fa80

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
bd116e1189dda874ecbd04032ac6997d

SHA1
8f7bae7c49405d46a8781cc1c7a27d4803c535d1

SHA256
4b7b035c13968ab2038083db0ae8d46e36580646619140e394dc765324ce3868

SHA512
09938b02f7358d39450ff48dce5f0a3d90b6e67ef43ac9931f0e12adcb255008b97e15314b2b709216e01dc7c290be6586fc03f6ed300ac77cc5f26b57c60ddd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
18KB

MD5
3ef70e1c6abb539c118847b217b06772

SHA1
55fffe82fecb897a8fb80da99f61a1ef3a50fa35

SHA256
efb557d950b224f59760781e10b3060e248bee68107a76445bff97acfd4e1725

SHA512
56fd328ebe25613313a7279d936ef20db15d07e646c259bd64762e04d7fa49316d93df244b8896df2768d9e66ff6cb5e3862c104e2c2fbfbc50280a93ac3360a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
17KB

MD5
b38f9e9e5f122016606d54cace2824e9

SHA1
aecab025e9bdd526ee9d6c7c84e531a142634e8e

SHA256
45f581175ca52627b9b8b7bffa390bd280d2b2bab36a2065f328ce370199dd8f

SHA512
95aa808b2c149c1016680ff6f9848215d34409ab8559d4e17dbc49a0aa6cef7cd079c3ca5c52e27280a849b934c5fd7997c9bda86007e762ec543ca047f5564f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
17KB

MD5
b27c09cf4d9ddcb962b797361147b5d2

SHA1
fa19a4436efd1d7f47c49d95d6c007f8e84f71cc

SHA256
dc0b28cfe1d6705dc3057ad112546bc6b997d496f446d823ebed875455244ae3

SHA512
c2637463fe7f45e401f01472506061b191fbca6a4d46eace0f54e3c13f00d9f13a05468e7b2c0545b0ddc217101a0680dd03017535d13a13e89dcf7125242367

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
6946fa2b24995786d5aba26a0502b509

SHA1
e5396220c1bc6f57e7c324daab558599ce460d98

SHA256
512bacb680231df189cbe5dc32da10f8521070df51ae9ba86adaaaba107de97f

SHA512
56b49121ae46d48f305463f1021ed4fc0b04a618fd90a9092c64c032e5a716513e30e00af1225bf0781000bc95a272452d0c34c4da7d057eddd628529e13d1e8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
721fd1f00e96ed014429eb53349b0f02

SHA1
c88c85758811c5d514efa2d068de7228640bfc61

SHA256
405e351317903691b4f065e7ec577a37fecff7c34747c37d2ec62ece3fcd4dcf

SHA512
0ecd0053a9412665c1e7de165430a96588ccd0180835a9172ae149bd5ab9dfe975867e71434f5f4c1c3f1589a1b10401f5343a0abc58d34f70227c787292471f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
7KB

MD5
ca6b7c8c6117cbb99ad25a1b68720ea3

SHA1
bf3a2463aa562ae82bc41f14ffcb61c996ca8ae2

SHA256
d9c8546dacbd19db14b386caa012749d9aee39aacd0168b06aa667ff0e0fd007

SHA512
493bc7d4d798b3c52a643bb0e26d249eeb0e47549ca50cbf3bd6bbe87d735ff550a71c92cb07c4370d8761fdc0b6755ae902364d277b75a3d3aebacc6b72f24a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
5397f6667bdbf34ec2bc36eb480eea65

SHA1
c33d91f910bf7805c72d1e486a6bc1b0656265d1

SHA256
9a65c14c3a14706103b0ea7ee92f5063382670a7849036cdee08806934f262a7

SHA512
92fc8fbb18378f5b2523b6d429f22290aa034699b29d8f53486b5cdcee0fe2011f13a30ecaae23112d3af71e40b9067fe418c133caa400c60c2b56197dbb7acc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
17KB

MD5
b306245892d248591b94b815d0704bce

SHA1
3c854a7cc0e8e0d6778a3b3c4686b10a5886fc81

SHA256
0047fed3ea718d574dfee4cd751567d06adff2ef6fada5b0f272bde0a6c74239

SHA512
b1351bbf0dea53b3f1b4875c58a984a20f1054864a1abc067d715953df72088a22b053cec13317ff02be3d031a6188569889156b5969e61e7acf8306989fcac5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
18KB

MD5
ba678ddd18364eed1dddd786cc965019

SHA1
ef550e11cdff26871bd9936208f69e5603f7d015

SHA256
1ed6d0f92f495b4b8374c546b73ec862d219069c53fb914fae12be6bcfaf939c

SHA512
6df2f6b8672d4824eb144dc0bdaae98f5348f929a06af615cd12660432ae72a2fdb5751bf85a5a8064a87b5317d4f75a30920235dda392f78ae6fa1e74c7804b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
17KB

MD5
904f6d2b77b2a763592e977802464962

SHA1
66e13101455bb715da9a33199c03113451281f8c

SHA256
b2a82528b05e4973d153fb2cb225181fa46ce8304613347d8b20b81fed7b3422

SHA512
3342fbfa767f88df1281b9dcb8ed4a7416054b98928bd6773a46e043629c2f2bcf4a611c61ce578af8b5a54bccd9652d2859ac597ea07a4f450d19fbc40d4be0

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
b1db0b31bebbbaf6ab591a4bb9899469

SHA1
892bb2168ca3318f448db3a68817d59bc3ec9273

SHA256
f2326346c31f59122f09c5019e06bbe434a7103a19d3a7411cccd3d9af19dc54

SHA512
09247344125b3538aca0634f47d8f287297fbb4d543d93f5fb6bea3d4ae89723fbbecd64a3301f4a56a083f5d5615c0d4783644a9aed79654cfd83dbc35c8466

Download Submit
C:\Users\Admin\Downloads\202041734721574.bat

Filesize
322B

MD5
c719f3a51e489e5c9fbb334ecbb45ede

SHA1
5b5585065dd339e1e46f9243d3fe3cb511dc5ce6

SHA256
c67348cacc707decd859789c8ed1e8afdb6eb8753d3941d0ee9ecba2f00500b7

SHA512
b2b0ea3a3701b5d689a5cbcc5c16721cf807304ca02375f33c5b507c1a00655917354e32f6e2b96c081125751498484c974c2d3eaa754d6074c9d55aec8c0164

Download Submit
C:\Users\Admin\Downloads\@[email protected]

Filesize
933B

MD5
7e6b6da7c61fcb66f3f30166871def5b

SHA1
00f699cf9bbc0308f6e101283eca15a7c566d4f9

SHA256
4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e

SHA512
e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3

Download Submit
C:\Users\Admin\Downloads\@[email protected]

Filesize
585B

MD5
433e85ab41dd5da41637804a8ec258ac

SHA1
ca929b3e2ebd1e474ddaeeebea222408d71a7ec0

SHA256
e94b01d284f9ed690c459d92169bf22b3707cd54a4f16be8af52ad2f17d9977b

SHA512
5fdbfddab134c773225652d157fafa98425b976fd4bde2ecaab5213d175de3178839de93c58a0a86eeff599e6710e2f4c29cb4de8537cbef262897a5cfbcf04f

Download Submit
C:\Users\Admin\Downloads\NoEscape.PYYqayWf.exe.zip.part

Filesize
13.5MB

MD5
660708319a500f1865fa9d2fadfa712d

SHA1
b2ae3aef17095ab26410e0f1792a379a4a2966f8

SHA256
542c2e1064be8cd8393602f63b793e9d34eb81b1090a3c80623777f17fa25c6c

SHA512
18f10a71dc0af70494554b400bdf09d43e1cb7e93f9c1e7470ee4c76cd46cb4fbf990354bbbd3b89c9b9bda38ad44868e1087fd75a7692ad889b14e7e1a20517

Download Submit
C:\Users\Admin\Downloads\TaskData\Tor\SSLEAY32.dll

Filesize
694KB

MD5
a12c2040f6fddd34e7acb42f18dd6bdc

SHA1
d7db49f1a9870a4f52e1f31812938fdea89e9444

SHA256
bd70ba598316980833f78b05f7eeaef3e0f811a7c64196bf80901d155cb647c1

SHA512
fbe0970bcdfaa23af624daad9917a030d8f0b10d38d3e9c7808a9fbc02912ee9daed293dbdea87aa90dc74470bc9b89cb6f2fe002393ecda7b565307ffb7ec00

Download Submit
C:\Users\Admin\Downloads\TaskData\Tor\libeay32.dll

Filesize
3.0MB

MD5
6ed47014c3bb259874d673fb3eaedc85

SHA1
c9b29ba7e8a97729c46143cc59332d7a7e9c1ad8

SHA256
58be53d5012b3f45c1ca6f4897bece4773efbe1ccbf0be460061c183ee14ca19

SHA512
3bc462d21bc762f6eec3d23bb57e2baf532807ab8b46fab1fe38a841e5fde81ed446e5305a78ad0d513d85419e6ec8c4b54985da1d6b198acb793230aeecd93e

Download Submit
C:\Users\Admin\Downloads\TaskData\Tor\libevent-2-0-5.dll

Filesize
702KB

MD5
90f50a285efa5dd9c7fddce786bdef25

SHA1
54213da21542e11d656bb65db724105afe8be688

SHA256
77a250e81fdaf9a075b1244a9434c30bf449012c9b647b265fa81a7b0db2513f

SHA512
746422be51031cfa44dd9a6f3569306c34bbe8abf9d2bd1df139d9c938d0cba095c0e05222fd08c8b6deaebef5d3f87569b08fb3261a2d123d983517fb9f43ae

Download Submit
C:\Users\Admin\Downloads\TaskData\Tor\libgcc_s_sjlj-1.dll

Filesize
510KB

MD5
73d4823075762ee2837950726baa2af9

SHA1
ebce3532ed94ad1df43696632ab8cf8da8b9e221

SHA256
9aeccf88253d4557a90793e22414868053caaab325842c0d7acb0365e88cd53b

SHA512
8f4a65bd35ed69f331769aaf7505f76dd3c64f3fa05cf01d83431ec93a7b1331f3c818ac7008e65b6f1278d7e365ed5940c8c6b8502e77595e112f1faca558b5

Download Submit
C:\Users\Admin\Downloads\TaskData\Tor\libssp-0.dll

Filesize
90KB

MD5
78581e243e2b41b17452da8d0b5b2a48

SHA1
eaefb59c31cf07e60a98af48c5348759586a61bb

SHA256
f28caebe9bc6aa5a72635acb4f0e24500494e306d8e8b2279e7930981281683f

SHA512
332098113ce3f75cb20dc6e09f0d7ba03f13f5e26512d9f3bee3042c51fbb01a5e4426c5e9a5308f7f805b084efc94c28fc9426ce73ab8dfee16ab39b3efe02a

Download Submit
C:\Users\Admin\Downloads\TaskData\Tor\taskhsvc.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\Downloads\TaskData\Tor\zlib1.dll

Filesize
105KB

MD5
fb072e9f69afdb57179f59b512f828a4

SHA1
fe71b70173e46ee4e3796db9139f77dc32d2f846

SHA256
66d653397cbb2dbb397eb8421218e2c126b359a3b0decc0f31e297df099e1383

SHA512
9d157fece0dc18afe30097d9c4178ae147cc9d465a6f1d35778e1bff1efca4734dd096e95d35faea32da8d8b4560382338ba9c6c40f29047f1cc0954b27c64f8

Download Submit
C:\Users\Admin\Downloads\WannaCry.EXE

Filesize
3.4MB

MD5
84c82835a5d21bbcf75a61706d8ab549

SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

Download Submit
C:\Users\Admin\Downloads\b.wnry

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\Downloads\c.wnry

Filesize
780B

MD5
93f33b83f1f263e2419006d6026e7bc1

SHA1
1a4b36c56430a56af2e0ecabd754bf00067ce488

SHA256
ef0ed0b717d1b956eb6c42ba1f4fd2283cf7c8416bed0afd1e8805ee0502f2b4

SHA512
45bdd1a9a3118ee4d3469ee65a7a8fdb0f9315ca417821db058028ffb0ed145209f975232a9e64aba1c02b9664c854232221eb041d09231c330ae510f638afac

Download Submit
C:\Users\Admin\Downloads\m.vbs

Filesize
201B

MD5
b067df716aac6db38d973d4ad1337b29

SHA1
541edd1ca3047ca46fef38bd810e5f0f938b8ae2

SHA256
3f7ded679522e917f30aacbfb7c688ef477d7886e722731c812dc486195e220f

SHA512
0cbc1b820abf13e225e7a7636ce1e336d758fa54a9ee6aa09dee7a9748a2cf890f45ba55a7a188b69972b396bac37ddb9a98ba202ff2e203b34a75e515c0759c

Download Submit
C:\Users\Admin\Downloads\msg\m_bulgarian.wnry

Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\Downloads\msg\m_chinese (simplified).wnry

Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\Downloads\msg\m_chinese (traditional).wnry

Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\Downloads\msg\m_croatian.wnry

Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\Downloads\msg\m_czech.wnry

Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\Downloads\msg\m_danish.wnry

Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\Downloads\msg\m_dutch.wnry

Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\Downloads\msg\m_english.wnry

Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\Downloads\msg\m_filipino.wnry

Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\Downloads\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Downloads\msg\m_french.wnry

Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\Downloads\msg\m_german.wnry

Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\Downloads\msg\m_greek.wnry

Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\Downloads\msg\m_indonesian.wnry

Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\Downloads\msg\m_italian.wnry

Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\Downloads\msg\m_japanese.wnry

Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\Downloads\msg\m_korean.wnry

Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Users\Admin\Downloads\msg\m_latvian.wnry

Filesize
40KB

MD5
c33afb4ecc04ee1bcc6975bea49abe40

SHA1
fbea4f170507cde02b839527ef50b7ec74b4821f

SHA256
a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

SHA512
0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

Download Submit
C:\Users\Admin\Downloads\msg\m_norwegian.wnry

Filesize
36KB

MD5
ff70cc7c00951084175d12128ce02399

SHA1
75ad3b1ad4fb14813882d88e952208c648f1fd18

SHA256
cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

SHA512
f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

Download Submit
C:\Users\Admin\Downloads\msg\m_polish.wnry

Filesize
38KB

MD5
e79d7f2833a9c2e2553c7fe04a1b63f4

SHA1
3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

SHA256
519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

SHA512
e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

Download Submit
C:\Users\Admin\Downloads\msg\m_portuguese.wnry

Filesize
37KB

MD5
fa948f7d8dfb21ceddd6794f2d56b44f

SHA1
ca915fbe020caa88dd776d89632d7866f660fc7a

SHA256
bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

SHA512
0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

Download Submit
C:\Users\Admin\Downloads\msg\m_romanian.wnry

Filesize
50KB

MD5
313e0ececd24f4fa1504118a11bc7986

SHA1
e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

SHA256
70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

SHA512
c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

Download Submit
C:\Users\Admin\Downloads\msg\m_russian.wnry

Filesize
46KB

MD5
452615db2336d60af7e2057481e4cab5

SHA1
442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

SHA256
02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

SHA512
7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

Download Submit
C:\Users\Admin\Downloads\msg\m_slovak.wnry

Filesize
40KB

MD5
c911aba4ab1da6c28cf86338ab2ab6cc

SHA1
fee0fd58b8efe76077620d8abc7500dbfef7c5b0

SHA256
e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

SHA512
3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

Download Submit
C:\Users\Admin\Downloads\msg\m_spanish.wnry

Filesize
36KB

MD5
8d61648d34cba8ae9d1e2a219019add1

SHA1
2091e42fc17a0cc2f235650f7aad87abf8ba22c2

SHA256
72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

SHA512
68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

Download Submit
C:\Users\Admin\Downloads\msg\m_swedish.wnry

Filesize
37KB

MD5
c7a19984eb9f37198652eaf2fd1ee25c

SHA1
06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae

SHA256
146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4

SHA512
43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

Download Submit
C:\Users\Admin\Downloads\msg\m_turkish.wnry

Filesize
41KB

MD5
531ba6b1a5460fc9446946f91cc8c94b

SHA1
cc56978681bd546fd82d87926b5d9905c92a5803

SHA256
6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415

SHA512
ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

Download Submit
C:\Users\Admin\Downloads\msg\m_vietnamese.wnry

Filesize
91KB

MD5
8419be28a0dcec3f55823620922b00fa

SHA1
2e4791f9cdfca8abf345d606f313d22b36c46b92

SHA256
1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8

SHA512
8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

Download Submit
C:\Users\Admin\Downloads\r.wnry

Filesize
864B

MD5
3e0020fc529b1c2a061016dd2469ba96

SHA1
c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade

SHA256
402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c

SHA512
5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

Download Submit
C:\Users\Admin\Downloads\s.wnry

Filesize
2.9MB

MD5
ad4c9de7c8c40813f200ba1c2fa33083

SHA1
d1af27518d455d432b62d73c6a1497d032f6120e

SHA256
e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b

SHA512
115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617

Download Submit
C:\Users\Admin\Downloads\t.wnry

Filesize
64KB

MD5
5dcaac857e695a65f5c3ef1441a73a8f

SHA1
7b10aaeee05e7a1efb43d9f837e9356ad55c07dd

SHA256
97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6

SHA512
06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2

Download Submit
C:\Users\Admin\Downloads\taskdl.exe

Filesize
20KB

MD5
4fef5e34143e646dbf9907c4374276f5

SHA1
47a9ad4125b6bd7c55e4e7da251e23f089407b8f

SHA256
4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79

SHA512
4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5

Download Submit
C:\Users\Admin\Downloads\taskse.exe

Filesize
20KB

MD5
8495400f199ac77853c53b5a3f278f3e

SHA1
be5d6279874da315e3080b06083757aad9b32c23

SHA256
2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d

SHA512
0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4

Download Submit
C:\Users\Admin\Downloads\u.wnry

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Public\Desktop\⚙⁈⁄⊎ୁ⊬ᖠᨢフ⵾ݑ⛴❤Უᔣ⪳݁⏃ᢡᶞ⿾ᕓۮ⨑ୗ౩ᷦ

Filesize
666B

MD5
e49f0a8effa6380b4518a8064f6d240b

SHA1
ba62ffe370e186b7f980922067ac68613521bd51

SHA256
8dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13

SHA512
de6281a43a97702dd749a1b24f4c65bed49a2e2963cabeeb2a309031ab601f5ec488f48059c03ec3001363d085e8d2f0f046501edf19fafe7508d27e596117d4

Download Submit
memory/1252-3867-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download
memory/1252-4042-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download
memory/3792-11-0x0000025564530000-0x0000025564531000-memory.dmp

Filesize
4KB

Download
memory/3792-2-0x0000025565E20000-0x0000025566090000-memory.dmp

Filesize
2.4MB

Download
memory/3792-12-0x0000025565E20000-0x0000025566090000-memory.dmp

Filesize
2.4MB

Download
memory/3812-1971-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/5040-3230-0x00000000737F0000-0x0000000073872000-memory.dmp

Filesize
520KB

Download
memory/5040-3396-0x00000000003E0000-0x00000000006DE000-memory.dmp

Filesize
3.0MB

Download
memory/5040-3397-0x00000000738A0000-0x0000000073ABC000-memory.dmp

Filesize
2.1MB

Download
memory/5040-3415-0x00000000738A0000-0x0000000073ABC000-memory.dmp

Filesize
2.1MB

Download
memory/5040-3414-0x00000000003E0000-0x00000000006DE000-memory.dmp

Filesize
3.0MB

Download
memory/5040-3382-0x00000000003E0000-0x00000000006DE000-memory.dmp

Filesize
3.0MB

Download
memory/5040-3242-0x00000000738A0000-0x0000000073ABC000-memory.dmp

Filesize
2.1MB

Download
memory/5040-3536-0x00000000003E0000-0x00000000006DE000-memory.dmp

Filesize
3.0MB

Download
memory/5040-3537-0x00000000738A0000-0x0000000073ABC000-memory.dmp

Filesize
2.1MB

Download
memory/5040-3243-0x0000000073880000-0x000000007389C000-memory.dmp

Filesize
112KB

Download
memory/5040-3241-0x00000000003E0000-0x00000000006DE000-memory.dmp

Filesize
3.0MB

Download
memory/5040-3789-0x00000000003E0000-0x00000000006DE000-memory.dmp

Filesize
3.0MB

Download
memory/5040-3790-0x00000000738A0000-0x0000000073ABC000-memory.dmp

Filesize
2.1MB

Download
memory/5040-3244-0x00000000737F0000-0x0000000073872000-memory.dmp

Filesize
520KB

Download
memory/5040-3247-0x00000000736B0000-0x0000000073727000-memory.dmp

Filesize
476KB

Download
memory/5040-3836-0x00000000003E0000-0x00000000006DE000-memory.dmp

Filesize
3.0MB

Download
memory/5040-3837-0x00000000738A0000-0x0000000073ABC000-memory.dmp

Filesize
2.1MB

Download
memory/5040-3246-0x0000000073730000-0x0000000073752000-memory.dmp

Filesize
136KB

Download
memory/5040-3245-0x0000000073760000-0x00000000737E2000-memory.dmp

Filesize
520KB

Download
memory/5040-3860-0x00000000003E0000-0x00000000006DE000-memory.dmp

Filesize
3.0MB

Download
memory/5040-3861-0x00000000738A0000-0x0000000073ABC000-memory.dmp

Filesize
2.1MB

Download
memory/5040-3228-0x0000000073760000-0x00000000737E2000-memory.dmp

Filesize
520KB

Download
memory/5040-3229-0x00000000738A0000-0x0000000073ABC000-memory.dmp

Filesize
2.1MB

Download
memory/5040-3232-0x00000000003E0000-0x00000000006DE000-memory.dmp

Filesize
3.0MB

Download
memory/5040-3231-0x0000000073730000-0x0000000073752000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads