jigsaw | da4cc1b53a91259c68033e08d90e4bbef47df7ae48369a6b86e1f2de4d753932

Resubmissions

09/03/2025, 09:08

250309-k31m2szkx5 1

09/03/2025, 08:57

250309-kw35lazsgv 10

09/03/2025, 08:35

250309-khevvazjx3 10

09/03/2025, 08:28

250309-kc7cxazjv3 8

Analysis

max time kernel
1796s
max time network
1789s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2025, 08:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

218KB
MD5

3f06b47847759782317c7542e1b2c761
SHA1

71880ad118b1e577fcc6839a6906b739dfe03c23
SHA256

da4cc1b53a91259c68033e08d90e4bbef47df7ae48369a6b86e1f2de4d753932
SHA512

6d68c779d7cb118a19917d083538fecdbdf29d8886cb8eb31436e2bf6cb1ce76de35ca496cbebc80505ee34e818a6bbed223e7540079c42553b3962c33f568eb
SSDEEP

1536:34Edd0E6RJNvZO+uzA+QmMJUDmidraCOljmFSwP6AhUdcC/cl2h7ZBog3B:HbDmU5yPKg3B

Score

10^/10

jigsaw wannacry defense_evasion discovery execution impact persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Signatures

Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
ransomware jigsaw
Jigsaw family
jigsaw

Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 5300 created 1328	5300	taskmgr.exe	132
PID 5300 created 1328	5300	taskmgr.exe	132

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (3709) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD8D8A.tmp	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD8D83.tmp	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

Executes dropped EXE 64 IoCs

pid	Process
1328	drpbx.exe
5924	taskdl.exe
3996	@[email protected]
4392	@[email protected]
1616	taskhsvc.exe
5336	taskdl.exe
5480	taskse.exe
2968	@[email protected]
4224	taskdl.exe
3500	taskse.exe
5956	@[email protected]
4056	taskse.exe
1240	@[email protected]
1252	taskdl.exe
6004	taskse.exe
552	@[email protected]
3172	taskdl.exe
1276	taskse.exe
5012	@[email protected]
3200	taskdl.exe
5980	taskse.exe
5480	@[email protected]
1060	taskdl.exe
5728	taskse.exe
804	@[email protected]
6024	taskdl.exe
900	taskse.exe
4220	@[email protected]
5620	taskdl.exe
5752	taskse.exe
3128	@[email protected]
1532	taskdl.exe
4880	taskse.exe
3628	@[email protected]
1192	taskdl.exe
5856	taskse.exe
5280	@[email protected]
1324	taskdl.exe
3616	taskse.exe
4752	@[email protected]
4980	taskdl.exe
5464	taskse.exe
60	@[email protected]
5324	taskdl.exe
3284	taskse.exe
4384	@[email protected]
3988	taskdl.exe
3908	taskse.exe
5204	@[email protected]
5984	taskdl.exe
3180	taskse.exe
5980	@[email protected]
4752	taskdl.exe
908	taskse.exe
1740	@[email protected]
4880	taskdl.exe
3196	taskse.exe
2028	@[email protected]
2932	taskdl.exe
2296	taskse.exe
1672	@[email protected]
4728	taskdl.exe
2696	taskse.exe
4228	@[email protected]

Loads dropped DLL 7 IoCs

pid	Process
1616	taskhsvc.exe
1616	taskhsvc.exe
1616	taskhsvc.exe
1616	taskhsvc.exe
1616	taskhsvc.exe
1616	taskhsvc.exe
1616	taskhsvc.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2696	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iwmggcrir063 = "\"C:\\Users\\Admin\\Downloads\\Ransomware.WannaCry\\tasksche.exe\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe"	jigsaw.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	drpbx.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	drpbx.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
194	raw.githubusercontent.com
350	raw.githubusercontent.com
373	raw.githubusercontent.com
189	camo.githubusercontent.com
190	camo.githubusercontent.com
193	camo.githubusercontent.com
195	raw.githubusercontent.com
196	raw.githubusercontent.com
197	raw.githubusercontent.com
191	camo.githubusercontent.com
192	camo.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ja-jp\ui-strings.js.fun	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\dot_2x.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sv-se\ui-strings.js.fun	drpbx.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr.jar.fun	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\osfFPA\addins.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_altform-unplated_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-16_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_ellipses_selected.svg	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ro-ro\ui-strings.js.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-64_altform-unplated.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-200_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-36.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\8px.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\LogoBeta.png	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\WideTile.scale-200.png	drpbx.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity-dark.png.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hu-hu\ui-strings.js	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\ui-strings.js.fun	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sk-sk\ui-strings.js.fun	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\selector.js.fun	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\AppStore_icon.svg.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\logo.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxWideTile.scale-200.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-400_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-200_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-36_altform-unplated.png	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\close-2.svg.fun	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\ui-strings.js.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\StopwatchMedTile.contrast-white_scale-200.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_targetsize-40.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FetchingMail.scale-400.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MediumTile.scale-125_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubAppList.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\FetchingMail.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-100_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe81b.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SplashScreen.scale-100_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\MedTile.scale-100.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\MedTile.scale-100.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\ui-strings.js	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\ui-strings.js.fun	drpbx.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionSmallTile.scale-150.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\ui-strings.js	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_scale-200.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\README_en_US.txt	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fill-sign.png.fun	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fi-fi\ui-strings.js.fun	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\pt-br\ui-strings.js.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-100.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerLargeTile.contrast-white_scale-100.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-60.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-200.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_altform-unplated_contrast-white.png	drpbx.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	drpbx.exe
File created	C:\Windows\assembly\Desktop.ini	drpbx.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	drpbx.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6fd7697efc137faf2d3ad5d63ffe4743db70f905a71dbed76207beeeb04732f2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\Local Settings	OpenWith.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4596	reg.exe

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\EarthKrahang_20240404.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Ransomware.Jigsaw.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Dino.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Ransomware.WannaCry.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
4488	NOTEPAD.EXE
1176	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3996	msedge.exe
3996	msedge.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
5192	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
60	OpenWith.exe
3064	OpenWith.exe
5400	OpenWith.exe
2968	@[email protected]

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3684	firefox.exe
Token: SeDebugPrivilege	3684	firefox.exe
Token: SeDebugPrivilege	3684	firefox.exe
Token: SeDebugPrivilege	3684	firefox.exe
Token: SeDebugPrivilege	3684	firefox.exe
Token: SeDebugPrivilege	3684	firefox.exe
Token: SeDebugPrivilege	3684	firefox.exe
Token: SeDebugPrivilege	3684	firefox.exe
Token: SeDebugPrivilege	3684	firefox.exe
Token: SeDebugPrivilege	3684	firefox.exe
Token: SeDebugPrivilege	5300	taskmgr.exe
Token: SeSystemProfilePrivilege	5300	taskmgr.exe
Token: SeCreateGlobalPrivilege	5300	taskmgr.exe
Token: 33	5300	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5300	taskmgr.exe
Token: SeDebugPrivilege	3504	taskmgr.exe
Token: SeSystemProfilePrivilege	3504	taskmgr.exe
Token: SeCreateGlobalPrivilege	3504	taskmgr.exe
Token: 33	3504	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3504	taskmgr.exe
Token: SeDebugPrivilege	3684	firefox.exe
Token: SeDebugPrivilege	3684	firefox.exe
Token: SeDebugPrivilege	3684	firefox.exe
Token: SeDebugPrivilege	3684	firefox.exe
Token: SeDebugPrivilege	5192	powershell.exe
Token: SeDebugPrivilege	3684	firefox.exe
Token: SeDebugPrivilege	3684	firefox.exe
Token: SeDebugPrivilege	3684	firefox.exe
Token: SeIncreaseQuotaPrivilege	4052	WMIC.exe
Token: SeSecurityPrivilege	4052	WMIC.exe
Token: SeTakeOwnershipPrivilege	4052	WMIC.exe
Token: SeLoadDriverPrivilege	4052	WMIC.exe
Token: SeSystemProfilePrivilege	4052	WMIC.exe
Token: SeSystemtimePrivilege	4052	WMIC.exe
Token: SeProfSingleProcessPrivilege	4052	WMIC.exe
Token: SeIncBasePriorityPrivilege	4052	WMIC.exe
Token: SeCreatePagefilePrivilege	4052	WMIC.exe
Token: SeBackupPrivilege	4052	WMIC.exe
Token: SeRestorePrivilege	4052	WMIC.exe
Token: SeShutdownPrivilege	4052	WMIC.exe
Token: SeDebugPrivilege	4052	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4052	WMIC.exe
Token: SeRemoteShutdownPrivilege	4052	WMIC.exe
Token: SeUndockPrivilege	4052	WMIC.exe
Token: SeManageVolumePrivilege	4052	WMIC.exe
Token: 33	4052	WMIC.exe
Token: 34	4052	WMIC.exe
Token: 35	4052	WMIC.exe
Token: 36	4052	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4052	WMIC.exe
Token: SeSecurityPrivilege	4052	WMIC.exe
Token: SeTakeOwnershipPrivilege	4052	WMIC.exe
Token: SeLoadDriverPrivilege	4052	WMIC.exe
Token: SeSystemProfilePrivilege	4052	WMIC.exe
Token: SeSystemtimePrivilege	4052	WMIC.exe
Token: SeProfSingleProcessPrivilege	4052	WMIC.exe
Token: SeIncBasePriorityPrivilege	4052	WMIC.exe
Token: SeCreatePagefilePrivilege	4052	WMIC.exe
Token: SeBackupPrivilege	4052	WMIC.exe
Token: SeRestorePrivilege	4052	WMIC.exe
Token: SeShutdownPrivilege	4052	WMIC.exe
Token: SeDebugPrivilege	4052	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4052	WMIC.exe
Token: SeRemoteShutdownPrivilege	4052	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
1328	drpbx.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
5632	OpenWith.exe
5632	OpenWith.exe
5632	OpenWith.exe
5632	OpenWith.exe
5632	OpenWith.exe
5632	OpenWith.exe
5632	OpenWith.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
3064	OpenWith.exe
3064	OpenWith.exe
3064	OpenWith.exe
3064	OpenWith.exe
3064	OpenWith.exe
3064	OpenWith.exe
3064	OpenWith.exe
3064	OpenWith.exe
3064	OpenWith.exe
3064	OpenWith.exe
3064	OpenWith.exe
3064	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 3684	3808	firefox.exe	86
PID 3808 wrote to memory of 3684	3808	firefox.exe	86
PID 3808 wrote to memory of 3684	3808	firefox.exe	86
PID 3808 wrote to memory of 3684	3808	firefox.exe	86
PID 3808 wrote to memory of 3684	3808	firefox.exe	86
PID 3808 wrote to memory of 3684	3808	firefox.exe	86
PID 3808 wrote to memory of 3684	3808	firefox.exe	86
PID 3808 wrote to memory of 3684	3808	firefox.exe	86
PID 3808 wrote to memory of 3684	3808	firefox.exe	86
PID 3808 wrote to memory of 3684	3808	firefox.exe	86
PID 3808 wrote to memory of 3684	3808	firefox.exe	86
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 3840	3684	firefox.exe	87
PID 3684 wrote to memory of 1736	3684	firefox.exe	88
PID 3684 wrote to memory of 1736	3684	firefox.exe	88
PID 3684 wrote to memory of 1736	3684	firefox.exe	88
PID 3684 wrote to memory of 1736	3684	firefox.exe	88
PID 3684 wrote to memory of 1736	3684	firefox.exe	88
PID 3684 wrote to memory of 1736	3684	firefox.exe	88
PID 3684 wrote to memory of 1736	3684	firefox.exe	88
PID 3684 wrote to memory of 1736	3684	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3472	attrib.exe
2508	attrib.exe

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\sample.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\sample.html
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1960 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 27096 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {99791da8-7573-48f8-a480-d71524f28ab8} 3684 "\\.\pipe\gecko-crash-server-pipe.3684" gpu
    3⤵
    PID:3840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2404 -parentBuildID 20240401114208 -prefsHandle 2380 -prefMapHandle 2376 -prefsLen 28016 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55ad507f-dd01-4d29-a48d-0c49f25776fd} 3684 "\\.\pipe\gecko-crash-server-pipe.3684" socket
    3⤵
    PID:1736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3320 -childID 1 -isForBrowser -prefsHandle 3324 -prefMapHandle 1472 -prefsLen 28157 -prefMapSize 244628 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2d7822c-e605-4fcd-8d23-50fe96fd05ad} 3684 "\\.\pipe\gecko-crash-server-pipe.3684" tab
    3⤵
    PID:1300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3552 -childID 2 -isForBrowser -prefsHandle 3632 -prefMapHandle 3628 -prefsLen 32506 -prefMapSize 244628 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {789edde1-054e-492a-a034-b2659b4b3d0e} 3684 "\\.\pipe\gecko-crash-server-pipe.3684" tab
    3⤵
    PID:4112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4468 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4524 -prefMapHandle 4440 -prefsLen 32506 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5aad99e1-f8c8-4d2d-8053-79c2327ecd2b} 3684 "\\.\pipe\gecko-crash-server-pipe.3684" utility
    3⤵
    - Checks processor information in registry
    PID:4860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5344 -childID 3 -isForBrowser -prefsHandle 5332 -prefMapHandle 4632 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a473fdb-c93d-4f0e-b0a6-301e43d8e1e9} 3684 "\\.\pipe\gecko-crash-server-pipe.3684" tab
    3⤵
    PID:4516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5360 -childID 4 -isForBrowser -prefsHandle 5504 -prefMapHandle 5512 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee355414-d1aa-4788-a841-e011f859bbad} 3684 "\\.\pipe\gecko-crash-server-pipe.3684" tab
    3⤵
    PID:4644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5768 -childID 5 -isForBrowser -prefsHandle 5760 -prefMapHandle 5756 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf15cde6-cdec-40a6-a32d-e6fa5500a459} 3684 "\\.\pipe\gecko-crash-server-pipe.3684" tab
    3⤵
    PID:2668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5688 -childID 6 -isForBrowser -prefsHandle 6068 -prefMapHandle 6064 -prefsLen 32637 -prefMapSize 244628 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e45ca2c-6f28-4dd9-9a2c-bdda040fab9c} 3684 "\\.\pipe\gecko-crash-server-pipe.3684" tab
    3⤵
    PID:3700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5300 -childID 7 -isForBrowser -prefsHandle 6328 -prefMapHandle 6316 -prefsLen 27162 -prefMapSize 244628 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f2c525e-aa53-4997-9706-8a249fe59e5a} 3684 "\\.\pipe\gecko-crash-server-pipe.3684" tab
    3⤵
    PID:5888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6708 -childID 8 -isForBrowser -prefsHandle 6720 -prefMapHandle 6716 -prefsLen 27162 -prefMapSize 244628 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {25f80679-eac8-4225-a17a-757d5a5c9890} 3684 "\\.\pipe\gecko-crash-server-pipe.3684" tab
    3⤵
    PID:5796

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2992

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5632

C:\Users\Admin\Downloads\Ransomware.Jigsaw\jigsaw.exe
"C:\Users\Admin\Downloads\Ransomware.Jigsaw\jigsaw.exe"
1⤵
- Adds Run key to start application
PID:64
- C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
  "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\Downloads\Ransomware.Jigsaw\jigsaw.exe
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of FindShellTrayWindow
  PID:1328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault9b6c778bh641ah4895h85aeh517847927b14
1⤵
PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff962e746f8,0x7ff962e74708,0x7ff962e74718
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,13995796653624445798,13197518212939668252,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,13995796653624445798,13197518212939668252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1956,13995796653624445798,13197518212939668252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:3332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2588

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5300

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\44413177b1b84d5c86c8403bb5033a6d /t 216 /p 1328
1⤵
PID:1920

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3504

C:\Users\Admin\Downloads\EarthKrahang_20240404\Win32.EarthKrahang_20240404\6fd7697efc137faf2d3ad5d63ffe4743db70f905a71dbed76207beeeb04732f2.exe
"C:\Users\Admin\Downloads\EarthKrahang_20240404\Win32.EarthKrahang_20240404\6fd7697efc137faf2d3ad5d63ffe4743db70f905a71dbed76207beeeb04732f2.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:6060

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:60
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Dino\dino.bin
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4488

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3064

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5192

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:5400

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Modifies registry class
PID:5004

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
PID:4836

C:\Users\Admin\Downloads\Ransomware.WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
"C:\Users\Admin\Downloads\Ransomware.WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
PID:3236
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:3472
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:2696
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 95261741510477.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1464
- - C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    3⤵
    PID:384
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - Views/modifies file attributes
  PID:2508
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected] co
  2⤵
  - Executes dropped EXE
  PID:3996
- - C:\Users\Admin\Downloads\Ransomware.WannaCry\TaskData\Tor\taskhsvc.exe
    TaskData\Tor\taskhsvc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4956
- - C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
    @[email protected] vs
    3⤵
    - Executes dropped EXE
    PID:4392
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      PID:5592
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4052
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5336
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5480
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "iwmggcrir063" /t REG_SZ /d "\"C:\Users\Admin\Downloads\Ransomware.WannaCry\tasksche.exe\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4756
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "iwmggcrir063" /t REG_SZ /d "\"C:\Users\Admin\Downloads\Ransomware.WannaCry\tasksche.exe\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4596
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4224
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3500
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  PID:5956
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4056
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1252
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6004
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:552
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3172
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1276
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5012
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3200
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5980
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5480
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5728
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:804
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:6024
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5620
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5752
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3128
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1532
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4880
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1192
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:5856
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5280
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1324
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4752
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5464
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5324
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3284
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4384
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3988
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5204
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5984
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3180
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5980
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4752
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:908
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1740
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4880
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3196
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2028
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2932
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2296
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1672
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4728
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2696
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4228
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:116
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5144
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5700
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1480
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  PID:3176
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3296
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  PID:4760
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4060
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1780
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1968

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
1⤵
- Opens file in notepad (likely ransom note)
PID:1176

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.fun

Filesize
720B

MD5
75a585c1b60bd6c75d496d3b042738d5

SHA1
02c310d7bf79b32a43acd367d031b6a88c7e95ed

SHA256
5ebbfc6df60e21044486a5df3cb47ccdcd7a4d5f197804555715ffd9bf6c5834

SHA512
663a302e651b9167f4c4e6ae30028307b4d8da0dda3a0e5fd414104951d50419862fc9396c5b39fe5c4b696efd3efbf0b575688983b1d341f3ef38becf500505

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png.fun

Filesize
7KB

MD5
72269cd78515bde3812a44fa4c1c028c

SHA1
87cada599a01acf0a43692f07a58f62f5d90d22c

SHA256
7c78b3da50c1135a9e1ecace9aea4ea7ac8622d2a87b952fc917c81010c953f7

SHA512
3834b7a8866e8656bbdbf711fc400956e9b7a14e192758f26ccf31d8f6ab8e34f7b1983c1845dc84e45ff70555e423d54a475f6a668511d3bcbdd1d460eeb4b0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_ie8.gif.fun

Filesize
7KB

MD5
eda4add7a17cc3d53920dd85d5987a5f

SHA1
863dcc28a16e16f66f607790807299b4578e6319

SHA256
97f6348eaa48800e603d11fa22c62e10682ad919e7af2b2e59d6bd53937618f2

SHA512
d59fa9648dc7cb76a5163014f91b6d65d33aaa86fc9d9c73bf147943a3254b4c4f77f06b2e95bb8f94246a982ea466eb33dac9573dd62f40953fd23de1c1b498

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_retina.png.fun

Filesize
15KB

MD5
7dbb12df8a1a7faae12a7df93b48a7aa

SHA1
07800ce598bee0825598ad6f5513e2ba60d56645

SHA256
aecde4eb94a19095495d76ef3189a9abd45bcfd41acbed7705d22b4c7d00aa77

SHA512
96e454ebb4c96573e8edc6822290c22d425f4c7f7adbab35e6dc4b3ce04a5916ae9254c2c312c98299835ecbf3c5aa95da2939b8408ac25fbae44ba87a3795dc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons.png.fun

Filesize
8KB

MD5
82a2e835674d50f1a9388aaf1b935002

SHA1
e09d0577da42a15ec1b71a887ff3e48cfbfeff1a

SHA256
904372666ca3c40f92b20317d92ca531678958affbc34591401e338146fe0ecb

SHA512
b10a8e384d0bd088443a5085f5c22a296f6f4d295a053d4526690ba65846e887daec47d01cf18fdf1160db98061a8b7c4040de56e6e604451a821fadccf32698

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons_retina.png.fun

Filesize
17KB

MD5
150c9a9ed69b12d54ada958fcdbb1d8a

SHA1
804c540a51a8d14c6019d3886ece68f32f1631d5

SHA256
2dee41184747742fbdc527b2023d67fecec1ccdfdf258439a06cd75d4fd33f43

SHA512
70193ee6f0919eb14311f43b5a5da041deacb568db55fc43290ee76e17af902ac468435b37a150630ea3b7871c724073915ae5dcba3c301ac42f2d68dd598e2f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.fun

Filesize
448B

MD5
880833ad1399589728c877f0ebf9dce0

SHA1
0a98c8a78b48c4b1b4165a2c6b612084d9d26dce

SHA256
7a27d891097df183fbf0031e3894bdac0ce77aef15d666ddd9f6a04e9836fb27

SHA512
0ddf247892a72a390437390d535debf6e41d12e51b31eb4f0353b710ec380c5fbc531a48e76935088063a41aca843287d3def9c1cd46be05b8dcb69f5017a464

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.fun

Filesize
624B

MD5
409a8070b50ad164eda5691adf5a2345

SHA1
e84e10471f3775d5d706a3b7e361100c9fbfaf74

SHA256
a91790b778026db625c9dedfe1c6d94b884818b33d7977e86b2f9c2f3c500796

SHA512
767a75edd37d29b3433040ce21cda849cd11ba549f27581f7edc6416c433ba7047c56908d40956422393ab0f35ede61617d4bd2aad0bde3d1ebd276584c858c7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.fun

Filesize
400B

MD5
2884524604c89632ebbf595e1d905df9

SHA1
b6053c85110b0364766e18daab579ac048b36545

SHA256
ae2facd997527426fc4def82e0db68be29b44499bfff86a28c36f7c31b177d4f

SHA512
0b506397627823a1768796129c6b37d146821471b89338b5f2d0fd3aea707fd46a8e197ee0e298ddfb3b50eef0a0b064946006346b060f733ef19cbd5d24fc90

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.fun

Filesize
560B

MD5
e092d14d26938d98728ce4698ee49bc3

SHA1
9f8ee037664b4871ec02ed6bba11a5317b9e784a

SHA256
5e8ec278a273be22199884d519a79f748801baa3a45b76e57569fdfffe96e7fb

SHA512
b2fcb5d46339cdf6b5a954f2a083cf913779e57cb6e8699bc5da1fba1c370c41117b7ddefb50075622067eb7b02a20268bc047171bd883bcda4a497c2ec64ea4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.fun

Filesize
400B

MD5
0c680b0b1e428ebc7bff87da2553d512

SHA1
f801dedfc3796d7ec52ee8ba85f26f24bbd2627c

SHA256
9433084e61062d2b709c1390e298ddaf3fb0226656662c04c0b7026a44dee750

SHA512
2d1399a6bf225b048d2b12656e941ad912636acae2dec387f92f33ac80629a1e504bca63580ba73a8ed073788f697274d5eb76ea1b089f0555fd397a8f5cbbff

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.fun

Filesize
560B

MD5
be26a499465cfbb09a281f34012eada0

SHA1
b8544b9f569724a863e85209f81cd952acdea561

SHA256
9095e9b4759e823e96984981af41b7a9915a5ecaa6be769f89c13484cef9e0f5

SHA512
28196e5de9670e9f63adcf648368bd3ea5926a03e28a13adc2fb69c567fba2f84e4f162637c487acb64eda2e30993f849806f2313820ba693c7e70303542d04f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.fun

Filesize
400B

MD5
2de4e157bf747db92c978efce8754951

SHA1
c8d31effbb9621aefac55cf3d4ecf8db5e77f53d

SHA256
341976b4fe312824d02512d74770a6df9e1c37123781655532bd9cd97ea65fa9

SHA512
3042a742c38434ae3ee4fe10f7137462cdebad5cae0f9a85fb61063d15a30e1b54ac878b1af65f699c6ca1a9d2c3e58d245e54bdebfadc460cbd060836734e11

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.fun

Filesize
560B

MD5
ad091690b979144c795c59933373ea3f

SHA1
5d9e481bc96e6f53b6ff148b0da8417f63962ada

SHA256
7805ac9d0e05d560023e5aabed960d842e4f3ec2aa3db45a9cfb541688e2edb1

SHA512
23b4c799a7b25f70962e8dd0ec7286ba7150053cab7c88f5fb1efc1095c2987bd6f3572e7fb3ee4b2238958e52a763de2c84a74615df7a6d3a19a034584fd687

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons.png.fun

Filesize
688B

MD5
65368c6dd915332ad36d061e55d02d6f

SHA1
fb4bc0862b192ad322fcb8215a33bd06c4077c6b

SHA256
6f9c7ebec5a707de439e3fd2e278fdfa07a39465d56157b70b24f091509bf76f

SHA512
8bb9a7690aeb3c0b9e14e1a6ebc5741536d354cf2324fd74ee0c3e4ef511718f7795039a94c8d2df94b6e6d0fb1762191cb649089d1def12abdf34003f0cdd0f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons2x.png.fun

Filesize
1KB

MD5
0d35b2591dc256d3575b38c748338021

SHA1
313f42a267f483e16e9dd223202c6679f243f02d

SHA256
1ca0cfc2df0354c8d886285ae5e743d9c7cc030e1afd68ac113c0f2ce43ad5fa

SHA512
f6c58c27bbde7508a866bd0e7fabadb13a4f020378cd8b8cfc0c9fa23f645d811d6cdea04b81afdf30c064c6248152e74b3e6a78ec7a3d1d19037a0db8897d7e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png.fun

Filesize
192B

MD5
b8454390c3402747f7c5e46c69bea782

SHA1
e922c30891ff05939441d839bfe8e71ad9805ec0

SHA256
76f8ed1dd50e50c7d62b804a0d6901a93e5534787d7b38467933d4c12ce98a0d

SHA512
22b26c62473e80d17c1f78df14757ccfb6c7175faa541705edc153c02baa7ab0982b5daabe8dd2c8c9efb92af81f55ccaeeecffe8ed9a0b3c26e89135ca50923

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png.fun

Filesize
704B

MD5
6e333be79ea4454e2ae4a0649edc420d

SHA1
95a545127e10daea20fd38b29dcc66029bd3b8bc

SHA256
112f72ef2bc57de697b82b731775fba3f518d1ae072120cd11b732bf4a782e36

SHA512
bed5906c7373814acc8a54c1631428a17f0aa69282920447a1575d8db826afd5dab262301dc6da610ff8bb81d24ec6babd3d9fb99fd6945f1aca9cb9c76ec2c9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png.fun

Filesize
8KB

MD5
3ae8789eb89621255cfd5708f5658dea

SHA1
6c3b530412474f62b91fd4393b636012c29217df

SHA256
7c5b1d8469e232a58359ccbcb89e619c81c20e6d2c7579e4292eb9a19849bc5a

SHA512
f6998dbae1a2fa56f962045261a11a50b8e03573d9d4cf39083da3be341cc104e0ecf5908076f03961bcdb1356d05a7450d69940ec3aaab73623a6fe180e7051

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png.fun

Filesize
19KB

MD5
b7c62677ce78fbd3fb9c047665223fea

SHA1
3218c7b6fd8be5e0a8b67d3953d37d5dbd0c71d8

SHA256
aa638be6e1107ed1f14e8430abedd6f6d0a837a31b1b63e6a7741d6d417eddc2

SHA512
9e0cc29835845f2a0260a6989c1b362bac22a8e0c2825bc18f1dde812ce7868503881d2deaf951429a80b5017b6ce31e785ff524883e08d730aa38b36a2fb074

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.fun

Filesize
832B

MD5
117d6f863b5406cd4f2ac4ceaa4ba2c6

SHA1
5cac25f217399ea050182d28b08301fd819f2b2e

SHA256
73acdc730d8a9ec8f340c724b4db96fc222bb1eaf836cec69dfe3fab8d6ac362

SHA512
e10883029c1e0fbc64bec9aac0a6957a8499af255e1790843717212077926474e02b2870c5dd04b057c956b97ad4bb1747fe73e731ea61b891f4b38dd80494d7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.fun

Filesize
1KB

MD5
433755fcc2552446eb1345dd28c924eb

SHA1
23863f5257bdc268015f31ab22434728e5982019

SHA256
d6c290e942ee665d71e288229423a1f1866842988eac01f886910b0ec383aa9b

SHA512
de83b580ce27012a7677e1da867c91e2a42dbc6b5872dcf756ace51c2862801814665ecca997171f2e550e8b9a3de19994d2516a4e5d4d57e16c7b4b823236c0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.fun

Filesize
1KB

MD5
781ed8cdd7186821383d43d770d2e357

SHA1
99638b49b4cfec881688b025467df9f6f15371e8

SHA256
a955039cd9e53674395f4b758218e4d59c89e99a0c4d2a909e49f6008b8f5dd4

SHA512
87cb9c4288586df232200f7bbacee3dee04f31c9444902dd369ad5c392d71e9837ebf8b3bb0fcb4a5db8a879cf757e97ce248939e3316c6bf3a3fe7cbe579534

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.fun

Filesize
2KB

MD5
51da980061401d9a49494b58225b2753

SHA1
3445ffbf33f012ff638c1435f0834db9858f16d3

SHA256
3fb25ddd378ab756ec9faa56f16b76691cf6d9c7405bb9a09ce542a6f5b94e44

SHA512
ecc5eb2a045ce2508d461b999f16caba6cce55aa0c00b34bd73a33e0458795f93a77caff5026212912684164057be016f51dc57ec83821c2a1f2e27417c47b2c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.fun

Filesize
2KB

MD5
2863e8df6fbbe35b81b590817dd42a04

SHA1
562824deb05e2bfe1b57cd0abd3fc7fbec141b7c

SHA256
7f1238332901b740cde70db622abcfb533fc02f71e93101340073552f4820dad

SHA512
7b2d95465ea66951ea05c341549535a0a939d26dbde365b212e3983e4047fa6912c37d737cb8054c41bb1a7d92586d968a0154c666572a70ebc59a4776897f38

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.fun

Filesize
4KB

MD5
79f6f006c95a4eb4141d6cedc7b2ebeb

SHA1
012ca3de08fb304f022f4ea9565ae465f53ab9e8

SHA256
e9847d0839d3cf1039bebdc49820ee7813d70941347ce420990592e5e3bd998e

SHA512
c143a4cf1ccfa98039b73214978722408188535ee4aa3dac08a34760b94bdf6d36ad0ff0de893da5b17fd69c96a6dfb25098ab7fec219fad1a77532113d0353e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.fun

Filesize
304B

MD5
b88e3983f77632fa21f1d11ac7e27a64

SHA1
03a2b008cc3fe914910b0250ed4d49bd6b021393

SHA256
8469b8a64e80d662eec71c50513f6d295ef4a3a9992763dbcac9d81253cef9d5

SHA512
5bf93d4f4250ca96169f3d27d4e648cc5d6e00b7558a3ef32e07edcbae36dadb8008d7ba5f83ac3ed812b72c9d52730e866191b4de7a339df57b5697e00df50d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.fun

Filesize
400B

MD5
f77086a1d20bca6ba75b8f2fef2f0247

SHA1
db7c58faaecd10e4b3473b74c1277603a75d6624

SHA256
cf10d2a22b638cf0978cf30ecaf39ecb5bb0e3ad78cd920afa433ad60cc1290d

SHA512
a77a897c0b41f4052cb9546d4cfd6e0856b288b6b8583a86d6c7e79059a05b19cc2593599251581e79107235e9d5cd589c392bf490452be04ff57e944cd19df3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.fun

Filesize
1008B

MD5
e03c9cd255f1d8d6c03b52fee7273894

SHA1
d0e9a9e6efd1746bc9ccb4eb8e7701c1cd707e2e

SHA256
22a34c8321384fc7682102e40d082e7812232a9109e4d4e8fa2152fda3f260f6

SHA512
d4bd002197b725316e1f1f2dd0a70ee44a82a53ac0dafa8c6b1166343adc406e147d0c4cca30d65a32aa545f1b327c6b69c0ec1d15330af48a6faa234dc4b5ac

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.fun

Filesize
1KB

MD5
62b1443d82968878c773a1414de23c82

SHA1
192bbf788c31bc7e6fe840c0ea113992a8d8621c

SHA256
4e96529c023168df8dde241a9acdbf4788ea65bc35605e18febff2b2071f1e24

SHA512
75c8604ea65e0cdd9ea74b4802930444dd16a945da1e7f0af4a9a3762259ee9eb41ea96973555d06f4814ee2f6b73ab662c6b314b97876e9628fa5d4536e771c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.fun

Filesize
2KB

MD5
bca915870ae4ad0d86fcaba08a10f1fa

SHA1
7531259f5edae780e684a25635292bf4b2bb1aac

SHA256
d153ed6c5ea8c2c2f1839f8dadcc730f61bd8cd86ad732bab002a258dea1d037

SHA512
03f23de6b0ae10e63c41e73308b3844d49379c55d2df75fa1dc00771b26253d832c21081d8289f04260369df996e31273b7c0788cf3b5c78a27ec909f14a283a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.fun

Filesize
848B

MD5
14145467d1e7bd96f1ffe21e0ae79199

SHA1
5db5fbd88779a088fd1c4319ff26beb284ad0ff3

SHA256
7a75b8ec8809c460301f30e1960b13c518680792e5c743ce7e9a7f691cfafc38

SHA512
762d499c54c5a25aba4357a50bb4e6b47451babeda84fa62cfbd649f8350bca55204ad002883b9147e78dda3dbabaae8da1dc94b716204226bb53326030772b7

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.fun

Filesize
32KB

MD5
829165ca0fd145de3c2c8051b321734f

SHA1
f5cc3af85ab27c3ea2c2f7cbb8295b28a76a459e

SHA256
a193ee2673e0ba5ebc5ea6e65665b8a28bd7611f06d2b0174ec2076e22d94356

SHA512
7d380cda12b342a770def9d4e9c078c97874f3a30cd9f531355e3744a8fef2308f79878ffeb12ce26953325cb6a17bc7e54237dfdc2ee72b140ec295676adbcb

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.fun

Filesize
160B

MD5
580ee0344b7da2786da6a433a1e84893

SHA1
60f8c4dd5457e9834f5402cb326b1a2d3ca0ba7e

SHA256
98b6c2ddfefc628d03ceaef9d69688674a6bc32eb707f9ed86bc8c75675c4513

SHA512
356d2cdea3321e894b5b46ad1ea24c0e3c8be8e3c454b5bd300b7340cbb454e71fc89ca09ea0785b373b483e67c2f6f6bb408e489b0de4ff82d5ed69a75613ba

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

Filesize
283KB

MD5
2773e3dc59472296cb0024ba7715a64e

SHA1
27d99fbca067f478bb91cdbcb92f13a828b00859

SHA256
3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7

SHA512
6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5131b775848795914147396d64724bbb

SHA1
3c98f2e2f0240ac6f5b534b8da3e7cba180eb2c5

SHA256
a1a373baebb3a26a3605868f13718264cb73107580f131fab643086ef0e7e322

SHA512
c59cabf562ff42a8625122fcbf03652516af7f93ebd8abee8eeadf1efabf29ecc86997d7a612aa39a999784cdd56daedf568539ec3836a10e23ecdab206e25ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
92d80ef25c58ea14c87b3b9c4a84b490

SHA1
91e73e02daf522c52666dfab54369ea0a2773947

SHA256
60f1de5caad70e7718c8e4e5378c646854896f3499bdef51eb9a6c576c423362

SHA512
59b392765838b6509654bf9a06dca0dcc2e80e3e0b1ccb85b6fcd2d8dad710899752cab432e6bf3befb3f11170b7fd80b1bd05a5675eba870fb5ddec5ca10670

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5a311c3045faab9283cdf87d3d62571f

SHA1
d115c665a1da22638bff041502974839f5070ab3

SHA256
6b43e02ee472e51c466bf5b5ecc2660005ec91a7d2b61bf0c1480bcb32f6aaaf

SHA512
8485c4ff9f16bdaca4f1d2f1c75c19ae86956f424b68d91efe7759f790d345e1f7f6a92f2a098e70cca5db3324080e22328b4a608a68d18dcadf007abd95e650

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
d7b89b4d8143f3b17d6d356b6e038d0f

SHA1
1b77acf54a713ee6b45b3bd0976aa99c14155120

SHA256
240aa95919c67a2232b02a9cd9271d3972a808a3e87fcdcb0c45ddb336d47476

SHA512
b9268b6001aeb3cc96681bee2c666e7f667edf4ec4f5fd7f93e5c188d81520b929559a42528a88e6ae56dd3008e1f8218dada9819fd0dc920cfbe8033c2928f1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v82jw7ls.default-release\activity-stream.discovery_stream.json

Filesize
22KB

MD5
eda3f944af8f740a2a0afcb1aef93e49

SHA1
2dd66011526d9d2576049fb7258b872103870f3f

SHA256
20cd411aae1177d5162260251e1004354ea021aef4fb49dba2d49ac8a9ba393b

SHA512
91fcf38adcf797b51535807489897e87d5c4d1098a771be10757d908d7f56a3993ed683fef33b57243cd1da0abdf63ccf1282becfb6991931548825b1ff97932

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v82jw7ls.default-release\cache2\doomed\14278

Filesize
17KB

MD5
384d56b8895bbf28838affd24a8dc255

SHA1
bc1179c9fc0c10b356ad6bd242cd9d3a61aa1618

SHA256
d2eb02f37ef1ea4c5c6b7cfcbc43c21216bcd10a5099a1cb0f63be531d46d0dc

SHA512
1a2f891f5208dd633c0a8341a510d194c879a25d5f3bbba0bb75061f4a5af453ac5d5a24a40dd594ad3019ac78b002747a6121b22d6e0984563aa1de59b83053

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v82jw7ls.default-release\cache2\doomed\29615

Filesize
13KB

MD5
6eb83d95d9e12820e0620d1349df48cc

SHA1
689c169bf7ba98997c3c6ec3da48fbceec65abe9

SHA256
bb5e196cb603ff5374a2da2867413df144c6835adb6877e8710908016b106aec

SHA512
407c6f5a8ecc726ba592a3fb544f21bf43fd082dc96bc06e9d3cb55f63e4f2f5cdf339259cc67f81148ff5f5ebd3cdea4602637de874c3ed8afa5915ded018a2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v82jw7ls.default-release\cache2\doomed\31625

Filesize
17KB

MD5
3e05f6f3cccbedff9d35ad3c2a2440eb

SHA1
cc9a654af32e7600acecbb8ae5586f9e2eff1c4b

SHA256
c17985933c670cdbb22b453eb33a01d4eeb342d616ea2e4a58a036864f5d9b5a

SHA512
7646bd61cdad3a301132760d748f9b731ae529b46adea79a49f68f683c3149bbc09ea71226020315d6a485f63d016da091939d4c686f88896fc449f8ed24442e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v82jw7ls.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
13KB

MD5
89c26ff03872f1830a41afb3d77e9440

SHA1
5a3b0fb997dfebef25aae7f376bf76dfdfd8861f

SHA256
cf2baf520c3c8713ab159dd38a35d39c363053a04c917d28fadfd6879ffa613a

SHA512
c8878ac8adb72193e0cf4ab6c7addb1a03d9ad4771bbc0f85bb4708de1bd54832fb8b0c73bcf4a3a80d61e6baa4b9ee15c02a327b4ae95ed2f2e22648a2bec9c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v82jw7ls.default-release\jumpListCache\rw88GZUtYZiLRsc7RRJIdsK1NnstaSJvNLkMSB9q2yA=.ico

Filesize
25KB

MD5
6b120367fa9e50d6f91f30601ee58bb3

SHA1
9a32726e2496f78ef54f91954836b31b9a0faa50

SHA256
92c62d192e956e966fd01a0c1f721d241b9b6f256b308a2be06187a7b925f9e0

SHA512
c8d55a2c10a2ef484dedded911b8f3c2f5ecb996be6f6f425c5bd4b4f53eb620a2baccd48bac1915a81da9a792971d95ff36c3f216075d93e5fd7a462ecd784f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v82jw7ls.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.fun

Filesize
8KB

MD5
f22599af9343cac74a6c5412104d748c

SHA1
e2ac4c57fa38f9d99f3d38c2f6582b4334331df5

SHA256
36537e56d60910ab6aa548e64ca4adafdcabde9d60739013993e12ba061dfd65

SHA512
5c8afc025e1d8342d93b7842dc7ef22eca61085857a80a08ba9b3f156ee3b814606bb32bc244bd525a7913e7915bdf3a86771d39577f4a1176ade04dc381c6d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1739805317.txt.fun

Filesize
16B

MD5
8ebcc5ca5ac09a09376801ecdd6f3792

SHA1
81187142b138e0245d5d0bc511f7c46c30df3e14

SHA256
619e246fc0ac11320ff9e322a979948d949494b0c18217f4d794e1b398818880

SHA512
cec50bfc6ad2f57f16da99459f40f2d424c6d5691685fa1053284f46c8c8c8a975d7bcb1f3521c4f3fbdc310cf4714e29404aa23be6021e2e267c97b090dc650

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5irx4owe.ueo.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-18467

Filesize
3.3MB

MD5
efe76bf09daba2c594d2bc173d9b5cf0

SHA1
ba5de52939cb809eae10fdbb7fac47095a9599a7

SHA256
707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a

SHA512
4a1df71925cf2eb49c38f07c6a95bea17752b025f0114c6fd81bc0841c1d1f2965b5dda1469e454b9e8207c2e0dfd3df0959e57166620ccff86eeeb5cf855029

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Filesize
36.7MB

MD5
21b766fbfd52a415b90cc99d3550fc65

SHA1
85ed0693e2be170048f39aea469abf34285648c2

SHA256
eac6760e770aeb2cdb0ba7920789d50601e3f8e9a7a3422819a51546fe433d94

SHA512
dc24345be5ee752968994a139f4a634b88b5b2bf9f09ef150d222dd298569f3d129eee8bf3faaf3d6c53309c32e3f934fe8526bb5e1de64a9cbc81dd7993f5eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
21KB

MD5
1601cd0ef37fc7d8e4566f91c87ecdd4

SHA1
0236bbf6afd4e4691aef80dcea921ad4182cf130

SHA256
cda77f0a2cf6eefb59286ca00ff9da97f8f92eb9a278fa5c2dc9eebb62dc2ea9

SHA512
b73d3e2fc9cc4ea8d9744f9023845a8c670fd1265ebfc99296eeb58a046ad3c94f9b95bfe65c09c36f991ae42258061825cca56dbc2de0b855b00fafdd656415

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
21KB

MD5
e92943c1b38b61a9527f207747f71b82

SHA1
fbf51c02744816711686f7259dad1221dc5185f3

SHA256
4a853278cf10217161637f82ceb25640c7245634dc65e1e91b4f079e9686cad0

SHA512
d6b337ff320fb736b521631f7f57dfc8e2fdda0fb9e84d49ce60445c712cffbb14dcefe4c1e98280f28dfcb94de7f65a709a18f0f330cd8496684e7316441310

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
21KB

MD5
fe9f6929cf3bd2699b618357c3424ab9

SHA1
5ef2cf5ff15671b71592585f18bc4c7a5d57418d

SHA256
f65bc6df3508aa67e986432c898fa05b3fbe6efa51ab9520fc4630ac1f9221ee

SHA512
5eb8e575a6a8617897dde1e91a2a74713afd7a53c7d172181ebbe29b6016f5dfb7139add3644f1e7d79b5b8fe37b505dc45aaadaa34fda9d7cc27e68e656f65c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
21KB

MD5
fed610460fc5cc7b890012a260a875c3

SHA1
3539a5d153828a5897d1f809dc40924f7dfac3df

SHA256
788211069a9ca60f6bce8603a2a70528c9e04642fae90efbd2c134b741872950

SHA512
7e46dc0f3e55ade0533b40123df35b10f66eec2970a2943172c452f6012c1c51452264d7ff87082bec72d61c13594458d7169f583bfed12dbe862c892dccb5c2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\91NEM5B2FYF4JL573CD3.temp

Filesize
21KB

MD5
f979a9785ce8092d6e62116f8b2b8870

SHA1
48a0259937697a236c6c0c59332ba36a96810c7a

SHA256
b1ee27520b3dbce58ad12ec27830f4848966413234f58e1a70ccfca90f6279ef

SHA512
6772509e4bb2ba02d5b02f444ad668c3ef95a405662f2daac8893d951fac26b7a728c67359d45de681914cc6e3050082fefefe7c5968ec4ad818195b873b5f9b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\AlternateServices.bin

Filesize
7KB

MD5
f342894191ea578505f6014ac8f736c4

SHA1
58c1a30163744ab648ad2444eae8e171a3ac8a4e

SHA256
b4fdc330a1d6669a42120498a199eecdf20379dc0d822d3e98cc78cf36a31fcf

SHA512
71ee634bf46bc44307476b74c3b4ad3d0ceddfa7a714cb57a112a20f1c62736dd7053d4dcb9b40e1639719e20aa820232f3a8bca22530babf6112189c35056c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\AlternateServices.bin

Filesize
10KB

MD5
db68a7240705af7b13db914b073f8e02

SHA1
18c6a5ad72c595e9489cafb7eceec8a78448e6de

SHA256
6d8f9c5e81a9c9b8d678b1c451508de4e014fde8bdb001d8a41675e1b1c63c86

SHA512
004b2cdc99ad74b43ba1d5a278984e250d4a8bc5101a64392ed210f963636cd89b6eb6bd6bb73567604323b398a197f1069fafcfe3f6f9e49f4ae95d439ebec0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\AlternateServices.bin

Filesize
20KB

MD5
2d2c07da21fbd9301f86265cdc15e342

SHA1
277f53e46cae14a19bd81d57e7a4c026b95d9e78

SHA256
0eb05d038d572e5a36c92f56eafdd1d0d7c0d4d832a85b9b413a512cfdc8b1fe

SHA512
37d3a3ed0ed88c5d84213a712455fda3e889a81869e768586d1a802f2005ee1e2673eefab4c152cfa6da2ea245a3216d8bd6029de019214a1e413babd2361941

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\bookmarkbackups\bookmarks-2025-03-09_11_5h4HaGvpPXXNwaDtVxocEQ==.jsonlz4

Filesize
1017B

MD5
f2029c72b692657a1f0ffb9ba053ba1d

SHA1
b97fb20abb575619f8b0d0fce5ae985834bea912

SHA256
342e9aa8abcef4027e21179dc41d98b026617d452121370559eb161589b218ec

SHA512
ce1fd14619e4dec74625298fb9f6297df73358e86f6084c6718e2e181af29916527a2be5ebc96636d5a843449f6f8a34d75e6449c00733ef4bfb7adfe713d8f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\cert9.db

Filesize
224KB

MD5
c5b894358fc0cd16862891b9d8cd737e

SHA1
fc658f8fcf6d77a3258326cea14408a1b02b916a

SHA256
1477167d6125fffe79ecd375632f301f67d8afbfce337ba1c7258cd47d34e7a0

SHA512
413190f359d184e497ecd33058c7edc685bf718e44488c176f1f5bbf0121b35859f3f1e992fcfc486fd208c496d29c4c877648a304e2945f5fff280c0bade371

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\datareporting\glean\db\data.safe.tmp

Filesize
74KB

MD5
424cad1ddde00682e234155fbca86d6b

SHA1
a2907b6f214dffccb5e655d61b354020ab505c4c

SHA256
1bf81c5480b3c69cb379b8e05fbd52e84d12d9d8de896d5df50239768cc2b54c

SHA512
3555ca43d996fea78a15a1878a894acdc580e58dbfe33d1aadd2197f46e66b702b151ac0c196f3f375bc21454382841da10f97f1445f23f1b7d66ad886224f36

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
b15579d5de8ae797152c5f3cc4b06265

SHA1
fa568d936e8d445a0eda82a2c8e5f67d1ab406a4

SHA256
b643f8adfa24a2148e223d65c4ccdde3dd44a74b56fd8023e1f760ad5719acc2

SHA512
69bc80c6c4466b018969b6c8ebb30bf804cf596669957c43ecd4c7c61c30e9ba6239a50ee5030e64499f234f960f024fcd2ce2a02c349841e651415dab8ab894

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\datareporting\glean\db\data.safe.tmp

Filesize
74KB

MD5
189bc48fbffabf39cedc7a209e099cb5

SHA1
91480034298a7f96e609acd793649769d0cc2339

SHA256
de1691ccb9cab3d6018ff541094ab33c7b36ea8b21e7ebfd1212d631d9479155

SHA512
d8b76c1ee192a378eafd0652438dc08b69cacc2825c19a8a033720e0710996f0c233da412b7082078ef3e23da57542d9b35dd432e5aeee8601aada49b229664a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
5a26692d64d5fde030303fffc8bb9d97

SHA1
a6dcf496b337491fbbbd48b6815e78f95dd30eea

SHA256
36722c9c8240285b9208bd498a088a916d56a82656658d9fa44486931162fd00

SHA512
f0ef0beea0e951af29b39c6d8d612905dbaf315de88e4dde7e69b4e76c4c05bb26d6d1eb1816577910e90a0eddcff4e90bcedd33d0308ce6103392dd644d20e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
827039650798dac2150601850f1c18d0

SHA1
709fa5c58639ac615eed35dbdef30f37c255843f

SHA256
da344257da717b05bb694081e304949ae7a382051dc35dbf176b83292d6017b8

SHA512
49fef67db809e33b364a380367891583a7f9f6aa48721770bb5a465f1b6171612694d76648034d9c181c3559da27f5b5b1db546732dc5368c4dafee76b8fe927

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\datareporting\glean\pending_pings\192826f9-e243-4aa1-9e87-0e099104071f

Filesize
671B

MD5
461b082a2c054affed3a779649ddbe08

SHA1
40a40318657bf58d37d6c2bb2ffd2e5eefbe2f61

SHA256
7a3016b37c503e5c07e28bfb9d53f62de7b1c0eb54e8fbc2ad08e8d22a78b887

SHA512
40d75eb4ef3812476c44c71d52887abba87f803ef7c5c7e4b35ec3a28a0942641b574a416b7cab8e7550dbe6e697cee33ea5b030691def0ad93ea7ae1999da39

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\datareporting\glean\pending_pings\3c916707-e207-493c-aca9-890121f9eb0d

Filesize
905B

MD5
22b40b7d08f529afef47753256786260

SHA1
a29e84e4180247208f40e47ce0fcb7df84aeb320

SHA256
bc9d42bb0f5016b8c50a501b5db014cd0c92836deb71c5f0951a00744610560a

SHA512
eccb57c825c45b5f6bebab0f5a29f5bdc2bd078a01bc337fb79a1578930d46034517c9309db66e8e908bedfb231f844341ba382e34a22670feee6223210a6bf9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\datareporting\glean\pending_pings\580b4cbf-3973-4c59-a5bb-4db8bec59ee6

Filesize
28KB

MD5
0d8bb0675498bf2ecd8a474faf474a85

SHA1
e57c8aaa1a79f29c5f631b4c52d14a3c9467544a

SHA256
59c93c7f29c8096070daa0f7ec1448a837dc48d5a92840f7eea3e8bba31eb326

SHA512
8af66d1cff96d08df3fbf7ebf0e5c1efe7242055999764a2d02220fcf467037229b60558909d15fbd779b82271b5c1a711238d65e6e4f2c1131d22f3ec23a618

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\gmp-widevinecdm\4.10.2710.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\prefs-1.js

Filesize
10KB

MD5
f638a0748c00cd63827fe7b277930afa

SHA1
b5c16dd360b2980a1bb116eb9a21949b25f83910

SHA256
57e6bbe1f40a5bd832bc2685127b4e81ad7411dd90fabaa456125f0049468c83

SHA512
b3f8e81509a879a1b081eef628444539a7ea77dc0634c69fc2e3103e6c9280d293c36dc932afc15a6e9ab918bcf5412c890693f746401dd1a4bbd6d0e9e22dc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\prefs.js

Filesize
11KB

MD5
3ff9d1f463abf57fe52983d4c7c5fcfe

SHA1
5d6a624d33693cb537c4a2c5685bf58051d73a3a

SHA256
f2523d1b99ee522ef37d58d2f7ef73d315da7ec3845c2c84efbb931af1bd8c03

SHA512
aa3fe77dcc466c1a5579322c4e3dba9d99dabdc5f8d2fc798dc32982ab9c3c19336c2c06741c809639d94b83f8db18ed702d33a9ca1f95099717faadc1688c8a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\prefs.js

Filesize
9KB

MD5
cf80fa865583c7e27ce6182bd237e32c

SHA1
2cca72b211062ea93175e8cb452f89cf73e6e84a

SHA256
d198f565091ccd3cd988a5815098c7fe719f2d728b12aa34e97dc5016ff49f47

SHA512
2d633c7b67c6c3ba95f356f2895fecf45ee3b1e003e58d2365c39e54e3b8db292e7f0312adf9ae9a4546e5dfcc9ca004f0b238a16de8f55fe6994fe221f83ef1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\prefs.js

Filesize
9KB

MD5
8181da4784b98c3501cef644a3e84e19

SHA1
481f80432172e1c95403e903fb1042462b8e44f3

SHA256
45e39463f02b1c95c3851cf6247201eec2cfb93028df8c40a15b6c61b658f8fa

SHA512
670d6a313f0115e7df8373c92aa7832f06bd39313115538bafd9c4cbddf0d737f0019aaf54f72a8c6d01e10d30dddc8e3f87d7366f6320a3fe11140636971226

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\prefs.js

Filesize
11KB

MD5
127b60d92669ada3fc12611bbc3df3ee

SHA1
235cd35259052086c1e6dec4b1b7fdbecc36e777

SHA256
a1ff6b503f9089166578ee1eee3f03291f257fe6c0cb69d42adcc44d65269d8f

SHA512
ec9b49440de4d4e4a9969ecdbb4ecd90848ef08888fe2d935cc1eadcf5b0a534ab9444432a7c039915506722b52f4897128e80165f9082d8f40dfe1f1e4f9d05

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\prefs.js

Filesize
11KB

MD5
ff233a18ec5e7abd8a3ec2a422772268

SHA1
16bbcf03508bffdb4b368a1afd1f227746e63d3b

SHA256
8411c8756ae3ffbb0096bc4cf613a925232dadf1cd317cb295770b0a85f02cc7

SHA512
6c538bf7950d8d29c6c9d40dd28638bcea13e68ac4c7732fb7d862ecebc2ae00268d61ba7de944e870991cdea8108b8c84a1d24b413ddd0509a2b9b0ce5f2154

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
d90d0bf80f134ba1ac51a8d988dfbd79

SHA1
4c140edf2e1333c9b997fa177c9b99264fb26a1a

SHA256
e5588ec910826a9dc3670c15e6d6c9b35bbe71d5b0496bd92cbb5fac94d59cde

SHA512
7c4753850f5048c78097a41f22ea8d9319b5d64e8dbeb600d92add7f284d5b0a30c7688fba7ce765fe95f40e61f05a881757b613a250993f7cc17dfc38c2fe65

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
04187b18974de378d696f59b9894f160

SHA1
837fd076ffa1ddba930c7e11a048599b0b847129

SHA256
a0ca449ee7b1f960cf17f9db72e102e2a96c3470a3230b61ab70732498a5256e

SHA512
9fdb5690d167af6e58a639a8342aed4d5aeb5765c2a8968f13f17ee89c9f3559d940956169a779d4cfe162c7572788bca629e6c449f6bfb8039abb69d76375ab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
7d14f00a16bfd89a525bffdaf0107502

SHA1
0cc60c7e051225288f4c076160b2b2314170fda7

SHA256
b613e1454c730bb207bc2d672910ae970f810f8fc9879597b308aa1b06bb5ab3

SHA512
ab5549dab1201a9bcb823f9a839277b97b48be0b59b3a673f5ce9bae97f39e48a855402a8372c0d8160d006594585f85eb20c4a491936d03068306d4696b89fe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
dca34db11a4a2470766799556ab78e04

SHA1
aa38efbbeb580d234d38f61529cd6bbe746f3af3

SHA256
ef8967001b6e78df5bf39d11c90fff0e7fd8c400e5ddc9299d0e67a9f66414ff

SHA512
eeb4e3e1091658351e0fdb125773b51c7f040e832a6cf21b00103401b3bdb40a8c96b003d797ef3e053b2b001bc228622df4f7f12efc762fc69f24191857714a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
c83109adad0500a4e7779dcee1c88758

SHA1
518472e2b4729252c1280ac45e5a7a065d372ce3

SHA256
451d052132748c4b29696380f014ead1561f5459464a32fea51f763b157684c9

SHA512
40ad8a431d3cf918b850bbe2d98526f4202646671e244d658c1e7808beb3a899f9992d82077aace56067daf6ef356b85a98f8ad69fd4c9483c026d0f24b42fe7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
085487cf89ac72feeb5b415a3cb0cec8

SHA1
cbd47ddb51ed3facfa52e780b61e5784e38cf4f9

SHA256
cca0b0a7e328e6b5991bb2382f1f77e76f5ffbfd936d38c2e4951cf9580a1a2a

SHA512
0f073f655ffcec646dc9f02a5e98ac71657cdcb7eee917c141768878671e08b1797a3efdfb4b39dde8057adb2f97ce560c6f51b70473c2d84b26bf8d7d9a62d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
91a2f93d1c515c23efa3dc8a06b03410

SHA1
12e04b9789123658cf9e2c1a7c75ac26799f3848

SHA256
9a4ca3ab3dc194ca371145483c44ff1801f923ad36d4846558ef2423c7ab8bb8

SHA512
e089d39edbd82480766a1e1341d3093888c3a1e6dbc6174ddf6e77dc473bf107b780569107bd65f885f9ae86e480b3562d0389db1b675426ce029a5dfdb919fd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
3c44a20ef1d35460f2efb95345f7bc84

SHA1
927c005cb43d1d0b2b32f10d7bf4a8f94e025185

SHA256
fd878a73dd2d1b8e4edfae5a4e560e4fd5dcfbe06b58cc808e582d6766b75a6a

SHA512
8af92576b40803cefb85b32485ee1cc6eb8b29cf4723ece18eb67e464f127be77f1f7344e8d23f2d8040b4b03e89d49594b54bc0ea8d6f2b0eec43c7aefd6e5e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
5d379d3fad86040684ec2bf27180a663

SHA1
d0ccfc72748d4a8f9b13e3f4ea4e2b666b3640cd

SHA256
b145a0a890b14636d820b6b07eacfa469ad40d54ad93f859a8dde3aca3bf7550

SHA512
bf6ca4c50f82b8f67bc339e27e2da852ac7fefe8c0f780b74febf3ab0a16a1c147d144de9c888681685f47554fdbb810b6997411de1173916072bfe2b113a8e5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
7c99265d6c4e65c5cc16a65d9b922cf4

SHA1
abb155640c02d3b1c1b330ec3ce3676f086c1322

SHA256
27b710366b3fb66e96df26b82e4f040b13aab2fc02d9ec7998d659b85629e878

SHA512
1c4ec8ab0f28c699ccf984a4d8a8b384690c95da30d5ce736c31b6e55d821c19a71524f4c86ea1dee535e775b856365707f82edd95362342d59d7c5f6c3509fb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
265005d1bea8b783debaec8af2f14c5e

SHA1
43bf0aa3011ee1e86e6aa9ae7d6ab5d726165e5f

SHA256
a576c8db777460bc8ee72931855e00b9550268a5e0d036a138c095c4cbbec902

SHA512
798223339869cc236bf3b09ba99be37acfc4bd5ac92259da19638d93aee3a3b73244423a36d41fe4dbc98de1fd5e601a434e5537674fd3525248b87d829ca3cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\sessionstore-backups\recovery.baklz4

Filesize
11KB

MD5
22db61f119b20eb468e43b286a5ea5a1

SHA1
e517262ea34cbb7cc75f18180514f85de0ca5cce

SHA256
4b6656d46c3bb839b261763759aaecc63c99dacedc19c35059ea0e01ce4322ce

SHA512
858e3a4b5fffd02036a874b51d5493b795efcc786a12fc2786a6bb268744d324a32deb915286ef64e69ce72fca2143b3052c4ee0f0858eb8ba7a511c3c372fa8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
83d4cabc86d81e6cf4cb0703b9e32d55

SHA1
3fc718fd7dccc7e0b78d5e62c3995623f08dd26a

SHA256
0647873ee9d118d1c977c73abbf59afbfc8d0a30a05cab05bee8741dc477ed86

SHA512
c347d8d8c3e40e36bb0592352178123496f45c7b3f9ed6d2d5fae365f247aedaa9ccb5c1405fd65a36cec57e56a4b33d761e861ffa9d2559dc87501eaa3ca83a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
c1168f1ed16c337b9fcdc1c088055e36

SHA1
bca3e15e32733c55d8f3d2b1168af5b8a397e494

SHA256
68595145ad67ef89e276778422e64a74d9bae1386563d5363cbfbbd97396ef47

SHA512
6a9d19d1c4640410cddda25c0b08b3a2a52cd2da5f4d2e3ec1936a0cba48fe2329438531acc7ffe33976d793554c70252c9a830636db2f3aeeca3ad322ba4521

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
456fccf4f1f128cdf1f34d68a5fece53

SHA1
6c71cb821738f1cb6244d30dbc5119a9e8a83bde

SHA256
53cea82c77c7281dc717baf1eb4f14e390f011dfda6fc9bd2f731b952789c9c6

SHA512
a3b89a3650ad7ef4d6b368fde5025184c3b4c63f73b06c5ac3972baebdc7b3065c16fefb1988011a2dd0e39a4848c57b33e2d3a413a25c70a39870ff037b5f24

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
b149efc27d4a4195cbe2c151a83b0085

SHA1
9754252a239899846061e9b6ff828b0c719a3b8a

SHA256
efd34f1cd173925b78637e5c4726a0047ee9da418c516a3a8ecafbd200f45a3e

SHA512
e3c6b584ba19b8486383ab863e0e2e53139ab0bb5c3e532887ffedd7198b8362e6bc9dc28591762c31161d1f6c60fc26287e043a35a265ba9b8e00cc9e203f9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
ba7e1f176171c41e0a2d7e6ac7eeab69

SHA1
506f974ad4d3a21f7e2ec47666bfb1ec83f7af65

SHA256
f3aa33e55e171d2f4e93d18fdef47c582adc9267c0d6c6ddd9de3afd0cb37080

SHA512
82fd3d7a41990fd4c11df60d5048839eff36b1ecab259e02581b0a7d6f1924e28adcdd0c248e7435e60ee300f7201bfefbbc8ac814973f32df8e06590cd01ff9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
bb1205a543106745d05ce98e8d687427

SHA1
0adc9d055b2c976e1ef06f2880647fc52ae8d9c8

SHA256
7915c81abb3ca4c57b358888d66190709ecdbf59ae6c281829161c5291bc91b1

SHA512
236e9f7ab82e31692b9ff6be9b615e0a0461c80b64f2ccd5eb5ce5fa0f8e7944fd6eb649b20cc19a3414812622a2f54e218bd173f886bf057d296ddfc92bcb3d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
1f34d216857aec2b20bf684cdeeff283

SHA1
2391b3a63e28d68d43c27d181e8f11287061d7cd

SHA256
b85fbc4ff153465f7c512cdd3c75fafc9e26422f602e0d18ace09193f927eab4

SHA512
a205c7f24344c5bbfcbe6aaa01922c5bc650a3cabd0cb2646ef2d52f3c4ddd26708d344e901149c87f2f0d4cdf722385fe46b033ea64f4174cb57e82c39ef0f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
429f279a8ade0db58a2762e2e250792a

SHA1
5ef92e615f33058c4eaf6aa8e4b28be8c2a7c6e2

SHA256
98b6c24820fdcd2ea3109e91f2787d43f708bf8052480395091adc0496059f67

SHA512
c8ddf173a2c9a339f13db3f1710654d8249d88529085bebf01e5546fb3694a743ef8e7d2468724094bc3ed478aece4d5207c0ee94940404373ecb481afb05806

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
1546bc76a088faeb2a21624f3e248b5f

SHA1
a0833a5fe3329d3d45fa6b8e4e2a28d0b53a0b60

SHA256
e1da81dc5d54b9e7cf95d5d2c93dfb5f9f8516c80b7265b0e46fa3fde06f91d5

SHA512
3ccf7657467551d7c498ecfe04bf6d23299bbec3736072bb17567fcfd2349af536580cfe437da617e41b7b15d2cd9044885d7af8810190a6236199aa1f94b47c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
656KB

MD5
985ef1c161d27f157d0301ea94f8d90b

SHA1
34fe3483baea8ecef3b84fccca8956aa7009c4f7

SHA256
adf6be05776afd2686f5e9925a2df3f938f5296ae1f8fe6014e5b8cb3ae80b0b

SHA512
2ce877ad5968a59784de178a1fc82e47635809d0aa86a0026af96ea2c839f37ec716692bdfff1ed3ce2a25e15fe827f835edd817f4006dc4d14526b70232d101

Download Submit
C:\Users\Admin\AppData\Roaming\System32Work\EncryptedFileList.txt

Filesize
420KB

MD5
49af1aec81f50e6d55bd81e060bf0fa1

SHA1
9a6a9a401b3ec448527c0237f03415d0306cb68c

SHA256
c390cd40f08bca694a6b9ffb6dda4df7446216909daebb1e1594e34a0caab1d0

SHA512
540b199e533c04b8551bae8a2ff79ecdaa69f9889b9edf5b035f089883577e3993d4365d6a35c3635bbfb6316ae8a6ce9741df820d1b4971ddf9d986c462ba7f

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

Filesize
16.1MB

MD5
abe4da7257168054d95fd23dc8bf8a88

SHA1
731948af77053647089f53851c6c31173621b561

SHA256
21323031457e3fec194db5942cc2511b5468b1d9b7aa5656a5ff3ac3b0634f1e

SHA512
62bbdc2d34e240ccc31909877ff3cbc44bb7613fbc872fe66da36ed3ef393f12b8cfce684996bfa3b074c0216f4e3343de0f724e0348489a0dfa5155eb989f3f

Download Submit
C:\Users\Admin\Downloads\2UCoz4uW.zip.part

Filesize
249KB

MD5
3cdb9b91b2d8b971a2cc708968097337

SHA1
e6c442016aa3c25c54e32cf9637a0b79ebaaa5e1

SHA256
66fb3bfdb601414cd35623d3dab811215f8dfa08c4189df588872fb543568684

SHA512
d7800cc749410f0bf1a316d4c6af5ca7bc0bb4f19389937fc9d5738b56800f4d04bdc541a587a76226cf3c8f3fd7a1c84cafefc3d5c3f2baa04857b61435fe83

Download Submit
C:\Users\Admin\Downloads\ClearResume.wmv

Filesize
1.2MB

MD5
90b46160aae62f9b6600515f73a65677

SHA1
a4547f5f318ab1370a7a23d96ea15a2be4a1b44e

SHA256
229dd324165d28bc11e279a26a700bde2ad9668811567703951ba70eea809d3a

SHA512
60b303dee6f18587a37c184e7d3a30c20f1244cc36b138e04fb987da51b7267870f29c7a490d06e105f97cbb48adca355edfe4af39308732df0926b094f7a74c

Download Submit
C:\Users\Admin\Downloads\NxNSUFFK.zip.part

Filesize
239KB

MD5
3ad6374a3558149d09d74e6af72344e3

SHA1
e7be9f22578027fc0b6ddb94c09b245ee8ce1620

SHA256
86a391fe7a237f4f17846c53d71e45820411d1a9a6e0c16f22a11ebc491ff9ff

SHA512
21c21b36be200a195bfa648e228c64e52262b06d19d294446b8a544ff1d81f81eb2af74ddbdebc59915168db5dba76d0f0585e83471801d9ee37e59af0620720

Download Submit
C:\Users\Admin\Downloads\Ransomware.Jigsaw.zip

Filesize
239KB

MD5
67b0939fedd0ec8748c962ceaaa6b99e

SHA1
c8c82f7cac6a4ae72b15d0b27f84e6748bde8f16

SHA256
2b1699e29c565107c0e067d783c52d17c8e5eb866b131ba293da4261481767d3

SHA512
45f603f46a82d1b06abdaf0e19bee6403d427c1e7b60b80411b33c1f6ce3a9a45ee58cbd186046ca68c01a44be502b3974b5e79713cd660ab0477c981863086e

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\95261741510477.bat

Filesize
362B

MD5
fe9561e52b9a2cad33eaa33fbdaee8f4

SHA1
2bc1b267837017ec84edec64e2ed5ab787a59793

SHA256
6cf7e177e05490a3326a71f20a6640edef1d92936601969df22b0ea5261b1d44

SHA512
e734e185a32b0d2109cb666c8bf217096fffb9804578b97d8b108a7edae01ab129c7e6bf20174faf67c5ec493e9ce0e98d85381017fd3b879fe7232a36430261

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]

Filesize
933B

MD5
7a2726bb6e6a79fb1d092b7f2b688af0

SHA1
b3effadce8b76aee8cd6ce2eccbb8701797468a2

SHA256
840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5

SHA512
4e107f661e6be183659fdd265e131a64cce2112d842226305f6b111d00109a970fda0b5abfb1daa9f64428e445e3b472332392435707c9aebbfe94c480c72e54

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]

Filesize
721B

MD5
93a6e79b46c40378e1ac70eff689d1ff

SHA1
6dd07bbfe7cb1ef6be13afd3eeaf7b1e4d0e6e58

SHA256
f094f3b9be4ebcf2cf4ac241a68f6902f1ba8adec6c4e75fee73e2a6848d870e

SHA512
6a7426381e07918bf3f4e50d8d4f59aea5975ba29502d09c75809f08b5bfa4e5e5e5b0f5726a42851cec5ee2d60bc7b7ec8596c8c680b9e72dc6f5ea30ff80b8

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\TaskData\Tor\tor.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\b.wnry

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\c.wnry

Filesize
780B

MD5
8124a611153cd3aceb85a7ac58eaa25d

SHA1
c1d5cd8774261d810dca9b6a8e478d01cd4995d6

SHA256
0ceb451c1dbefaa8231eeb462e8ce639863eb5b8ae4fa63a353eb6e86173119e

SHA512
b9c8dfb5d58c95628528cc729d2394367c5e205328645ca6ef78a3552d9ad9f824ae20611a43a6e01daaffeffdc9094f80d772620c731e4192eb0835b8ed0f17

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\m.vbs

Filesize
241B

MD5
cb8af050def8bd8ff07b6fece0b09530

SHA1
8faf2a240203f7dc8739952672c788a0fb2df973

SHA256
c97d8fc0de558b033cbf088ef69122addd364e65a49111aec218465549bf1227

SHA512
5ccb09d7e199f31e4a9a92621755c6514e8aae6187b6bef8aba2b6644834776941401188646dbf552639a13124285de15b18e6ff12acb57f91cb7d204cafdd57

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_bulgarian.wnry

Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_chinese (simplified).wnry

Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_chinese (traditional).wnry

Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_croatian.wnry

Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_czech.wnry

Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_danish.wnry

Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_dutch.wnry

Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_english.wnry

Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_filipino.wnry

Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_french.wnry

Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_german.wnry

Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_greek.wnry

Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_indonesian.wnry

Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_italian.wnry

Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_japanese.wnry

Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_korean.wnry

Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_latvian.wnry

Filesize
40KB

MD5
c33afb4ecc04ee1bcc6975bea49abe40

SHA1
fbea4f170507cde02b839527ef50b7ec74b4821f

SHA256
a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

SHA512
0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_norwegian.wnry

Filesize
36KB

MD5
ff70cc7c00951084175d12128ce02399

SHA1
75ad3b1ad4fb14813882d88e952208c648f1fd18

SHA256
cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

SHA512
f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_polish.wnry

Filesize
38KB

MD5
e79d7f2833a9c2e2553c7fe04a1b63f4

SHA1
3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

SHA256
519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

SHA512
e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_portuguese.wnry

Filesize
37KB

MD5
fa948f7d8dfb21ceddd6794f2d56b44f

SHA1
ca915fbe020caa88dd776d89632d7866f660fc7a

SHA256
bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

SHA512
0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_romanian.wnry

Filesize
50KB

MD5
313e0ececd24f4fa1504118a11bc7986

SHA1
e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

SHA256
70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

SHA512
c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_russian.wnry

Filesize
46KB

MD5
452615db2336d60af7e2057481e4cab5

SHA1
442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

SHA256
02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

SHA512
7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_slovak.wnry

Filesize
40KB

MD5
c911aba4ab1da6c28cf86338ab2ab6cc

SHA1
fee0fd58b8efe76077620d8abc7500dbfef7c5b0

SHA256
e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

SHA512
3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_spanish.wnry

Filesize
36KB

MD5
8d61648d34cba8ae9d1e2a219019add1

SHA1
2091e42fc17a0cc2f235650f7aad87abf8ba22c2

SHA256
72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

SHA512
68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_swedish.wnry

Filesize
37KB

MD5
c7a19984eb9f37198652eaf2fd1ee25c

SHA1
06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae

SHA256
146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4

SHA512
43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_turkish.wnry

Filesize
41KB

MD5
531ba6b1a5460fc9446946f91cc8c94b

SHA1
cc56978681bd546fd82d87926b5d9905c92a5803

SHA256
6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415

SHA512
ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_vietnamese.wnry

Filesize
91KB

MD5
8419be28a0dcec3f55823620922b00fa

SHA1
2e4791f9cdfca8abf345d606f313d22b36c46b92

SHA256
1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8

SHA512
8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\r.wnry

Filesize
864B

MD5
3e0020fc529b1c2a061016dd2469ba96

SHA1
c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade

SHA256
402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c

SHA512
5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\s.wnry

Filesize
2.9MB

MD5
ad4c9de7c8c40813f200ba1c2fa33083

SHA1
d1af27518d455d432b62d73c6a1497d032f6120e

SHA256
e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b

SHA512
115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\t.wnry

Filesize
64KB

MD5
5dcaac857e695a65f5c3ef1441a73a8f

SHA1
7b10aaeee05e7a1efb43d9f837e9356ad55c07dd

SHA256
97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6

SHA512
06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe

Filesize
20KB

MD5
4fef5e34143e646dbf9907c4374276f5

SHA1
47a9ad4125b6bd7c55e4e7da251e23f089407b8f

SHA256
4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79

SHA512
4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe

Filesize
20KB

MD5
8495400f199ac77853c53b5a3f278f3e

SHA1
be5d6279874da315e3080b06083757aad9b32c23

SHA256
2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d

SHA512
0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\u.wnry

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
memory/64-973-0x0000000000FA0000-0x0000000000FD8000-memory.dmp

Filesize
224KB

Download
memory/64-974-0x000000001BAD0000-0x000000001BF9E000-memory.dmp

Filesize
4.8MB

Download
memory/64-975-0x000000001C040000-0x000000001C0DC000-memory.dmp

Filesize
624KB

Download
memory/1328-1014-0x0000000000AE0000-0x0000000000AE8000-memory.dmp

Filesize
32KB

Download
memory/1328-4824-0x0000000000950000-0x00000000009C2000-memory.dmp

Filesize
456KB

Download
memory/1616-5551-0x0000000073600000-0x0000000073682000-memory.dmp

Filesize
520KB

Download
memory/1616-5586-0x00000000733B0000-0x00000000735CC000-memory.dmp

Filesize
2.1MB

Download
memory/1616-5580-0x00000000007A0000-0x0000000000A9E000-memory.dmp

Filesize
3.0MB

Download
memory/1616-5568-0x00000000007A0000-0x0000000000A9E000-memory.dmp

Filesize
3.0MB

Download
memory/1616-5559-0x00000000007A0000-0x0000000000A9E000-memory.dmp

Filesize
3.0MB

Download
memory/1616-5548-0x0000000073730000-0x00000000737B2000-memory.dmp

Filesize
520KB

Download
memory/1616-5549-0x0000000073710000-0x000000007372C000-memory.dmp

Filesize
112KB

Download
memory/1616-5547-0x00000000007A0000-0x0000000000A9E000-memory.dmp

Filesize
3.0MB

Download
memory/1616-5550-0x0000000073690000-0x0000000073707000-memory.dmp

Filesize
476KB

Download
memory/1616-5553-0x00000000733B0000-0x00000000735CC000-memory.dmp

Filesize
2.1MB

Download
memory/1616-5552-0x00000000735D0000-0x00000000735F2000-memory.dmp

Filesize
136KB

Download
memory/1616-5521-0x0000000073600000-0x0000000073682000-memory.dmp

Filesize
520KB

Download
memory/1616-5522-0x00000000735D0000-0x00000000735F2000-memory.dmp

Filesize
136KB

Download
memory/1616-5523-0x00000000007A0000-0x0000000000A9E000-memory.dmp

Filesize
3.0MB

Download
memory/1616-5520-0x00000000733B0000-0x00000000735CC000-memory.dmp

Filesize
2.1MB

Download
memory/1616-5519-0x0000000073730000-0x00000000737B2000-memory.dmp

Filesize
520KB

Download
memory/3236-5190-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/3504-4851-0x0000024108220000-0x0000024108221000-memory.dmp

Filesize
4KB

Download
memory/3504-4848-0x0000024108220000-0x0000024108221000-memory.dmp

Filesize
4KB

Download
memory/3504-4842-0x0000024108220000-0x0000024108221000-memory.dmp

Filesize
4KB

Download
memory/3504-4849-0x0000024108220000-0x0000024108221000-memory.dmp

Filesize
4KB

Download
memory/3504-4843-0x0000024108220000-0x0000024108221000-memory.dmp

Filesize
4KB

Download
memory/3504-4850-0x0000024108220000-0x0000024108221000-memory.dmp

Filesize
4KB

Download
memory/3504-4841-0x0000024108220000-0x0000024108221000-memory.dmp

Filesize
4KB

Download
memory/3504-4853-0x0000024108220000-0x0000024108221000-memory.dmp

Filesize
4KB

Download
memory/3504-4852-0x0000024108220000-0x0000024108221000-memory.dmp

Filesize
4KB

Download
memory/5192-5008-0x000001EC8DBC0000-0x000001EC8E681000-memory.dmp

Filesize
10.8MB

Download
memory/5192-4996-0x000001ECA7070000-0x000001ECA70E6000-memory.dmp

Filesize
472KB

Download
memory/5192-5004-0x000001EC8DBC0000-0x000001EC8E681000-memory.dmp

Filesize
10.8MB

Download
memory/5192-5000-0x000001EC8DBC0000-0x000001EC8E681000-memory.dmp

Filesize
10.8MB

Download
memory/5192-4990-0x000001ECA6AB0000-0x000001ECA6AD2000-memory.dmp

Filesize
136KB

Download
memory/5192-4995-0x000001ECA6B30000-0x000001ECA6B74000-memory.dmp

Filesize
272KB

Download
memory/5192-4997-0x000001ECA6B80000-0x000001ECA6B9E000-memory.dmp

Filesize
120KB

Download
memory/5300-4838-0x0000016CBDBE0000-0x0000016CBDBE1000-memory.dmp

Filesize
4KB

Download
memory/5300-4839-0x0000016CBDBE0000-0x0000016CBDBE1000-memory.dmp

Filesize
4KB

Download
memory/5300-4829-0x0000016CBDBE0000-0x0000016CBDBE1000-memory.dmp

Filesize
4KB

Download
memory/5300-4828-0x0000016CBDBE0000-0x0000016CBDBE1000-memory.dmp

Filesize
4KB

Download
memory/5300-4827-0x0000016CBDBE0000-0x0000016CBDBE1000-memory.dmp

Filesize
4KB

Download
memory/5300-4834-0x0000016CBDBE0000-0x0000016CBDBE1000-memory.dmp

Filesize
4KB

Download
memory/5300-4835-0x0000016CBDBE0000-0x0000016CBDBE1000-memory.dmp

Filesize
4KB

Download
memory/5300-4837-0x0000016CBDBE0000-0x0000016CBDBE1000-memory.dmp

Filesize
4KB

Download
memory/5300-4833-0x0000016CBDBE0000-0x0000016CBDBE1000-memory.dmp

Filesize
4KB

Download
memory/5300-4836-0x0000016CBDBE0000-0x0000016CBDBE1000-memory.dmp

Filesize
4KB

Download