Overview

overview

10

Static

static

1

EICAR.txt

windows10-ltsc_2021-x64

10

Resubmissions

23/03/2025, 19:10

250323-xvmsfa11gt 10

23/03/2025, 18:49

250323-xglyzsvn17 8

23/03/2025, 18:23

250323-w1gb6str12 8

23/03/2025, 18:13

250323-wtvk8azwcy 8

23/03/2025, 18:01

250323-wlzvzatlz3 10

23/03/2025, 17:38

250323-v722saywcy 10

23/03/2025, 17:35

250323-v53kjayve1 10

23/03/2025, 17:27

250323-v1pswasnw2 10

23/03/2025, 15:05

250323-sf8n5sylt7 8

23/03/2025, 14:52

250323-r8x8faxrx9 8

Analysis

  • max time kernel
    540s
  • max time network
    437s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250314-de
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250314-delocale:de-deos:windows10-ltsc_2021-x64systemwindows
  • submitted
    23/03/2025, 18:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    EICAR.txt

  • Size

    68B

  • MD5

    44d88612fea8a8f36de82e1278abb02f

  • SHA1

    3395856ce81f2b7382dee72602f798b642f14140

  • SHA256

    275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f

  • SHA512

    cc805d5fab1fd71a4ab352a9c533e65fb2d5b885518f4e565e68847223b8e6b85cb48f3afad842726d99239c9e36505c64b0dc9a061d9e507d833277ada336ab

Score
10/10
mydoomadwaredefense_evasiondiscoverypersistenceprivilege_escalationspywarestealerupxworm

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
    persistence
  • Detects MyDoom family 1 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies firewall policy service 3 TTPs 24 IoCs
    defense_evasion
  • Modifies security service 2 TTPs 12 IoCs
    defense_evasion
  • MyDoom

    MyDoom is a Worm that is written in C++.

    wormmydoom
  • Mydoom family
    mydoom
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 26 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Boot or Logon Autostart Execution: Port Monitors 1 TTPs 13 IoCs

    Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    persistence
  • Downloads MZ/PE file 7 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 47 IoCs
    persistence
  • Manipulates Digital Signatures 1 TTPs 64 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • Boot or Logon Autostart Execution: Print Processors 1 TTPs 2 IoCs

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence
  • Executes dropped EXE 18 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 7 IoCs
    defense_evasion
  • Loads dropped DLL 1 IoCs
  • Modifies system executable filetype association 2 TTPs 54 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Indicator Removal: Clear Persistence 1 TTPs 47 IoCs

    remove IFEO.

    defense_evasion
  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Maps connected drives based on registry 3 TTPs 3 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Modifies WinLogon 2 TTPs 13 IoCs
    persistence
  • Drops file in System32 directory 41 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 21 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 7 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 36 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 60 IoCs
    defense_evasionspywaretrojan
  • NTFS ADS 9 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 46 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 13 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\EICAR.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:6108
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:6012
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Downloads MZ/PE file
      • Subvert Trust Controls: Mark-of-the-Web Bypass
      • Checks processor information in registry
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1928
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27101 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2108 -initialChannelId {82810cea-2d99-4b57-b9ff-d10a3cfa2d86} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        3⤵
          PID:6096
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27137 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {a0b69670-59e3-473d-a27b-d9c61827f692} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
          3⤵
            PID:4728
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3832 -prefsLen 27277 -prefMapHandle 3836 -prefMapSize 270279 -jsInitHandle 3840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3848 -initialChannelId {5135c337-cf3a-46ac-8758-95b00210b9a1} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            3⤵
            • Checks processor information in registry
            PID:5000
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4000 -prefsLen 27277 -prefMapHandle 4004 -prefMapSize 270279 -ipcHandle 4100 -initialChannelId {6ffd4dbe-df7a-40fb-a354-e60c87acecc6} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            3⤵
              PID:4548
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2736 -prefsLen 34776 -prefMapHandle 2864 -prefMapSize 270279 -jsInitHandle 2804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2744 -initialChannelId {5ca26dd5-181d-4013-b94a-9f9a1bcc8ddd} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
              3⤵
              • Checks processor information in registry
              PID:5072
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5144 -prefsLen 35013 -prefMapHandle 5140 -prefMapSize 270279 -ipcHandle 5104 -initialChannelId {68c73b75-45f8-4e6b-8699-bf83f9f224c7} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
              3⤵
              • Checks processor information in registry
              PID:1708
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5320 -prefsLen 32900 -prefMapHandle 5324 -prefMapSize 270279 -jsInitHandle 5328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5336 -initialChannelId {ba607fbf-db4f-4aa2-9688-df2bfdbc1462} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
              3⤵
              • Checks processor information in registry
              PID:2576
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5548 -prefsLen 32900 -prefMapHandle 5552 -prefMapSize 270279 -jsInitHandle 5556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5376 -initialChannelId {322f4101-6e54-4622-93c4-7753aecd78f6} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
              3⤵
              • Checks processor information in registry
              PID:956
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5724 -prefsLen 32900 -prefMapHandle 5728 -prefMapSize 270279 -jsInitHandle 5732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5740 -initialChannelId {8e6cd4f4-76cf-4fdf-8dcc-1e90d27c4b7e} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
              3⤵
              • Checks processor information in registry
              PID:5940
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6748 -prefsLen 33071 -prefMapHandle 6752 -prefMapSize 270279 -jsInitHandle 6756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6232 -initialChannelId {af616040-cadb-4618-9d5c-44f09a46459d} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
              3⤵
              • Checks processor information in registry
              PID:3680
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5768 -prefsLen 36502 -prefMapHandle 7132 -prefMapSize 270279 -jsInitHandle 7156 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7152 -initialChannelId {ecc9e6a9-258c-4e6d-b82a-3f93b890af72} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
              3⤵
              • Checks processor information in registry
              PID:3144
            • C:\Users\Admin\Downloads\Amus.exe
              "C:\Users\Admin\Downloads\Amus.exe"
              3⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2688
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4824 -prefsLen 36598 -prefMapHandle 6972 -prefMapSize 270279 -jsInitHandle 5304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6304 -initialChannelId {3a3ee8dd-a4b1-4029-bd39-37750d487c8c} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
              3⤵
              • Checks processor information in registry
              PID:4232
            • C:\Users\Admin\Downloads\MeltingScreen.exe
              "C:\Users\Admin\Downloads\MeltingScreen.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4520
            • C:\Users\Admin\Downloads\NakedWife.exe
              "C:\Users\Admin\Downloads\NakedWife.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • NTFS ADS
              • Suspicious use of SetWindowsHookEx
              PID:3636
            • C:\Users\Admin\Downloads\Pikachu.exe
              "C:\Users\Admin\Downloads\Pikachu.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:4272
            • C:\Users\Admin\Downloads\Pikachu.exe
              "C:\Users\Admin\Downloads\Pikachu.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:3108
            • C:\Users\Admin\Downloads\MyDoom.A.exe
              "C:\Users\Admin\Downloads\MyDoom.A.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              PID:5936
              • C:\Windows\SysWOW64\notepad.exe
                notepad C:\Users\Admin\AppData\Local\Temp\Message
                4⤵
                  PID:1960
              • C:\Users\Admin\Downloads\xpajB.exe
                "C:\Users\Admin\Downloads\xpajB.exe"
                3⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: GetForegroundWindowSpam
                PID:5768
              • C:\Users\Admin\Downloads\Fagot.a.exe
                "C:\Users\Admin\Downloads\Fagot.a.exe"
                3⤵
                • Adds autorun key to be loaded by Explorer.exe on startup
                • Modifies WinLogon for persistence
                • Modifies firewall policy service
                • Modifies security service
                • Boot or Logon Autostart Execution: Active Setup
                • Boot or Logon Autostart Execution: Port Monitors
                • Event Triggered Execution: Image File Execution Options Injection
                • Manipulates Digital Signatures
                • Boot or Logon Autostart Execution: Print Processors
                • Executes dropped EXE
                • Impair Defenses: Safe Mode Boot
                • Modifies system executable filetype association
                • Adds Run key to start application
                • Indicator Removal: Clear Persistence
                • Installs/modifies Browser Helper Object
                • Maps connected drives based on registry
                • Modifies WinLogon
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                • Checks SCSI registry key(s)
                • Checks processor information in registry
                • Enumerates system info in registry
                • Modifies Internet Explorer settings
                • Modifies Internet Explorer start page
                • Modifies registry class
                • Modifies system certificate store
                • System policy modification
                PID:2512
          • C:\Windows\system32\AUDIODG.EXE
            C:\Windows\system32\AUDIODG.EXE 0x514 0x510
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2784
          • C:\Windows\system32\taskmgr.exe
            "C:\Windows\system32\taskmgr.exe" /4
            1⤵
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:504
          • C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
            1⤵
              PID:4884
            • C:\Windows\Anti_Virus.exe
              "C:\Windows\Anti_Virus.exe"
              1⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1912
            • C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
              "C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
              1⤵
              • Suspicious use of SetWindowsHookEx
              PID:5052
            • C:\Windows\System32\SecurityHealthHost.exe
              C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
              1⤵
                PID:1652
              • C:\Windows\System32\SecurityHealthHost.exe
                C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
                1⤵
                  PID:4336
                • C:\Windows\System32\SecurityHealthHost.exe
                  C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
                  1⤵
                    PID:808
                  • C:\Windows\System32\SecurityHealthHost.exe
                    C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
                    1⤵
                      PID:3080
                    • C:\Windows\Anti_Virus.exe
                      "C:\Windows\Anti_Virus.exe"
                      1⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:1996
                    • C:\Windows\Ankara.exe
                      "C:\Windows\Ankara.exe"
                      1⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:4812
                    • C:\Windows\Adapazari.exe
                      "C:\Windows\Adapazari.exe"
                      1⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:4264
                    • C:\Windows\KdzEregli.exe
                      "C:\Windows\KdzEregli.exe"
                      1⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:940
                    • C:\Windows\Messenger.exe
                      "C:\Windows\Messenger.exe"
                      1⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:1912
                    • C:\Windows\Meydanbasi.exe
                      "C:\Windows\Meydanbasi.exe"
                      1⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:4140
                    • C:\Windows\My_Pictures.exe
                      "C:\Windows\My_Pictures.exe"
                      1⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:1948
                    • C:\Windows\Pide.exe
                      "C:\Windows\Pide.exe"
                      1⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:3364
                    • C:\Windows\Pire.exe
                      "C:\Windows\Pire.exe"
                      1⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:4704
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\ILOVEYOU.vbs"
                      1⤵
                        PID:4928
                      • C:\Windows\system32\taskmgr.exe
                        "C:\Windows\system32\taskmgr.exe" /4
                        1⤵
                        • Checks SCSI registry key(s)
                        • Checks processor information in registry
                        • Suspicious use of AdjustPrivilegeToken
                        PID:6100
                      • C:\Windows\system32\taskmgr.exe
                        "C:\Windows\system32\taskmgr.exe" /4
                        1⤵
                        • Checks SCSI registry key(s)
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4620
                      • C:\Windows\system32\taskmgr.exe
                        "C:\Windows\system32\taskmgr.exe" /4
                        1⤵
                        • Checks SCSI registry key(s)
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1068
                      • C:\Windows\system32\taskmgr.exe
                        "C:\Windows\system32\taskmgr.exe" /4
                        1⤵
                        • Checks SCSI registry key(s)
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5128
                      • C:\Windows\system32\taskmgr.exe
                        "C:\Windows\system32\taskmgr.exe" /4
                        1⤵
                        • Checks SCSI registry key(s)
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2956

                      Network

                      MITRE ATT&CK Enterprise v15

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Persistence

                      Boot or Logon Autostart Execution

                      7
                      T1547

                      Active Setup

                      1
                      T1547.014

                      Port Monitors

                      1
                      T1547.010

                      Print Processors

                      1
                      T1547.012

                      Registry Run Keys / Startup Folder

                      2
                      T1547.001

                      Winlogon Helper DLL

                      2
                      T1547.004

                      Browser Extensions

                      1
                      T1176

                      Create or Modify System Process

                      2
                      T1543

                      Windows Service

                      2
                      T1543.003

                      Event Triggered Execution

                      3
                      T1546

                      Change Default File Association

                      1
                      T1546.001

                      Image File Execution Options Injection

                      1
                      T1546.012

                      Netsh Helper DLL

                      1
                      T1546.007

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      7
                      T1547

                      Active Setup

                      1
                      T1547.014

                      Port Monitors

                      1
                      T1547.010

                      Print Processors

                      1
                      T1547.012

                      Registry Run Keys / Startup Folder

                      2
                      T1547.001

                      Winlogon Helper DLL

                      2
                      T1547.004

                      Create or Modify System Process

                      2
                      T1543

                      Windows Service

                      2
                      T1543.003

                      Event Triggered Execution

                      3
                      T1546

                      Change Default File Association

                      1
                      T1546.001

                      Image File Execution Options Injection

                      1
                      T1546.012

                      Netsh Helper DLL

                      1
                      T1546.007

                      Defense Evasion

                      Impair Defenses

                      2
                      T1562

                      Disable or Modify System Firewall

                      1
                      T1562.004

                      Safe Mode Boot

                      1
                      T1562.009

                      Indicator Removal

                      1
                      T1070

                      Clear Persistence

                      1
                      T1070.009

                      Modify Registry

                      13
                      T1112

                      Subvert Trust Controls

                      3
                      T1553

                      Install Root Certificate

                      1
                      T1553.004

                      SIP and Trust Provider Hijacking

                      2
                      T1553.003

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      1
                      T1552

                      Credentials In Files

                      1
                      T1552.001

                      Discovery

                      Peripheral Device Discovery

                      2
                      T1120

                      Query Registry

                      6
                      T1012

                      System Information Discovery

                      4
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      Lateral Movement

                      Collection

                      Data from Local System

                      1
                      T1005

                      Command and Control

                      Web Service

                      1
                      T1102

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                        Filesize

                        64KB

                        MD5

                        d2fb266b97caff2086bf0fa74eddb6b2

                        SHA1

                        2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                        SHA256

                        b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                        SHA512

                        c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                        Download Submit

                      • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                        Filesize

                        4B

                        MD5

                        f49655f856acb8884cc0ace29216f511

                        SHA1

                        cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                        SHA256

                        7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                        SHA512

                        599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                        Download Submit

                      • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                        Filesize

                        944B

                        MD5

                        6bd369f7c74a28194c991ed1404da30f

                        SHA1

                        0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                        SHA256

                        878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                        SHA512

                        8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h550saij.default-release\activity-stream.contile.json
                        Filesize

                        4KB

                        MD5

                        fd83cec12358cca410ecc5e014b2d53b

                        SHA1

                        6b799ba6842fc8e3e609a7cd795372bb0d097d85

                        SHA256

                        d4241e494363931c3dc9ffbdd23e5257fd9ecdb3e20d5e06f07c79e9e038284e

                        SHA512

                        15e162d18522a3db23af4c2f83cfae935bb84694dfb5b70da794f42f0861f262d4761a0452322ce4f3d21f24ff6cb874c7cb1f4380a6e0adafc6c9798254c0ac

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h550saij.default-release\cache2\doomed\25084
                        Filesize

                        56KB

                        MD5

                        efbf300d55fa5a5eefab41e1eb391eda

                        SHA1

                        7940761f654262abb958ad09e56a6f9339f2c8d9

                        SHA256

                        7034266a9abb98b652f22d6da5c10a239207675cf607768994f8df7bbc1c5107

                        SHA512

                        c8fc1aba05078644505d54a0d1d971917d6c5f1c23bc58eacd85a0f54164472aa56d93adf076266bf1c9a4ecb7ab0c448baf8d606bdafb8c498359bbcbe71c80

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h550saij.default-release\cache2\entries\1A5996C16946393FC0B184220943714409DE2FE0
                        Filesize

                        43KB

                        MD5

                        094a5780ad793e9dd76e7a9315a3ca8e

                        SHA1

                        43725bd382fe5fff011acd27542ca405ddee14e6

                        SHA256

                        c758c43ba91c100b2102f235b78c181dfff2920fadd286a8bf67500d0df02020

                        SHA512

                        c8091f9d6d3542569970e1c346b5035eb7f191979957ed449e03ea17dc097de97032fca53f509197b9ab21f4ab7b6de5a296bf40b504fa6944616eebb2c371e5

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h550saij.default-release\cache2\entries\2F879E430745EC79E1888DA9C3EA593AA94D739F
                        Filesize

                        25KB

                        MD5

                        8f3d9a1368bfcf5a400d7e1422a04c4c

                        SHA1

                        69e85dfc9ac74a88d5305bd2bb6fb182129d25e7

                        SHA256

                        bf45b4f32901d3d17cbc6245b027b800102bee2293cb084c6612936fe881293c

                        SHA512

                        da7091a5521af23f77ae5146ce1cb885bd9aa7ddf6af5041ce2fed76d409457173c09bf9d705c8da5df53f68ef8c020f34098158f5700c0699bb5ec0c39ffc3d

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h550saij.default-release\cache2\entries\311589B5F7E27FD8DAEE1AEB3F2A1C1A3FFED5A9
                        Filesize

                        16KB

                        MD5

                        c1ffc99034a4ccd9c0a6e897b828ef7f

                        SHA1

                        7caae9d271e64be0fca7fb238f19d562291b31f4

                        SHA256

                        9ea763638eb0719c306f5b6617c19b3228ed1c25986588052fbc4b9b2ec9c611

                        SHA512

                        a15f8aad3a1e74f1beb8d7aae669475b48bebc43f32433a3dfd1c3fe4e15589ad8a15fa51ad46cd8829b5a8fdfdc6bb7a036d7f43ad1bd1a68efb12bb6d8db78

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h550saij.default-release\cache2\entries\33809CDBDD69269236BB05F66DFF2693F384205C
                        Filesize

                        60KB

                        MD5

                        45fe4e00a251bd105775f211f6638742

                        SHA1

                        3b61c38ccf6e3329df834e433849183683f0fc3e

                        SHA256

                        593550482b78ebab051b429aa5eba6142d589c43cfb06f625f07fc5ae94d4f53

                        SHA512

                        55302e7017344f90dac1328fa20b270e7f94506a9a77756339142f38058a0b67c1cb12681ae22f95dd1c4c9cae9d864a50e3a97d0dd1035fe2795ae0d696ed9d

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h550saij.default-release\cache2\entries\35547F305B43F28C7F3664D49C1AD32A7112A1A4
                        Filesize

                        34KB

                        MD5

                        c68d24fd73fa3e077be69e33a0e1cfbf

                        SHA1

                        28c3cbfbde7c4a8f3a3bfb0aaf5acba261a8a458

                        SHA256

                        76ce473f18fbc77a6440e46cda5f733b5af1eda762228b1630f76961ffbf1934

                        SHA512

                        bf735348f93d2187f594fb3fbf30df1ed7285b86acf0585538699f874a59953991e451c2031f5f7960b2ee2b611ca90af519a377965aa3cd4c4a6f9785ac9af8

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h550saij.default-release\cache2\entries\3A1FDC6B34A57BABDC117F984BC456C512AF3C8A
                        Filesize

                        95KB

                        MD5

                        282068460e481be01beb97b83742989b

                        SHA1

                        a17510cc5c139a3b04677dcc2bcdb04c01dfc647

                        SHA256

                        d3713059be420cfbe0d09a977d7eed505f085f0dce42c51e874e05b305a7f27b

                        SHA512

                        d7cacbf09ecc5fee67dae0057ef0a350661ca214430453585c027b13463e8b135bc9b3672545de517d2dce8de7c2407aa7e3f890d482b14f53dd94a7a2ed5ed2

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h550saij.default-release\cache2\entries\5ACB46A5A72DCA2C675A19F9DCC5C68E4EEE16B7
                        Filesize

                        34KB

                        MD5

                        5f7cfbf275f436fc447b77e7484220b3

                        SHA1

                        c091543a737b57bbbdd0d236e23ad78d07244c62

                        SHA256

                        f0ddd9e97d65a3eeb2dd977d7b3304a0e8d7ae2d9e3688012eb23bbda017319b

                        SHA512

                        02894c609dde24a7bca9e1325ef8bcfbc92b86905bc567241eb5d1ad9b2e91efa0e15b2d9b056feadc1f43017fa55ea4550c9eca00096e869b475b4307968594

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h550saij.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
                        Filesize

                        13KB

                        MD5

                        6e7691411606700a82f24a0992195eb9

                        SHA1

                        7ae084918f2de77d277e086bf5196b36d5b74a78

                        SHA256

                        8e5c9482aa10836002fd43dfa8390ad56c05c07c3623ba796ad8e35ebaca991e

                        SHA512

                        d324b1f1bcde9aa33630c3d207076f63b4429b9a73900d25e6ce6edc91fa5c07feade5b2530a9c5f79ab1988a48423b24c2173e4d17b5625ecab83f9702e39c0

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h550saij.default-release\cache2\entries\8D11864F69B6D9276086D87F1C72386DC26A1DF7
                        Filesize

                        17KB

                        MD5

                        2452594c82b75b7b2b816046718581a4

                        SHA1

                        6ce76183a4f84b0c347aa3399b57843b41071f7d

                        SHA256

                        125d9eb73ce5ed59a39a10b8161e3357eb23d0a9339123b84b7af140b064c51c

                        SHA512

                        6e7702c63c1bb4186079d53e75c38455d974f971c04e977caf5b2721587f49dd36dd95fffc3f4db5f4b70eceab4c0cbd0e60fd9a0bafc5a86400bbe4a491aa86

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h550saij.default-release\cache2\entries\956C138E7E189A8F1B675B499ED2D87604EE6E73
                        Filesize

                        16KB

                        MD5

                        dd5e4d8a70ce53f1256c0e72c0ea8cf5

                        SHA1

                        1f48038cd28e8ff9eb33fbed8e7cf41d77dea1a3

                        SHA256

                        fc75843b48d923fe79fe64b35e16c6191337f412e14c6c83515cf9f15574a13f

                        SHA512

                        31f214211041e5df9119ac742c68749d073fd6e5af92336a681ff979799189980036490724f1240b7deb29edd8f69a1eddeff8c7b19eb3f6c283c56cc8b7ae88

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h550saij.default-release\cache2\entries\97AFFA25C9ED84269BA5F8059413E057B9831B3A
                        Filesize

                        41KB

                        MD5

                        89f81a0ab06e4a68693024532206ebe8

                        SHA1

                        0807c340f453817ee89f6c5cb8e49a2059d80933

                        SHA256

                        d8ca0c581c9386fffbb892d2422cb9392fbe1ae6a5a33ebe4f5cdfe6c3a254d3

                        SHA512

                        f6d49cadb0cb42be280151afc357adbe5a2a729c187b3d0803b0ed8a8d3274d614b899d14a38f322c3ae00bfb02bb157111dc6bbc2cbea4e23f4e304fb340fc1

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h550saij.default-release\cache2\entries\A6C74BC2260EAFF823C7AED38BBA607C962CCB55
                        Filesize

                        39KB

                        MD5

                        fa3376ced554f66cbb19af1c08a46fd6

                        SHA1

                        aa7543debf8eb45a47c6f53438038de69b0ce5e9

                        SHA256

                        08a47db6dd089936a812982aa5fb77230b2c788f1a4559b98674b94f02589df1

                        SHA512

                        428f07a68e40eac6596ab6dcd30d62a773c5210683c92249099f73b5244d0f82bb9103bf80c79573d3387ac89d61fe312390221b7040b3633b20462021e72042

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h550saij.default-release\cache2\entries\BC02779E4549B742F87E407101403B7CA65078CE
                        Filesize

                        45KB

                        MD5

                        53317437523498525ed306c89d34688f

                        SHA1

                        af1cc1da0460c7624138220f2a14947caba17623

                        SHA256

                        ccae5fc12ebef77be559c2e88496173ccfcd8db078ac679f360d13904c7b6fc0

                        SHA512

                        c6341bedf21b62bd3ca6bf75ef6971081a47b1bbc268448927bbcedc46d72cad587d724fe7507d3b5eca4bd8f542fe19a4491c6ed7ac4b567885da08ebe8e2ee

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h550saij.default-release\cache2\entries\E19316B1CDA62317F9DA2551F9B56E711FCC77AD
                        Filesize

                        13KB

                        MD5

                        385a2b5199c8cea260cf1a73d4b377ff

                        SHA1

                        66c0bb339cc83c1e88ccd50da7c43f9ebd8b4221

                        SHA256

                        b670350c0f3fd3ce3372a13f71ba299a3e4210000a7b7723b44f49007ba58d1a

                        SHA512

                        cb34932bf11b7eb350588cf4636754bf4dbac6b7348d1dd54e0cdd4276cdae9133c78473be787e81675130bf52a2d1360b5617190cbd97e2b0663eedeadd94ce

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                        Filesize

                        502KB

                        MD5

                        e690f995973164fe425f76589b1be2d9

                        SHA1

                        e947c4dad203aab37a003194dddc7980c74fa712

                        SHA256

                        87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

                        SHA512

                        77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                        Filesize

                        14.0MB

                        MD5

                        bcceccab13375513a6e8ab48e7b63496

                        SHA1

                        63d8a68cf562424d3fc3be1297d83f8247e24142

                        SHA256

                        a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

                        SHA512

                        d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                        Filesize

                        18KB

                        MD5

                        29f3e5f986302e5526a5ea6648917817

                        SHA1

                        1626afb283b560e3e2494b3ab6ea10fc1124156e

                        SHA256

                        c82bbda2473ddef47fb32781291d5b09251be969d780a7e0e6f11a2600a13f14

                        SHA512

                        630ba39cef45586c0367b8a65824760b6177d50d7ad5c6f7966ddf72eb79cc29db00dbfb2cc1dcf252c3b606705c36f2ba188d43b6a2799c652babad4fedbc90

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                        Filesize

                        20KB

                        MD5

                        b7825792e9244c662560a076b41d72bd

                        SHA1

                        a46c938ca6501e7c8061cbb1e78f0e281ae61548

                        SHA256

                        eae574c8e2360a40ccfe7889d7801fcf1bc286bf4b513fa12525064d4757bcac

                        SHA512

                        f5479060b50c26cf761d42aa7f7658d7a3bf3478498f6f6b93d311e10209383ba230e237f0059308e3771b4f660cd13ab0db519826ddec2a63f34562ea4ad7dc

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                        Filesize

                        20KB

                        MD5

                        3cc63c22ea75abca352e2a41536e03ee

                        SHA1

                        c9f1ec3e26b8f947f8a35daa5fe6d7028b3172be

                        SHA256

                        1e95e9fcb5c04933948734408f684ab798d0b1ddea0799b91d5e8c217bc8fe90

                        SHA512

                        2c423a131f5b77f71d0f467aeaed4976e969c0c7d42f75bfdff25289cf40a9efbbdc96a7c12b824890d5044a94e91d32c90b477e0d05bd5b4d112a37ce5a0805

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\AlternateServices.bin
                        Filesize

                        7KB

                        MD5

                        6a0427affe6aabdc34413334b4361348

                        SHA1

                        04e9a6bf382f4cca7cb8cf9d3c9ccd9f1dc4ff39

                        SHA256

                        22e972ccafc3c0824325eeb6a266ddfa2915700823c0d57fb226df7a2faff764

                        SHA512

                        3be3d72a5dd8d453dceb4d813f7ebac84575e10425fcad44043869c09559769487ae7fcfd724250e79ee817a9a1decf0a18febe6e5a109bdb0dcd5db17597323

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\AlternateServices.bin
                        Filesize

                        11KB

                        MD5

                        d4817cf49fc670aa15cedb6df0a1fe58

                        SHA1

                        63493b0b20f68299fe1c8a15a49d5249bf2e700c

                        SHA256

                        2461001cef5e3490f0ef147dc0988672882ad6bd3b43461f19cdc111b39c0812

                        SHA512

                        db30211f057373eacf081bdaf09c18fc37d77c67d002bfdd854f1a48bd628e888e4f8077523b865412c3430262013f192b770b7675dd7850289bc4a2cc24fc1a

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        7KB

                        MD5

                        d6963270c1abf5e3e3ec80a4b3ce5629

                        SHA1

                        fdd9e62eb83fdb7883f022887227d25d98000193

                        SHA256

                        8bc11fa2c0f300b779736d1c800ebe75dd696287e02374d949d066b70632dc43

                        SHA512

                        0406a228f55c2593f452b380c6a677124492218275cc0b06a29fef1686a9cd393f6a4434578cac331ec914d7fcc364b8b8388953f8dad2238b518c892139c2ed

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        6KB

                        MD5

                        7a2e89761234f7336b411fea7b3f178c

                        SHA1

                        4eeee45d3e17eead28fbfe0a5d21ce45b2dd19ed

                        SHA256

                        c705fb711aa8a16cc8f8a07e19a26f5bb1e7ab03717d65a9a2d2ae27355dbb7c

                        SHA512

                        44dee199632a6da44fdec245f160db5923d08573e1a2ebf7e8d773b3435a404afc67d1027d962e1872af31d2b93b078c353c953cc8c79a6187e7775507b10215

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        6KB

                        MD5

                        efd0af4488eee89e43fa07309b377b6c

                        SHA1

                        c45c8025cdb98a6ed7854cf28034ad04daf33223

                        SHA256

                        d258e04bf9a76944a4604c5d6ec7ffd10110deb6fe753edabf18cdacb7724f5e

                        SHA512

                        322929d947456a64bed84bc80454d6d6b8e933940a9f890e03e8c26a53ba9fd1d3727d02cb86e5086b97fd8f0388491457fe6c0293d5ee6528744ea8c6d18e49

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        6KB

                        MD5

                        ca56f787a8611b4ddc465472ec9e169e

                        SHA1

                        238a748190b08e63deed8b5011f92098ce953d1a

                        SHA256

                        448c32f8fae48053cf21a0d1aefbbee176389241bcb5518d1d04b3218dbf1f45

                        SHA512

                        ce3577f9ce78e68439f6db42241937ada233d1933ed1f9df2cc6763d6556e896591b0cb8d2637ff2ef71bd258d2ee119affd3c14cf5f67e5eb9da04347309299

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\datareporting\glean\events\events
                        Filesize

                        4KB

                        MD5

                        59999ae9af46660f862df7ee62200fe9

                        SHA1

                        e7699f2a0d0edf3089abf81903c841165b94de34

                        SHA256

                        c220818cfa8c39b25ef5add5af7cfba40b3a51b42811d52e61a6cc98e2f93efd

                        SHA512

                        57c692050bbdd2777e9f31b271e646a8287e5b7207384b8299d697d7087030dbdbb1672680b98763019ece5bef1e6028ee3b25322443c0d222fedeffe08fda6b

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\datareporting\glean\events\events
                        Filesize

                        1KB

                        MD5

                        02592a453b0c3706831111bf9e755620

                        SHA1

                        fcdbc90f411b4a78f93089b89651adc1620fd5cc

                        SHA256

                        d9a71f122b4d971e54c2eb08429a44bf6350cb47ab35cb729468f3cd2d38e47b

                        SHA512

                        82a29d705dd3f48f94193bb0bcb0bfb9e26b7f6b079aa681c04c5a16ed457d541ba9c2cc50c653dc3080c61787a721701343a31ab1a31822dd1705abf432e619

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\datareporting\glean\pending_pings\003430b2-0b0e-4f3d-9557-b8b27a91dee4
                        Filesize

                        883B

                        MD5

                        7974c8f0217bd55bdfcb3f8753d22996

                        SHA1

                        e3a8b0a99e02a1c2647f7b6586039e42f873dcd2

                        SHA256

                        2496f11d8cbde828c3e83be65f3945d60d3098890412b39c8eec0c0dd4868fb6

                        SHA512

                        82b8cc9be25d395269ddec2d0167e746117a016d9071e2aaf1963b127f5c7908d59c88019d741548e1b4c2d244c7aead3c9f436735c753c5a59ae14fac4de0b9

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\datareporting\glean\pending_pings\2cbcfe21-634c-435b-a3a1-e6c201d293b6
                        Filesize

                        2KB

                        MD5

                        b68f6356a637bc99d612bcd31058d8e9

                        SHA1

                        4322fdf6aa34fa8ecd2624d016d96a184c714aad

                        SHA256

                        d053638adfdcccbe9d16b9b5b6808ed313510245b6301a5b10ae685558e9d149

                        SHA512

                        584c14df7b1287b647b40294293c24431ee0a6a429dbfdb4e46b68f0df91999417ebf3feeb4c98761f24af1221c2edaa22e11f3999c47f7c4374b6b75b61bf6b

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\datareporting\glean\pending_pings\36d3a202-ecdb-4d22-a8fe-e18675e3ce7d
                        Filesize

                        235B

                        MD5

                        3814fceed00242c501ecc41e07f42aad

                        SHA1

                        fad7bc074c923b68ba5504f9686403eda41a6a64

                        SHA256

                        01a139f96d83ade10e254fe30692c94c12e61ecf7c19c915c442f386e246efa7

                        SHA512

                        525543d85a5e01ab80afc712e823f090d2a6e56a32a99733fd154e5f6058fb67bc787398028ffb79d74d740d7c4c2ae4ea68e06456e551e44451d473a040837c

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\datareporting\glean\pending_pings\64c30c6c-eda5-4410-8fc9-43f8f254b799
                        Filesize

                        235B

                        MD5

                        c47c720a8995e2c6ad2ef0a87a926191

                        SHA1

                        3e6c06dfd9188ab0ff315cd693372fc0d818de61

                        SHA256

                        e131dba63db2a8993940d5083d1426d05cac17dca7e75899dedf4059affb86fb

                        SHA512

                        64ff40484e149d0a533efd65c12ae2879260c712dd212962621a5e26b55e49869443be60e2faeb8491edb11a29f303a16f90c4e9a9e2f6467089ff008f9c571b

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\datareporting\glean\pending_pings\a22694af-461f-47ac-9c26-769d06f1a4be
                        Filesize

                        15KB

                        MD5

                        8e4c0979fc57f34abb0316d3efa927d7

                        SHA1

                        9e2c85dff243cd4aad9d34cdfc19050738f2e784

                        SHA256

                        1ae2b3354277e677e756a5017b5fe0efc54a32746419999854dc8ea4671b4f74

                        SHA512

                        242f79b4476388f0571956bbf4ca84400e88b2f83206752ca1b3aa42ef321cf5578520b70a277817411de2e684fdc2ef4935c693a4f9fe3a3898e0a4ac3c4d0e

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\datareporting\glean\pending_pings\b4bcbb58-e4d5-4947-86d8-cf3bd6f7f333
                        Filesize

                        886B

                        MD5

                        2df7140f5cccb5c3c2ff058beea8e08a

                        SHA1

                        0cf9196b6fd72e4bd4976e5c9f7da3f1eb645555

                        SHA256

                        acf0e621c7c4d9fa466f80a8c40a2a1e8ea513f57e71e160fd4448671a5d2d1a

                        SHA512

                        a126ca7946dee585e05618887391966331f0ed82c6b8b54559c359b931a6bfe53f92ba239362d40fb835754eaebfcbca8fe1e35b84ea5a18568d862f17cb3806

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                        Filesize

                        1.1MB

                        MD5

                        626073e8dcf656ac4130e3283c51cbba

                        SHA1

                        7e3197e5792e34a67bfef9727ce1dd7dc151284c

                        SHA256

                        37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

                        SHA512

                        eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                        Filesize

                        116B

                        MD5

                        ae29912407dfadf0d683982d4fb57293

                        SHA1

                        0542053f5a6ce07dc206f69230109be4a5e25775

                        SHA256

                        fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

                        SHA512

                        6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json
                        Filesize

                        1001B

                        MD5

                        32aeacedce82bafbcba8d1ade9e88d5a

                        SHA1

                        a9b4858d2ae0b6595705634fd024f7e076426a24

                        SHA256

                        4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

                        SHA512

                        67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll
                        Filesize

                        18.5MB

                        MD5

                        1b32d1ec35a7ead1671efc0782b7edf0

                        SHA1

                        8e3274b9f2938ff2252ed74779dd6322c601a0c8

                        SHA256

                        3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

                        SHA512

                        ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\prefs-1.js
                        Filesize

                        8KB

                        MD5

                        24247863b0825f3de9d7351c475dce00

                        SHA1

                        2df56b5532c66a4a86c96ac0f27ed84a02bc78b1

                        SHA256

                        6735ded5b02b514fbd95cf6f69caf8082f859e2c6c100ddf6438b91a1071f33c

                        SHA512

                        398ac1f13f27d0955ae983b1aed287892310a27df6e626af663e2c19f033b5a11bafa8d4a93cc041def8faee6a7fd2535fcf183b553d8652aecab6afc5833b32

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\prefs-1.js
                        Filesize

                        6KB

                        MD5

                        5137cd7011378a5c3246d494e47c93e1

                        SHA1

                        8dd0f611c121a9899f0767591433f65e4fdcff3c

                        SHA256

                        999a0e8aa74844db4ae8fb622606a985b7f57d496fd21ae307607d8aa52716e9

                        SHA512

                        a0241d2e0b72a01eea5e5358201f845ebcde474b9d23262559db8b0ce2274e411d437324206dac2bf3e29dca4c32f4a08c7cfa3bf5b799b433a8f792827da22b

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\prefs.js
                        Filesize

                        7KB

                        MD5

                        40a1c684886f2decd1d5784b84ac0091

                        SHA1

                        063bca84dabff8fdd888dd6cda8b7d3019473105

                        SHA256

                        89f8c54856725b400c4f8b69f090bd6ed67014f3aa7bc5c7419d6c27e4660b76

                        SHA512

                        33951a0856571ffd7d24fabfed6ab3b90232f58cb026f655ac558cdfe80f7f6b86ece16b4f7ac489f56b6c074a20453639198e989f28d9959907015296ccfaa1

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\prefs.js
                        Filesize

                        6KB

                        MD5

                        6675375ded2cc208f8e6f592aed8fd2f

                        SHA1

                        19a97b58e0f1f380363df17667fa74eab203c5ba

                        SHA256

                        f08172928b9dc70a5ea8b085d6ae4b58c4e663a0482ec037bbd51c8c1a9030c8

                        SHA512

                        447746c85b662de8abed0de65a715498a833a31f7bd6ee33632fb90726c29a135e2d1bcd6822c4f0acd1afb680ae6369621745d2324e6fc090250a56899389a4

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\sessionstore-backups\recovery.baklz4
                        Filesize

                        6KB

                        MD5

                        72cae5ffbcbb804c39ad7fd9db047ffb

                        SHA1

                        2e3d57ac85efa7be360e95900b9d81165036c85b

                        SHA256

                        95e0046c5b2f0b445a7ef0124f7140fd96981cfc758562bf059db6a2c43c1980

                        SHA512

                        d355c95be7e243ee7dd5446216de4863ba439c3605cf1fa06db8c664b4e71f9b012e34068a7e66ba62e56a1158766ee33d2b227656080ff0e5b8057e2bd38ddb

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\sessionstore-backups\recovery.baklz4
                        Filesize

                        6KB

                        MD5

                        a323a81b16adb95441a575c54150ec67

                        SHA1

                        d72aec1566c38763afdf907837e70383baf91c3d

                        SHA256

                        0d82d91791cc3bc0859716d1f6a1d631c8813f4ba449899b4ae1934d39d6717e

                        SHA512

                        b500fbd6cdde1bbdc44e74df9522a158306715368385cca7604319fee74d5ae1e328f2f22653d28d8a41517c3ffb9b951d19736895b084cccb97060c5686db7a

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\sessionstore-backups\recovery.baklz4
                        Filesize

                        6KB

                        MD5

                        74258d76c82d73da95c763b229d86c07

                        SHA1

                        32d5c2e599c9395919dc6b92534870e3019eb682

                        SHA256

                        6f1a13ec84cbae14c8180208b999fcbc697b0425d737abc981ab4b2f8fa62b7b

                        SHA512

                        536eb39501529bece2d37a85a6b3347a2cf3e7db7577a77eb0fb9147f4422cdd15322768144883652e13d297d568ec8cc2e97bef08cc66878c6f0a70e463a559

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\sessionstore-backups\recovery.baklz4
                        Filesize

                        5KB

                        MD5

                        3da4da399f0ec43470509426522e9a9a

                        SHA1

                        22737469b0be27a89a0339fa47bb4bd727781ed2

                        SHA256

                        a70818d6f9ebaad4fa2acb1c2f01c480f27f3786fa70384029ccaa14cf30f83c

                        SHA512

                        24469a2481c31f67b235d1204f016420a7d9df39309b9ed7eeafba88b6ac593caa54636257dab5e745352b01d4fd79473fca248a52be097924709b4f92e60ea8

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\sessionstore-backups\recovery.baklz4
                        Filesize

                        6KB

                        MD5

                        19d471eec5e708ac6fe582f0c5e2e327

                        SHA1

                        263c5f08f0b6a7e2023b067b87478316d91648f5

                        SHA256

                        e74eb23b285aafabfc4b2486983571ae1400baedeec42b1b60dc92eefc1ec3de

                        SHA512

                        eefb979b88eebe3eaf4f3365d6f1d151aca58ea1ee72840616d3641822e9dabecb303a0cb7ee6c19d79214fc5f2b709b7abf7b344db9bb854cf7a65cb16f1ecd

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\sessionstore-backups\recovery.baklz4
                        Filesize

                        3KB

                        MD5

                        7d950b55c1476cabfb37a92e43f9a917

                        SHA1

                        7d4bdf1b2f30c9081cb06ff7f1c0ea3e3520ff5b

                        SHA256

                        6dc28d9b7ea2e609ffcc590b8c4bb4d5c560a5efb7b81648533d39fa82eabc38

                        SHA512

                        620f52ad10a5b629225991616ec705a2b4d39810e9f1405c4abc715589759fd0412179fbcc6f8c9765804c75d14e0903ecbd9c7c058a87b3d638dcfcaf3060dd

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\sessionstore-backups\recovery.baklz4
                        Filesize

                        4KB

                        MD5

                        4761f2fa4212e517cf1e9774246984d2

                        SHA1

                        e98c48dded29f6cb802ba2631779e0e7fbbf85e9

                        SHA256

                        8789e8e5fc76c06cd15e161aa14f2941b5390657cee32cebd38010ce7aa72da8

                        SHA512

                        54cf51d042427c8401d91c0592708b0323e4b32e191a1cb3fdb03c443bb96366f9e40122cb99c40ad883afe55ea4370eca4ed6cea5d7e8644969fd20ec8ecdfe

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\sessionstore-backups\recovery.baklz4
                        Filesize

                        6KB

                        MD5

                        533cbacaaecf593078f765504c9845fa

                        SHA1

                        4f140ac4288adce72e78a0726a707f1546487a62

                        SHA256

                        2e8a20d9bad07ec5052dbddc0ae26404fff8b06dd7e0b520f9467584ec2c1596

                        SHA512

                        0a3126bf115874e75b5bc073be2b4360571480eac138cb700dfb08006dc9c23f45dd5a6f8f223aa8867664e951b251180c39a80d24dcb5722e5bb3cf5d488676

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\sessionstore-backups\recovery.baklz4
                        Filesize

                        6KB

                        MD5

                        d897dad8bee688a9aa06af160d8fb876

                        SHA1

                        618ff0fa8a76cd2a56b87fc49d217643e211f3d2

                        SHA256

                        f3ec51c849c7b7afc37bcb223bc65f5c2774c9fc0032b3369cbd5c964c40803a

                        SHA512

                        9720ff06784c4caf54d66efa1bfdaede6f7ffc81acda4b496b7beaf3a079f9d9329800e2d1f7a6a8f99e440119983bd7be704cb593c7e1a372ffa42372223b01

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\sessionstore-backups\recovery.baklz4
                        Filesize

                        9KB

                        MD5

                        8344d824a18bbdc9f55ba9591e72e8ac

                        SHA1

                        6cbeaca65a8765a01b60d4e4dcfd909312ca2f57

                        SHA256

                        3d8205350335cd716d61c9faeb35972fb4278eb280330952d25f27ef5cd7448d

                        SHA512

                        c16f9698fb4c2c89eaa4f2b9f197fcd958e7a56c28a529ac30dce763dc3534224f0e8e67d32dac54a53dd2a997d02b076b6fd3b6f25492fb5cb1e4360a8153a3

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\sessionstore-backups\recovery.baklz4
                        Filesize

                        6KB

                        MD5

                        15224eb597bc16afc8c20ea69a9ac05a

                        SHA1

                        e4f2a74a3884d6c7680d0b40ef7488affb5f1616

                        SHA256

                        f30d0b1e68f63af83e04b5189014bca842d88fea3fe901de09a72439505abb67

                        SHA512

                        3711acac4f396b06eb60638a52789a76ea101493aa9acdbd8d4768bc6d6cb1671573da0208199c3a6e9c958e5a348c2a1d47bb2111be242e23747cee8363c773

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\sessionstore-backups\recovery.baklz4
                        Filesize

                        6KB

                        MD5

                        31803227634c1947517e8a32a00f1b83

                        SHA1

                        2017e66895d991e9b30ebe9b128728db16d50597

                        SHA256

                        9c9d9746cbedadbc51b78993d19bcf07632ef3633f7161028e81de5e086ce40a

                        SHA512

                        9c21255b4aa795ac3864a58a921db6bde532b1b29b001f5d51997dda238685e0699a21164e7338360b4350154a4f041dc635420e3286f00fd95301e7fa275329

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\sessionstore-backups\recovery.baklz4
                        Filesize

                        6KB

                        MD5

                        25a49acf3063822c3a532ea366b6ec48

                        SHA1

                        e751d9c920f12636d6408a8d013249a7d570d4d0

                        SHA256

                        49cd725ec292f917f6e86261140f46f85d6f0cf8758afc5df92fab28e2253f12

                        SHA512

                        6480b7eecc6b783ebdd337708e08cb014f9230cbdd0da5f1c31fcb0e0882332596f7860798b8f521be755c5bcea1c0aac65a1b1b5ae53c0f4c34d04ffe449dc5

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\sessionstore-backups\recovery.baklz4
                        Filesize

                        5KB

                        MD5

                        f9daac4dd2d49e0f981e21a21c016b96

                        SHA1

                        87bef88cda355f61e26b7d75b68fd59fb089641f

                        SHA256

                        80d336ca122e75e9bbea1d8f44af9fc535651fe73613e99742ae3f8dc1bbf69d

                        SHA512

                        7f8d9ea1773a33949d1a5a8029350f65f91541ff00569c27b4805cd0ffe89215459cc4f250b5594e099c8be74235fc13e6129643a1cb54e6569ee52a94aed6e5

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\sessionstore-backups\recovery.baklz4
                        Filesize

                        5KB

                        MD5

                        9cd8f228724c64843337b6badbf0ab1e

                        SHA1

                        045c966f9bc47742bad720efe5d4356f28b946c2

                        SHA256

                        f2e410e5c9b8180c1df3115ebb041db196d1ba990dd4094e66f3cf1fd2a30741

                        SHA512

                        30e92e53c95f3d98f362f0e681b5a249d0c702c26aa876abdbb8b89e03dfa0cb2a8de8753908a95560ef0faaeb8c6967c949c17213d63d83957694458fe6c1f1

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h550saij.default-release\storage\default\https+++github.com\ls\usage
                        Filesize

                        12B

                        MD5

                        2702cf2c596653e7f819ef8043199bb4

                        SHA1

                        b618a3a9dc7ca128c3758fb6679268aa2544ffb6

                        SHA256

                        9bc44582e16d35b2afa3d21dc832f961f8de3a0507f4c3039df5053abd56fae6

                        SHA512

                        948b978f1025ed8e5494ee708a31fad9ba2c3c186c7f64f0a29c0fbe502ae9536bbb3c731cbc50b95992c8045dc8a8f3d65a90012bf7d75bb323dfe950758fd9

                        Download Submit

                      • C:\Users\Admin\Downloads\Amus.gfq6pdWF.exe.part
                        Filesize

                        50KB

                        MD5

                        47abd68080eee0ea1b95ae31968a3069

                        SHA1

                        ffbdf4b2224b92bd78779a7c5ac366ccb007c14d

                        SHA256

                        b5fc4fd50e4ba69f0c8c8e5c402813c107c605cab659960ac31b3c8356c4e0ec

                        SHA512

                        c9dfabffe582b29e810db8866f8997af1bd3339fa30e79575377bde970fcad3e3b6e9036b3a88d0c5f4fa3545eea8904d9faabf00142d5775ea5508adcd4dc0a

                        Download Submit

                      • C:\Users\Admin\Downloads\Fagot.JI2cfn3o.a.exe.part
                        Filesize

                        373KB

                        MD5

                        30cdab5cf1d607ee7b34f44ab38e9190

                        SHA1

                        d4823f90d14eba0801653e8c970f47d54f655d36

                        SHA256

                        1517527c1d705a6ebc6ec9194aa95459e875ac3902a9f4aab3bf24b6a6f8407f

                        SHA512

                        b465f3b734beaea3951ff57759f13971649b549fafca71342b52d7e74949e152c0fbafe2df40354fc00b5dc8c767f3f5c6940e4ba308888e4395d8fd21e402b3

                        Download Submit

                      • C:\Users\Admin\Downloads\GtbRQ3-y.txt.part
                        Filesize

                        10KB

                        MD5

                        8e2c097ca623ca32723d57968b9d2525

                        SHA1

                        dccfb092fa979fb51c8c8ca64368a6f43349e41d

                        SHA256

                        556700ac50ffa845e5de853498242ee5abb288eb5b8ae1ae12bfdb5746e3b7b1

                        SHA512

                        a468476a8463c36c2db914e3fe4dc7aee67ac35e5e39292107431d68ab1553ca3c74255a741432ba71e8a650cf19eb55d43983363bfc9710e65b212fba37bbde

                        Download Submit

                      • C:\Users\Admin\Downloads\MeltingScreen.exe
                        Filesize

                        17KB

                        MD5

                        4784e42c3b15d1a141a5e0c8abc1205c

                        SHA1

                        48c958deba25a4763ef244ac87e87983c6534179

                        SHA256

                        9d355e4f9a51536b05269f696b304859155985957ba95eb575f3f38c599d913c

                        SHA512

                        d63d20a38602d4d228367b6596454a0f5b2884c831e3a95237d23b882abd624de59ea47835636b06a96e216f1decf8c468caacd45e5d3b16a5eb9e87bc69eb97

                        Download Submit

                      • C:\Users\Admin\Downloads\MyDoom.A.exe
                        Filesize

                        22KB

                        MD5

                        53df39092394741514bc050f3d6a06a9

                        SHA1

                        f91a4d7ac276b8e8b7ae41c22587c89a39ddcea5

                        SHA256

                        fff0ccf5feaf5d46b295f770ad398b6d572909b00e2b8bcd1b1c286c70cd9151

                        SHA512

                        9792017109cf6ffc783e67be2a4361aa2c0792a359718434fec53e83feed6a9a2f0f331e9951f798e7fb89421fdc1ac0e083527c3d3b6dd71b7fdd90836023a0

                        Download Submit

                      • C:\Users\Admin\Downloads\NakedWife.CvyQ0x-q.exe.part
                        Filesize

                        72KB

                        MD5

                        da9dba70de70dc43d6535f2975cec68d

                        SHA1

                        f8deb4673dff2a825932d24451cc0a385328b7a4

                        SHA256

                        29ceeb3d763d307a0dd7068fa1b2009f2b0d85ca6d2aa5867b12c595ba96762a

                        SHA512

                        48bbacb953f0ffbe498767593599285ea27205a21f6ec810437952b0e8d4007a71693d34c8fc803950a5454738bea3b0bafa9ff08cd752bf57e14fedf4efb518

                        Download Submit

                      • C:\Users\Admin\Downloads\Pikachu.gAu0rXkQ.exe.part
                        Filesize

                        32KB

                        MD5

                        715614e09261b39dfa439fa1326c0cec

                        SHA1

                        52d118a34da7f5037cde04c31ff491eb25933b18

                        SHA256

                        e1dfc005d5403fb2f356276f0abe19df68249ce10e5035450926d56c2f8d3652

                        SHA512

                        fe905c388b0711f54941076a29b11f2b605655b4a3f409d9f0f077f2fe91f241401035310daa490afb6df50a6deff5456be5ee86984e7b9069506efa07af51ae

                        Download Submit

                      • C:\Users\Admin\Downloads\xpajB.CtgtEm1K.exe.part
                        Filesize

                        520KB

                        MD5

                        bd76fc01deed43cd6e368a1f860d44ed

                        SHA1

                        a2e241e9af346714e93c0600f160d05c95839768

                        SHA256

                        e04c85cd4bffa1f5465ff62c9baf0b29b7b2faddf7362789013fbac8c90268bf

                        SHA512

                        d0ebe108f5baf156ecd9e1bf41e23a76b043fcaac78ff5761fdca2740b71241bd827e861ada957891fbc426b3d7baa87d10724765c45e25f25aa7bd6d31ab4ec

                        Download Submit

                      • C:\Windows\SysWOW64\shimgapi.dll
                        Filesize

                        4KB

                        MD5

                        8750df7c3d110ebc870f7afe319426e6

                        SHA1

                        a770fff05a829f666517a5f42e44785d6f0b4ae7

                        SHA256

                        fa3f934083746a702de18b927284f0145d4b82a92f2111693e93a4f762b50c00

                        SHA512

                        dfcbc2ba358ec40143e842d5242781a59943e646f50c41010a8cc4e2c5a15d5b19dcd2ee9556a0317ca73283e84d1f9d1b0b8b7470b493fe38e4e027336b8a2a

                        Download Submit

                      • memory/504-1062-0x000001B9DCD70000-0x000001B9DCD71000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/504-1051-0x000001B9DCD70000-0x000001B9DCD71000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/504-1050-0x000001B9DCD70000-0x000001B9DCD71000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/504-1061-0x000001B9DCD70000-0x000001B9DCD71000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/504-1052-0x000001B9DCD70000-0x000001B9DCD71000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/504-1060-0x000001B9DCD70000-0x000001B9DCD71000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/504-1059-0x000001B9DCD70000-0x000001B9DCD71000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/504-1058-0x000001B9DCD70000-0x000001B9DCD71000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/504-1057-0x000001B9DCD70000-0x000001B9DCD71000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/504-1056-0x000001B9DCD70000-0x000001B9DCD71000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/940-1101-0x0000000000400000-0x000000000040E000-memory.dmp

                        Filesize

                        56KB

                        Download

                      • memory/1912-1106-0x0000000000400000-0x000000000040E000-memory.dmp

                        Filesize

                        56KB

                        Download

                      • memory/1912-1075-0x0000000000400000-0x000000000040E000-memory.dmp

                        Filesize

                        56KB

                        Download

                      • memory/1948-1116-0x0000000000400000-0x000000000040E000-memory.dmp

                        Filesize

                        56KB

                        Download

                      • memory/1996-1087-0x0000000000400000-0x000000000040E000-memory.dmp

                        Filesize

                        56KB

                        Download

                      • memory/2688-1018-0x0000000000400000-0x000000000040E000-memory.dmp

                        Filesize

                        56KB

                        Download

                      • memory/2688-1127-0x0000000000400000-0x000000000040E000-memory.dmp

                        Filesize

                        56KB

                        Download

                      • memory/3364-1121-0x0000000000400000-0x000000000040E000-memory.dmp

                        Filesize

                        56KB

                        Download

                      • memory/4140-1111-0x0000000000400000-0x000000000040E000-memory.dmp

                        Filesize

                        56KB

                        Download

                      • memory/4264-1097-0x0000000000400000-0x000000000040E000-memory.dmp

                        Filesize

                        56KB

                        Download

                      • memory/4704-1126-0x0000000000400000-0x000000000040E000-memory.dmp

                        Filesize

                        56KB

                        Download

                      • memory/4812-1092-0x0000000000400000-0x000000000040E000-memory.dmp

                        Filesize

                        56KB

                        Download

                      • memory/5768-1741-0x0000000001F00000-0x0000000001F24000-memory.dmp

                        Filesize

                        144KB

                        Download

                      • memory/5768-1740-0x0000000000570000-0x0000000000572000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/5768-1739-0x0000000000400000-0x0000000000483000-memory.dmp

                        Filesize

                        524KB

                        Download

                      • memory/5936-1420-0x00000000004A0000-0x00000000004AD000-memory.dmp

                        Filesize

                        52KB

                        Download

                      • memory/5936-1425-0x000000007E1A0000-0x000000007E1A7000-memory.dmp

                        Filesize

                        28KB

                        Download

                      • memory/5936-1428-0x000000007E1A0000-0x000000007E1A7000-memory.dmp

                        Filesize

                        28KB

                        Download

                      • memory/5936-1427-0x00000000004A0000-0x00000000004AD000-memory.dmp

                        Filesize

                        52KB

                        Download

                      • memory/6100-1285-0x0000019B99720000-0x0000019B99721000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/6100-1286-0x0000019B99720000-0x0000019B99721000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/6100-1287-0x0000019B99720000-0x0000019B99721000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/6100-1289-0x0000019B99720000-0x0000019B99721000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/6100-1290-0x0000019B99720000-0x0000019B99721000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/6100-1288-0x0000019B99720000-0x0000019B99721000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/6100-1280-0x0000019B99720000-0x0000019B99721000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/6100-1278-0x0000019B99720000-0x0000019B99721000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/6100-1279-0x0000019B99720000-0x0000019B99721000-memory.dmp

                        Filesize

                        4KB

                        Download