275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f

max time kernel
390s
max time network
346s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-de
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-delocale:de-deos:windows10-ltsc_2021-x64systemwindows
submitted
23/03/2025, 18:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EICAR.txt
Size

68B
MD5

44d88612fea8a8f36de82e1278abb02f
SHA1

3395856ce81f2b7382dee72602f798b642f14140
SHA256

275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f
SHA512

cc805d5fab1fd71a4ab352a9c533e65fb2d5b885518f4e565e68847223b8e6b85cb48f3afad842726d99239c9e36505c64b0dc9a061d9e507d833277ada336ab

Score

8^/10

bootkit defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 10 IoCs

flow	pid	Process
273	3560	firefox.exe
273	3560	firefox.exe
273	3560	firefox.exe
273	3560	firefox.exe
273	3560	firefox.exe
273	3560	firefox.exe
273	3560	firefox.exe
273	3560	firefox.exe
273	3560	firefox.exe
273	3560	firefox.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Executes dropped EXE 11 IoCs

pid	Process
4580	MEMZ.exe
4492	MEMZ.exe
700	MEMZ.exe
4332	MEMZ.exe
2468	MEMZ.exe
2396	MEMZ.exe
2560	MEMZ.exe
384	IconDance.exe
4000	Gas.exe
3876	PCToaster.exe
864	Nostart.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5756	takeown.exe
2200	takeown.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	mountvol.exe
File opened (read-only)	\??\V:	takeown.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\M:	mountvol.exe
File opened (read-only)	\??\Q:	mountvol.exe
File opened (read-only)	\??\Y:	mountvol.exe
File opened (read-only)	\??\D:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\N:	mountvol.exe
File opened (read-only)	\??\O:	mountvol.exe
File opened (read-only)	\??\R:	mountvol.exe
File opened (read-only)	\??\U:	mountvol.exe
File opened (read-only)	\??\X:	mountvol.exe
File opened (read-only)	\??\V:	takeown.exe
File opened (read-only)	\??\A:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\L:	mountvol.exe
File opened (read-only)	\??\T:	mountvol.exe
File opened (read-only)	\??\W:	mountvol.exe
File opened (read-only)	\??\Z:	mountvol.exe
File opened (read-only)	\??\B:	mountvol.exe
File opened (read-only)	\??\P:	mountvol.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
272	raw.githubusercontent.com
273	raw.githubusercontent.com
274	raw.githubusercontent.com
275	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 7 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\IconDance.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Fagot.a.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\WannaCry.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Gas.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\PCToaster.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Nostart.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\MEMZ.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IconDance.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PCToaster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nostart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe

Checks SCSI registry key(s) 3 TTPs 13 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
404	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings	firefox.exe

NTFS ADS 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\PCToaster.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Nostart.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\MEMZ.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\IconDance.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Fagot.a.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\WannaCry.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Gas.exe:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5248	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
700	MEMZ.exe
4492	MEMZ.exe
4492	MEMZ.exe
700	MEMZ.exe
700	MEMZ.exe
4492	MEMZ.exe
700	MEMZ.exe
4492	MEMZ.exe
4492	MEMZ.exe
700	MEMZ.exe
4492	MEMZ.exe
700	MEMZ.exe
2468	MEMZ.exe
4332	MEMZ.exe
2468	MEMZ.exe
4332	MEMZ.exe
2396	MEMZ.exe
2396	MEMZ.exe
2468	MEMZ.exe
2468	MEMZ.exe
2396	MEMZ.exe
2396	MEMZ.exe
4332	MEMZ.exe
4332	MEMZ.exe
700	MEMZ.exe
700	MEMZ.exe
4492	MEMZ.exe
4492	MEMZ.exe
700	MEMZ.exe
4492	MEMZ.exe
4492	MEMZ.exe
700	MEMZ.exe
4332	MEMZ.exe
2396	MEMZ.exe
4332	MEMZ.exe
2396	MEMZ.exe
2468	MEMZ.exe
2468	MEMZ.exe
2468	MEMZ.exe
2396	MEMZ.exe
2468	MEMZ.exe
2396	MEMZ.exe
4332	MEMZ.exe
700	MEMZ.exe
4332	MEMZ.exe
700	MEMZ.exe
4492	MEMZ.exe
4492	MEMZ.exe
700	MEMZ.exe
4492	MEMZ.exe
700	MEMZ.exe
4492	MEMZ.exe
4332	MEMZ.exe
2396	MEMZ.exe
4332	MEMZ.exe
2396	MEMZ.exe
2468	MEMZ.exe
2468	MEMZ.exe
2396	MEMZ.exe
2468	MEMZ.exe
2396	MEMZ.exe
2468	MEMZ.exe
4332	MEMZ.exe
4492	MEMZ.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	3560	firefox.exe
Token: SeDebugPrivilege	3560	firefox.exe
Token: SeDebugPrivilege	2280	taskmgr.exe
Token: SeSystemProfilePrivilege	2280	taskmgr.exe
Token: SeCreateGlobalPrivilege	2280	taskmgr.exe
Token: 33	2280	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2280	taskmgr.exe
Token: SeDebugPrivilege	3560	firefox.exe
Token: SeDebugPrivilege	3560	firefox.exe
Token: SeDebugPrivilege	3560	firefox.exe
Token: SeDebugPrivilege	1344	taskmgr.exe
Token: SeSystemProfilePrivilege	1344	taskmgr.exe
Token: SeCreateGlobalPrivilege	1344	taskmgr.exe
Token: 33	1344	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1344	taskmgr.exe
Token: SeTakeOwnershipPrivilege	5756	takeown.exe
Token: SeDebugPrivilege	3560	firefox.exe
Token: SeDebugPrivilege	3484	taskmgr.exe
Token: SeSystemProfilePrivilege	3484	taskmgr.exe
Token: SeCreateGlobalPrivilege	3484	taskmgr.exe
Token: 33	3484	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3484	taskmgr.exe
Token: SeDebugPrivilege	404	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
3560	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe

Suspicious use of SetWindowsHookEx 60 IoCs

pid	Process
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
4580	MEMZ.exe
4492	MEMZ.exe
700	MEMZ.exe
4332	MEMZ.exe
2468	MEMZ.exe
2396	MEMZ.exe
2560	MEMZ.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
4144	javaw.exe
4144	javaw.exe
4144	javaw.exe
4144	javaw.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe
3560	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 3560	220	firefox.exe	84
PID 220 wrote to memory of 3560	220	firefox.exe	84
PID 220 wrote to memory of 3560	220	firefox.exe	84
PID 220 wrote to memory of 3560	220	firefox.exe	84
PID 220 wrote to memory of 3560	220	firefox.exe	84
PID 220 wrote to memory of 3560	220	firefox.exe	84
PID 220 wrote to memory of 3560	220	firefox.exe	84
PID 220 wrote to memory of 3560	220	firefox.exe	84
PID 220 wrote to memory of 3560	220	firefox.exe	84
PID 220 wrote to memory of 3560	220	firefox.exe	84
PID 220 wrote to memory of 3560	220	firefox.exe	84
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 2148	3560	firefox.exe	85
PID 3560 wrote to memory of 756	3560	firefox.exe	86
PID 3560 wrote to memory of 756	3560	firefox.exe	86
PID 3560 wrote to memory of 756	3560	firefox.exe	86
PID 3560 wrote to memory of 756	3560	firefox.exe	86
PID 3560 wrote to memory of 756	3560	firefox.exe	86
PID 3560 wrote to memory of 756	3560	firefox.exe	86
PID 3560 wrote to memory of 756	3560	firefox.exe	86
PID 3560 wrote to memory of 756	3560	firefox.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5356	attrib.exe

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\EICAR.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5248

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:220
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27100 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {bbe359d1-5434-4e59-8953-47f0a2d9f46c} -parentPid 3560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3560" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27136 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {481d419f-4a38-40f1-9ea4-389d0a246ca7} -parentPid 3560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 27277 -prefMapHandle 3840 -prefMapSize 270279 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {29987700-876a-4030-aa41-7a5387c144ea} -parentPid 3560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4000 -prefsLen 27277 -prefMapHandle 4004 -prefMapSize 270279 -ipcHandle 4020 -initialChannelId {516ef58b-8bbc-42d8-b684-3a8260336c25} -parentPid 3560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3560" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2896 -prefsLen 34776 -prefMapHandle 2900 -prefMapSize 270279 -jsInitHandle 1620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3196 -initialChannelId {b0ab0ec6-7567-4cbe-8fc0-278faa786f25} -parentPid 3560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5084 -prefsLen 35013 -prefMapHandle 5088 -prefMapSize 270279 -ipcHandle 4944 -initialChannelId {4895aa83-0e9c-4eb6-a8f9-900e2cf50720} -parentPid 3560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5452 -prefsLen 33031 -prefMapHandle 5456 -prefMapSize 270279 -jsInitHandle 5460 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5468 -initialChannelId {8e2712a6-2864-45a2-a434-b4187bce5965} -parentPid 3560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5480 -prefsLen 33031 -prefMapHandle 5488 -prefMapSize 270279 -jsInitHandle 5492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5484 -initialChannelId {c9dfdea2-16af-4c05-be01-5ba715fe4656} -parentPid 3560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5852 -prefsLen 33031 -prefMapHandle 5856 -prefMapSize 270279 -jsInitHandle 5860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5864 -initialChannelId {e3c0e2a1-2c1d-4b62-b059-226426af73fd} -parentPid 3560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6332 -prefsLen 33071 -prefMapHandle 6328 -prefMapSize 270279 -jsInitHandle 6396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5628 -initialChannelId {a57b1810-26e1-411a-82be-2b6f8e0edd0a} -parentPid 3560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5508 -prefsLen 33261 -prefMapHandle 2676 -prefMapSize 270279 -jsInitHandle 2660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6656 -initialChannelId {08858cfe-a377-48d0-bd94-859f42f0bfa5} -parentPid 3560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5340 -prefsLen 36502 -prefMapHandle 6248 -prefMapSize 270279 -jsInitHandle 6740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7096 -initialChannelId {6299a8e6-0ca6-4f24-8f05-aaf7ff849603} -parentPid 3560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5948
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4580
  - - C:\Users\Admin\Downloads\MEMZ.exe
      "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4492
  - - C:\Users\Admin\Downloads\MEMZ.exe
      "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:700
  - - C:\Users\Admin\Downloads\MEMZ.exe
      "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4332
  - - C:\Users\Admin\Downloads\MEMZ.exe
      "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2468
  - - C:\Users\Admin\Downloads\MEMZ.exe
      "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2396
  - - C:\Users\Admin\Downloads\MEMZ.exe
      "C:\Users\Admin\Downloads\MEMZ.exe" /main
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2560
- - C:\Users\Admin\Downloads\IconDance.exe
    "C:\Users\Admin\Downloads\IconDance.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:384
- - C:\Users\Admin\Downloads\Gas.exe
    "C:\Users\Admin\Downloads\Gas.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4000
- - C:\Users\Admin\Downloads\PCToaster.exe
    "C:\Users\Admin\Downloads\PCToaster.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3876
  - - C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\PCToaster.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4144
    - - C:\Windows\SYSTEM32\attrib.exe
        
        attrib +h C:\Users\Admin\Downloads\scr.txt
        5⤵
        Views/modifies file attributes
        
        PID:5356
    - - C:\Windows\SYSTEM32\diskpart.exe
        
        diskpart /s C:\Users\Admin\Downloads\scr.txt
        5⤵
        
        PID:1568
    - - C:\Windows\SYSTEM32\takeown.exe
        
        takeown /f V:\Boot /r
        5⤵
        Modifies file permissions
        Enumerates connected drives
        Suspicious use of AdjustPrivilegeToken
        
        PID:5756
    - - C:\Windows\SYSTEM32\takeown.exe
        
        takeown /f V:\Recovery /r
        5⤵
        Modifies file permissions
        Enumerates connected drives
        
        PID:2200
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /im lsass.exe /f
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:404
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol A: /d
        5⤵
        Enumerates connected drives
        
        PID:4236
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol B: /d
        5⤵
        Enumerates connected drives
        
        PID:3160
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol D: /d
        5⤵
        Enumerates connected drives
        
        PID:1824
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol E: /d
        5⤵
        
        PID:4552
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol F: /d
        5⤵
        
        PID:2044
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol G: /d
        5⤵
        Enumerates connected drives
        
        PID:1608
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol H: /d
        5⤵
        Enumerates connected drives
        
        PID:1344
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol I: /d
        5⤵
        Enumerates connected drives
        
        PID:468
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol J: /d
        5⤵
        Enumerates connected drives
        
        PID:2904
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol K: /d
        5⤵
        Enumerates connected drives
        
        PID:4088
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol L: /d
        5⤵
        Enumerates connected drives
        
        PID:704
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol M: /d
        5⤵
        Enumerates connected drives
        
        PID:2428
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol N: /d
        5⤵
        Enumerates connected drives
        
        PID:4908
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol O: /d
        5⤵
        Enumerates connected drives
        
        PID:3236
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol P: /d
        5⤵
        Enumerates connected drives
        
        PID:4528
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol Q: /d
        5⤵
        Enumerates connected drives
        
        PID:3960
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol R: /d
        5⤵
        Enumerates connected drives
        
        PID:4032
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol S: /d
        5⤵
        Enumerates connected drives
        
        PID:4768
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol T: /d
        5⤵
        Enumerates connected drives
        
        PID:4208
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol U: /d
        5⤵
        Enumerates connected drives
        
        PID:5908
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol V: /d
        5⤵
        
        PID:3676
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol W: /d
        5⤵
        Enumerates connected drives
        
        PID:3052
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol X: /d
        5⤵
        Enumerates connected drives
        
        PID:2040
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol Y: /d
        5⤵
        Enumerates connected drives
        
        PID:4644
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol Z: /d
        5⤵
        Enumerates connected drives
        
        PID:3328
    - - C:\Windows\SYSTEM32\mountvol.exe
        
        mountvol C: /d
        5⤵
        
        PID:2700
- - C:\Users\Admin\Downloads\Nostart.exe
    "C:\Users\Admin\Downloads\Nostart.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:864

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2280

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1344

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2628

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:5340

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:3436

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
22d47fde80501801656894bc91506aa6

SHA1
c5550f5450eca9b24416c56d722b7a6d7d63bfb4

SHA256
326410334921c9a003ca819820b2f26e6a31201d54a4b7dec0cf621756e46a94

SHA512
8abc97b035bc4a660184b1fd51ef190fc620d4017821d5e9ced6aee82fdc720be05eb412b606c4dcf2edbe354c370609bfc6ea8b5e14b6a26122f37ea5ffc6d2

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\doomed\7618

Filesize
57KB

MD5
a3342632b6804356c891ccae4f42b211

SHA1
2742280aac7852e08bd323f325921fa5494ed627

SHA256
e02b799ad44babdbcb2e2c167f708b7eeed843637ba4424065c759f3ab5ec87d

SHA512
148d2d9d841b725de2be2fca1c7c0947458454c9cb80a9062dca4891445707603ee3f920f03b46bfab2d3d0d01cb8ac2364b6f191edb252760fed15b1475540a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\1A5996C16946393FC0B184220943714409DE2FE0

Filesize
43KB

MD5
1af8873996065fbb13bbabbf0ebc9a68

SHA1
7b8e9f36163300ac3408bad10a705f2e59e4856e

SHA256
ccf20fb8b63bc23bf5a5d05b85b4f8f6afb39bc6989ded66d30dbf76e09d9cd7

SHA512
a6851fa26ef03bcff93ff70945569fc40743d1f667f571ae2c9ed0a7b205a86bb5dad558e8a2e30976de5d57e6802376af45774a4bbfd944b5c70aa2ff35903a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\2F879E430745EC79E1888DA9C3EA593AA94D739F

Filesize
96KB

MD5
4348f9b75145d78c98ebd6be18e7d0cf

SHA1
f62f579c74d52409a941174100a383854efeb057

SHA256
d6c9e9110cfd331618145e3640bb85e287d29d7df3f8c98a9b9b99e078e45b1f

SHA512
f9930d39db349533147a8caf4d36c45f165ecb416bad4f39e3b7f96920c26d4c38bd712e0c41dddf8d46d4d7b05fb68655e43b966692fbd67bb9c489526140d5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\311589B5F7E27FD8DAEE1AEB3F2A1C1A3FFED5A9

Filesize
16KB

MD5
434a2b0687d3e76fd73419f76d5e9923

SHA1
20397fb820df51684e24f000d4065ee5aaa6090a

SHA256
fdc51714ff95a17735538b473ea2714a947f7f7d4354c14c9c8d19fd5568f25c

SHA512
b297d32d39783ea07ad823399c5b8782c0cbcc6f727ff130707ba9921c8d952089bbd915db09c8b45d18e341fff6ef69af472135e743b50ab4a40a1b20b51e67

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\33809CDBDD69269236BB05F66DFF2693F384205C

Filesize
60KB

MD5
5c26533d2ce408a9045f5b5335442a9e

SHA1
96fb589d00086326832ce53edd6f73cf2ae17ab7

SHA256
6d096d096b102ee92d8f4c2747a627f43b27c3599dc958b818c0eddb3833758d

SHA512
419c232eb15f1188d8622ecd20e3ba7cbf560b073a3598272725fce7b12655e381b5c9c33510d16191dce3194a496d175021a317fb126c1e8eef3c3a49d9e65b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\35547F305B43F28C7F3664D49C1AD32A7112A1A4

Filesize
34KB

MD5
f26fd1869fa3cae917b529a886c0fbb6

SHA1
61b1930ca2598b72d883f1d83ac54f41c79b4dfc

SHA256
4d5a8ac7048f995df2d2990506cc8eb2438155d6813e02272de9bb45a37de02f

SHA512
26372e4fa1228a159ab437ed7b2303161f72c9c599e62f5dce7afe6944da302371a9959c29b2100e0a21423fd654176fb31ee4514a6bd871cd3505b390a669b1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\3A1FDC6B34A57BABDC117F984BC456C512AF3C8A

Filesize
17KB

MD5
ac58a7364bfce71d881bae35b80eb6fd

SHA1
77415f30e8a711adcd690fb410dadd1a9220a173

SHA256
d3d8d934b250315e90e7b108e8fb5123f9826eaa36e42322b633ea88a931eb3a

SHA512
fb39254bc01d81cbaef0222931de069ba86ef9cd6391b6adb53fa39c4ee0be2ba7525626c75934a1a49665587ef6d2321f445265c446bd22093d2c8f6d123e59

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\5ACB46A5A72DCA2C675A19F9DCC5C68E4EEE16B7

Filesize
34KB

MD5
62bde43fc71916bb0b9e8d2c3f0b6c72

SHA1
9d8bc0789c332673eebafd327be4dea8b1d27b70

SHA256
d7e1999d4caf7611538ba74f2f032089ba5061ed21541c32e88988438d1acf9c

SHA512
2cfd1e7814e8ffbf327e823ed7b88e24d670e8f551df66ea04bf8ca6168abafd9fcc635e1b535afa453c0c92d68d1651184bb5615c29ca287d448388d386e0e6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\8D11864F69B6D9276086D87F1C72386DC26A1DF7

Filesize
47KB

MD5
44a8cbbc656c2df07739213cc32f209c

SHA1
d998d3d8fc583ded932ac11271b6030252d7b287

SHA256
c94255a51f9dd56932bb4773f2f39ae7369e950c7dfb32e78fd66daddccd8601

SHA512
ef843a2df06aa0a56903a0fbbe77573ec993e352f8d12532c00b4d8bc276f575042595385b6d397b3291ab49de1f1c0c13e4dc68c212678d1c5393835f496fcf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\956C138E7E189A8F1B675B499ED2D87604EE6E73

Filesize
47KB

MD5
b19ae284cc3ac0b47b7c66c2277c87c4

SHA1
af745c6dd05d7b70a82574091d7a87136f19414a

SHA256
0ab51536f5a7e94ccc9170fcbd009e4fa3c6fd46f931a753d5567bb2fdc1bf12

SHA512
f7b91d98f8b52ef47a54281e809a5457fb69b8f89e907e5ab242fdb62d66203d3df314fcc693587a7316b26227c6c6751c2e3ce3bb829e8b76078008badb1f26

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\97AFFA25C9ED84269BA5F8059413E057B9831B3A

Filesize
41KB

MD5
b4c0e06a7610eab0fdf06fa4d615ebe0

SHA1
c5dc05fbcb75a060def88a564902720d2c1afcb5

SHA256
30f168a9f815e301621d21ce235ae49557875c9458db5b2a82b9e53ba0bb122e

SHA512
e60fc9e62a5a94cd0936d80b062bad4a7652debe40ced22352b01937f1ba3b1e1fdec4737fc56ed397757c395cf4db4dbb9cb2e67cefcf5c23f9dafda9db9085

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\BC02779E4549B742F87E407101403B7CA65078CE

Filesize
45KB

MD5
8fa5de372c307108817a0454d1979c4b

SHA1
3bfbcd845b18f490c2873f9def4e8568284a5f29

SHA256
b8c86d3e8ec3892f28d356f72ca33ad4b8b5b59f635ce2be938ddcd3bb288157

SHA512
d59f1b9d315e0a800bd99c5ec6ca484588b6dba19a5bdd1d6ba97fe22cf701a7e26a41112ab92f8d1714a858f8202e4efbe315c9a3274376233538fa0a208b54

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\E19316B1CDA62317F9DA2551F9B56E711FCC77AD

Filesize
13KB

MD5
b2a2c4319b6036fd7db09c4c99c7783d

SHA1
e7553559a951a2e189255e7ea36a1176884d51b0

SHA256
35ff6216cc36ac420b231e007a3301ec01bd40682873e7c000a5c623794ad934

SHA512
3dfd8059eb59aded27e658fe27aa6bebd23803565071d1939b02b6eb23838fceaf53a76d283bd435415846fac43bd7fe0383ca6ec33d2c9cbff0a473efdcb347

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
502KB

MD5
e690f995973164fe425f76589b1be2d9

SHA1
e947c4dad203aab37a003194dddc7980c74fa712

SHA256
87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

SHA512
77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
14.0MB

MD5
bcceccab13375513a6e8ab48e7b63496

SHA1
63d8a68cf562424d3fc3be1297d83f8247e24142

SHA256
a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

SHA512
d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
4e8e517e6870b2d40f449b353493c48f

SHA1
c83bfd59403f4ad23db86bab7451327947c5a198

SHA256
79fba1d4739b4e06f624c5097e3f7d2c1b059a561e374c33b52eb7df5ff4ebfc

SHA512
a4f951acdd6101e7c08d58b38e324bf0e2290e04861d4403abc954247a6be30b724fa734637d6d4e04605403ec8e9f6d3c5dec65522dba9202f2b9327425e9b2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
ecca5740b7940893099f447b66b569f6

SHA1
af55ac4a57e858c322098a66c56fab3b987bb60b

SHA256
b7d5a7bcfa66b1e1baa8b5452bd06d7477744e43bf4c7448301ff84abbd87155

SHA512
a664860d6effaf3c1e78f0a8acf8ff082a9fbe1fb5384c52a085c88858c6d7c0454838c4136363259ab2edbe9c87a67a25dde71daf4b4506d2039a4b572332dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\AlternateServices.bin

Filesize
7KB

MD5
b67c876874970fc38bfbef00baef3a75

SHA1
db8657a5fb4aa33d59c4e9406ee97e7291d798c4

SHA256
499d140368b00d3e8e98912bb788729e21c19dc090e9603dff62c340a80b5983

SHA512
026bec9ddec701ab4f1f9da1e9fddba604a9821cc28d5cb5f91b2343df20b1f952503f874c9fa873a29a5245a4a6847bbed6c16b4e9d3a6589e67dbd813ae79b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\AlternateServices.bin

Filesize
18KB

MD5
a246a6524c06ec1f2a6d482d1730e2b4

SHA1
b5c02e6330db0441fc879cf101bc6c8f95db0a83

SHA256
bba811b13f1fea7d26f524810cc7dfd2adb9c712fee0866b328ab58c02d1e02e

SHA512
0a03a3e523a5b75658c1b7ab2fe43030ef3647219f0834b532facd4dbaf1fa853138d988952332d8eb82c0b5ecef5f2e4159f267fffd4922062b77d3c41a7b22

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
2022dc653d5b3d064fed72a163c3ab3b

SHA1
c46f764758a051ccae0d638351420092593507fd

SHA256
e8c2a6ed14144acdb3a38220a31392216283e610313fa2d057191591d49acfb5

SHA512
ea47909390a2794140d447b39da8478439b848b366259254f6043c249741b67f0703007ee82552a242411ef5bd9fbf8b582be2ca2da5da961e69c09ff617c19c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
fe4a9afa3c85b6cd9036612c2a34be9e

SHA1
aa01f2b7b9c549d036d3e1a9841013cad6265d6f

SHA256
44224402e3d80dd027ccda1635745635ab32c48e09c5a384ae4e19f2cc9a00dd

SHA512
3ef927dd25ae47a5610a4112f3314202fc46aa4e0d0f9ae9347d441c988d511e88db6b7492bb2d269f2d2734c769c6dd9c848fe086f7a230c4b23349c612e868

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
13985b0e916386eb2c2de3eff0ed8581

SHA1
701e1dc554e50c2739a33ef1b7b9252bba2deee8

SHA256
900cafc8cf86bf09d04010616a17c150dd415669f0d50adb10ed21dca03da02e

SHA512
38cca488cf2c61202cc154e1202956803d590a1ac5524bbf93faa8feaefc3f32a8d89ee9995bbc05928c586682016adff341dec033d9716e727110b86d2d93a9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\events\events

Filesize
4KB

MD5
1b50dda8adfe743c4ee9ad159b599a72

SHA1
90d484b2bc38d7034f3307f4706d1d3c7683660c

SHA256
5ee8c7fb32a09c1cfa581a9f4b2840b7471c481a75a92f38e7fffb5254c2d140

SHA512
1813fef48f057c0879a9dd7bec6f088ac6c2041abc7b200a49b910ab6ac17e1fd0c29b6a887281863ec63d062a37695680b2a2a8c21babd8141353a9a89a2d3b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\03fc91cb-624f-4ad2-a6fd-edebcefc803d

Filesize
235B

MD5
00befddca137de336dcfe0d6f808033e

SHA1
01330fe1ec3702b80e1097f993c792d28286cb86

SHA256
2c996496fd3db4fb0c2e5fd13763e7d0396ccb612d6e750afd41608fb2cf7112

SHA512
f2aff71f41bdd19d198b01f45ced97af68d7a877d305ad4d689ec2f734f73ab53ad97003b8be51e5a86b7073a3560f9fdde49e4f8056beaeba730f6de3ab6b23

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\1caed66a-14a7-4d3e-8995-5dc34e23598b

Filesize
235B

MD5
1c8d68c4fecde1778ac0f0f33cea71a7

SHA1
d2eeb5410f4a7a051f1e09c17ae4b5714c591647

SHA256
53cbf69d39852ce050d00280cf2d6cb491a6a4fc7f9bc2b557ab6343b01c3fae

SHA512
a648c3e42e827170bad2301ddcfb4be378f7dc1085d058115e9549f8b40f15a55dc01489384873058702b0464af17a017cb5da6a06f2fbca8794b2451f6f7554

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\5bc2f2f3-0730-4703-a97a-fee67b9c7c8b

Filesize
2KB

MD5
d40d455569c76ec2c38200d14d14a695

SHA1
e1228b0b83190300c9f9b7537d3f34f3bd58ac44

SHA256
c18339b8c8035d4ac6069dc032b85ec35bbdbbf0c49c12fbcb68c8bd6f5dc81e

SHA512
a22c6c547683031a4015c3bddfafba5fbb8ab4df2614d42c7bf6a8b335ea14df3ba9229ce6109be7ac1e17018af1a673abd14975392e6c115027ed2408f4ad4e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\6fbe6505-0811-49d2-a750-d5ddaa0cec20

Filesize
16KB

MD5
b7f195779f580d8319530b5de8c96861

SHA1
c6449c0cf4c3e360ef6e74fb16f059e34c2bd3b7

SHA256
00a838df6fd5051b08fce147f8079296c1ec61770a98425b4e540d482e5c8f61

SHA512
2c644b5b898e5bbe4dc892f72b26e96a3065c77ca23eba20af4ff000396f47611903dee88dbc9035a63c8b59cefa08a2d1ff0ba51b728a3f75a7cc07d692c818

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\70d31f5a-83f1-43c1-a5a8-a95da203a4ff

Filesize
883B

MD5
d4f54f3c9706f6a1ae270670b2312522

SHA1
528c4ae59bf83313137a6ab3b1612eef7362d8d6

SHA256
2d728787e5ef446f38baef2ade5b8fc5851ed85ba3c34dddb87d16bfb692558b

SHA512
b4433dfc01ec00fdcd9079986ce1f591941bfa7781c2bc254a559d2e97b60b5319dec2ad4ecc5dc080f492fd388bd14328a704358c12afaec90dfa55b6648d78

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\c4aa9137-0481-4336-ae7d-844eeb7b1bfa

Filesize
886B

MD5
4973bedc738a4e1fa9e166d33dbaab0e

SHA1
4540f19d0bc5c938007c71708427607b36901b94

SHA256
0dc36f8bce74d0a7da953a6f85559111b6bd2ee9d7fd9a61567c3ff764adc823

SHA512
a9d3572026a8912ab987aed92d1c9f85a9ab13547e23859e9160538afc64447eb18ad2abc7669b4793881f6d15d573006f4f65938b5b4106bb427f81a6410e4c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll

Filesize
1.1MB

MD5
626073e8dcf656ac4130e3283c51cbba

SHA1
7e3197e5792e34a67bfef9727ce1dd7dc151284c

SHA256
37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

SHA512
eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info

Filesize
116B

MD5
ae29912407dfadf0d683982d4fb57293

SHA1
0542053f5a6ce07dc206f69230109be4a5e25775

SHA256
fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

SHA512
6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json

Filesize
1001B

MD5
32aeacedce82bafbcba8d1ade9e88d5a

SHA1
a9b4858d2ae0b6595705634fd024f7e076426a24

SHA256
4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

SHA512
67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll

Filesize
18.5MB

MD5
1b32d1ec35a7ead1671efc0782b7edf0

SHA1
8e3274b9f2938ff2252ed74779dd6322c601a0c8

SHA256
3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

SHA512
ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs-1.js

Filesize
6KB

MD5
56664dd8d3b85ba84c3780e3c4c5f8a1

SHA1
b706ac0d69a299a80816de72374cdb544b74a2ce

SHA256
acd584f0b83369d4e2e8f7986c103cf8684199eadccf8778f3d1215f19bc7d13

SHA512
c02c21fe23c7eabe07a3ef3abbafd0f88668805338fb06a624a64d7acfd088776a9dc75c9b84474c0c18b816b5fc43b7ab9019a16713a968d27030d68e5265bd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs-1.js

Filesize
11KB

MD5
c0e5e27fe0edbd3a6acf4aef4764213f

SHA1
b26017b70fdf6cd0041fb8bb42e2601c86e23cf0

SHA256
d97824e8fbe34a33098f3346d13bb872d05c55afae7a85fc39a317211f36d97a

SHA512
5e2a68d2114c56440a818ec0c9a111767f952a45d83f014f1352b6e524071e88a898b0aff154725d4e239006ce93ede3c2f45e8595b25a0c1072c251da1b4d95

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs.js

Filesize
8KB

MD5
bd2a9e63a810b6d4fe5485aeda08a48a

SHA1
776e941d7f112934a813b4aa137a73e177d35b85

SHA256
57e16ac8b30ce7e9a6102120e3538b90d3ffb4415e5228f67924e823a32f706f

SHA512
541569c73d775e34b33850683cd05a30097d16bdfe1f612f7b89e3bf8319bce02f7cf2ad064aa6a3d260a95362ff6a3c5c71e8cac4fe539080ca3273f8d7a2bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs.js

Filesize
6KB

MD5
866cf133386b4983d8c602d83e190c9a

SHA1
4f667c3c127e2528a27c3351f5aa037251a4ebe2

SHA256
5efc0f0509089e7f7ec104cc20652c04c57521cbaa9ae8eecf420de2761797d7

SHA512
f23c9ca600a6b7660148eef113dc77ce311bfda1d38e64b6801c735f88a218190f76d6a722024d14b336f5102e48a57e9ff7a554eab95df33049f42396dea46e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs.js

Filesize
7KB

MD5
066b52ee932a7e4bc2632a927f4b95f0

SHA1
19dd40506b97f2216c60f8bd6334b5f952da5b19

SHA256
f09e2395a464150edbbec3eb30114f30d80da89af662a2e8e00485c97e295765

SHA512
47fa84d923fecae66c7dfa1eeb43af7ceec5f9185bb008161a962be33d39057d97fd81ad2999b33fd7abfe09b371b1288150a3ac31c91709ff1cad0d89644170

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs.js

Filesize
11KB

MD5
b7b743fb06f462a8b8e55268bdf7b574

SHA1
2c6ff3e62802d83148e09f5102183cb1ebc21c07

SHA256
2f1cb2ffed9e705d7f28a415f0ff5c3f92e7d4dc939a45f1fb109cfa24d846fc

SHA512
eef77ce72df52313c4d7e78dbd177136074b351500c2159c9d14c24d3d50a34a6bb2287264f4d7c8b6f8d21f58c571d414d134fa5bab7e15fba2a9a2e52a4026

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
7c01902e6d2ceda79568db0e558851d9

SHA1
805d0b5bffabe6708e1cb66c7b9d9a0ddb8407e7

SHA256
511791f2f7e0996233cb27b1b9f0d506102c0ab5fe10a5c6a2e0b1585ce2a665

SHA512
30ad37ff47b23c5cf50432a505c7794aa577d259c5bf0d27342d2355894f734b317e981a019f649e7a01829d90523265cdb0fdbc09ddd300d03a9f9daabbc8f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
9da4f2ea2aae890a605e92960131b57f

SHA1
335d1aa0ce5bfc6defa3e9c8968792e915cb5cf9

SHA256
0a8de997d53c855e1cf87b8dde08dbf69ff47a2b69f627e8922f80e0eb412d2c

SHA512
015413350763cffb2c8c46e5cfff87da9c1f7d8c4c3aeb32ccd3e8319604debed6a54a33409e9e72c3b36330c64e580a2cb51f2fa94bb506bba359fe592f8a30

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
c38db01921ee22ead959b825daee2f26

SHA1
2fea09530b4edaf5e41cb1999955af5025034f15

SHA256
e0b166e0421ed1a12b5901d94e50279bd1e5d6b45eed39220f541bd302dfa619

SHA512
a6ad477c7f21365c3e228b820df9211feb34ebf9301a55596cc8c0bfad97e7fa09ebe5809acc6229fb89a3e58ca7edc7408a7fc50586b81079e6425d32f21252

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
08abcf84becc28a52c6da323bf5b5804

SHA1
de7fc11ca57de757d0e3d18da157ef09db187cf2

SHA256
de1eda1e8a6b4bbf053d788726532818973b4c5edcaec63030b8d987ad0b41e8

SHA512
09d2c660d4311546477395726eefadd14bbe7b1cd5e3cbb33dd0129b8b577a5701e913286fddde203e897414898696dd55e42ed4a402c4237a51958f3a6ae44c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
d7951fcbdad60866f13cbf5d10f51be6

SHA1
b0fa6f7b97024b29cdc96f2a4677d6ff1e855df0

SHA256
417e33b3670c927688a975ceb5264b9d5936f75753b72c5e856710ec7b2086de

SHA512
e017032162f85bf0589264cedde3e17bf4e2350c0dad349fbf1bf696b705a839a1fb77a3916a195940ed161e23b05c628186e48d4be71c9bdcae2247e2794205

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
ebfc43486eeff3820110aeb3d41dba21

SHA1
8dcbd4b201a30c22cee38be94aae02ef5dacc18d

SHA256
b57a7fd27f87fa612e22ebe1876bbd6a61d494e8e697ce69ccd6d73a07f07f0d

SHA512
befff9e4eaefc9ce152a784d8687afa28452cf02d5e5f3ac799b104d9c256100d1786a91a98d2cb1882d3380f8b1ce95f44855c8e49757151c519a61e12aa2a0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
c1e17d66e3f299dce2da3ee2f2f56f51

SHA1
de6d7742b4c52fa9372f691076d002b5c4990bf9

SHA256
ed6e4835ef795328a33813bb8e05fc9afa6d54fe79530522a28fb93634a018c1

SHA512
6e36069282cc25120a69ecaf9f98e88aa84c5ddc9b3a31b0f80a67812fcd9df63fc50289d4f46d99d3e596641c739ca046a88e6dc6318a1501c855c2ab39d3e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
3d14db85b8fe85f0e136533005c3da54

SHA1
e26c7cb11656d5dab6be050e2f62997eb6c89eaf

SHA256
8bebd64ff4fbaad7733c1918eb5a0600eed8f850725bd0630da3b292e02e9a3d

SHA512
2e33499dc135d283115ec863e581a4f39c3db2aa4c62dab2a7f08e5805b3cd4f6ea87ff836ab253abca81d7bf2cc551d1f8ddbb2d7ab7e7fe8e458be1ac957c8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
630ec77db0275d51faf20a178f522758

SHA1
b4b4617aec4652453b26886695b5ff4e1d926a55

SHA256
1120395ace4026b0c4cadb26ad1ed7a75c5cbeddddc3d1deaa07ad4bbe72e4b1

SHA512
04cf5f768177304dfb67890724b6e2dfd3ebf64775570039795def7c1e0cfc47c7fb26dbadff0f0dc949dbd61dacf5b010ec189c8d4ee1e3f05b96540aa5a7de

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
3dd3c747aac3723d759f76a98aa71c23

SHA1
be5ac12c03c6ca9bc94f0f5c7a894bf479f49184

SHA256
799ba7a7333aef8305d35748efa803fd6b649d428649613624cef860e1064a82

SHA512
8b95bb07efc0721faae82309ab9d83b978e609d482e389ab9c6a4ec24c8387d90ff69d4e8f6404c076d4effd2559d114a3e8a4468730c45e841688ee9d27b02a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
337e71077f61b02087c7cf7f384226d3

SHA1
eb63084ad6c66a077fcc53e3191d4f7728478e74

SHA256
168d240983b0fb497a9d09c0faa681878e526446560e1b5bfd81bc309e91690f

SHA512
a512d60a86445dfdb8bac781a7059663b505d6fb6b653a26342f74d8932ebcf33b61afc3dd49ed2e89863af3c765faec724b79dccb7ee9dfa2981a49727d0823

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
f36121365d651477fc18fff6c3decb63

SHA1
1e5829e513675e78b6945a4e2e7c74fb134d5356

SHA256
6c76851c6f5e4e2386b2d89d29aa38cd9ec31b64c95ec141bb83cb08d91b3abd

SHA512
47b15afe4ae8fd40fdd6c31e17665884b0e18c1040d0267a4a6871f1f140a7fa2306e2188dff774bd91c2f92028b3b5528daa3efcc27c80b5c19a734ddd724c4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
8e7d1fb343ed5931946171a05ee23ac2

SHA1
fc43ad5b46cbc449956f716dde484ac52559d485

SHA256
2fc14f0381b12e7a159f257f8ebf63e52926c414f51ca486bfcebd9dbabe36d4

SHA512
f424db1c062c3445ebfca43db59c7b4b62414d83aec9f4ef3686ec0f7758f3908eb8832c495c766bc9d700ecbc2ab70c757abcc9dc290413258a8462562decc0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
722d58155a69a42141c6e38233df8303

SHA1
b2c03b6ef3df303652066155789f1510105f97b7

SHA256
b4bfa33c46a3c70522fc5efb3cadc20b5b414b47ed4de3099008ccfb3588aacf

SHA512
f358b94b6003cbda0e8872e36c1b44eb8bcd74d8ab02bb98cc2a705fb81cd7672e439fe48ec51ccef915a7d002343a66c1f567db0dac72261d83bd665be98ba7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
3.5MB

MD5
de3249013705ed8ec571efe560bdcd30

SHA1
b911b31387da25dc17802ebce53ad337c238818d

SHA256
b2e981776376102609cd030b32f61456da7c957c4ce33395727c4af298630bcb

SHA512
23b16c6fb50984996a0e72246d443b6c772a08a3fba1d6c80f85b731dc50ae5ad33a0345fda53952ecb1cb8f0486ab043dea349014680c353168ed509e5e927c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
3.3MB

MD5
8c73778d49b824533da2ab6de4274adc

SHA1
4cd604dccd32b12505165b0f14d32f5b303b5280

SHA256
a824c8f11f12f0bbe7a33e938d4efc881af7b96022c46b9c4fb5e03cd578e817

SHA512
8e37d14bf98bca8c8cf02b086371f61851223d15a0f6f12197d0063ee936b43f0aad4e826f84ff089bda4c13029d26fcedfd7c2e39a145c6af407c1d141f8560

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
3.5MB

MD5
c1fe8470f0f62210563961484eb12b0d

SHA1
2927264032a449678faa5b9e6b59c96a809e0971

SHA256
20f8942823737aeb8155e4ff64404d58654127fb7dbbf2edb4d7352dc4f5a6b2

SHA512
a22cb7e60329ccd1ef03a5c4cc9a36225906995ba1dcce240c4c5b1c53da3ad7ccd0499457495d2b2eebd17caa144f21cc61f6c30477021964d764e37a19ab5a

Download Submit
C:\Users\Admin\Downloads\Fagot.a.exe

Filesize
373KB

MD5
30cdab5cf1d607ee7b34f44ab38e9190

SHA1
d4823f90d14eba0801653e8c970f47d54f655d36

SHA256
1517527c1d705a6ebc6ec9194aa95459e875ac3902a9f4aab3bf24b6a6f8407f

SHA512
b465f3b734beaea3951ff57759f13971649b549fafca71342b52d7e74949e152c0fbafe2df40354fc00b5dc8c767f3f5c6940e4ba308888e4395d8fd21e402b3

Download Submit
C:\Users\Admin\Downloads\Gas.exe

Filesize
18KB

MD5
e7af185503236e623705368a443a17d9

SHA1
863084d6e7f3ed1ba6cc43f0746445b9ad218474

SHA256
da3f40b66cc657ea33dbf547eb05d8d4fb5fb5cf753689d0222039a3292c937a

SHA512
8db51d9029dfb0a1a112899ca1f1dacfd37ae9dec4d07594900c5725bc0f60212ab69395f560b30b20f6e1dffba84d585ef5ae2b43f77c3d5373fe481a8b8fc3

Download Submit
C:\Users\Admin\Downloads\IconDance.MqQr5UYk.exe.part

Filesize
301KB

MD5
7ad8c84dea7bd1e9cbb888734db28961

SHA1
58e047c7abecdd31d4e3c937b0ee89c98ab06c6a

SHA256
a4b6e53453d1874a6f78f0d7aa14dfafba778062f4b85b42b4c1001e1fc17095

SHA512
d34b087f7c6dd224e9bfe7a24364f878fc55c5368ce7395349ca063a7fd9ac555baed8431bfa13c331d7e58108b34e0f9d84482ce2e133f623dd086f14345adb

Download Submit
C:\Users\Admin\Downloads\MEMZ.exe

Filesize
14KB

MD5
19dbec50735b5f2a72d4199c4e184960

SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822

SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

Download Submit
C:\Users\Admin\Downloads\Nostart.LNjoOmzd.exe.part

Filesize
233KB

MD5
20fa439e1f64c8234d21c4bc102d25f8

SHA1
ba6fc1d9ba968c8328a567db74ef03eee9da97d8

SHA256
2f10f1384f3513f573a88e1771c740a973a5a304387e23aa4bf310794532fa8e

SHA512
19e9d62a852293ffa99a412ba8fa5dd0336a7753af4975e06cd53c02ee6f0058485160f8f8a64a8bca19d88eb426a4a2785885c02a494f33f2b6e383204a7f39

Download Submit
C:\Users\Admin\Downloads\PCToaster.5iSYJ2Qz.exe.part

Filesize
411KB

MD5
04251a49a240dbf60975ac262fc6aeb7

SHA1
e211ca63af2ab85ffab1e5fbbdf28a4ef8f77de0

SHA256
85a58aa96dccd94316a34608ba996656a22c8158d5156b6e454d9d69e6ff38c3

SHA512
3422a231e1dadb68d3567a99d46791392ecf5883fd3bbc2cae19a595364dac46e4b2712db70b61b488937d906413d39411554034ffd3058389700a93c17568d2

Download Submit
C:\Users\Admin\Downloads\WannaCry.exe

Filesize
224KB

MD5
5c7fb0927db37372da25f270708103a2

SHA1
120ed9279d85cbfa56e5b7779ffa7162074f7a29

SHA256
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

SHA512
a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

Download Submit
C:\Users\Admin\Downloads\scr.txt

Filesize
45B

MD5
ad1869d6f0b2b809394605d3e73eeb74

SHA1
4bdedd14bfea9f891b98c4cc82c5f82a58df67f6

SHA256
7e9cde40095f2a877375cb30fecd4f64cf328e3ab11baed5242f73cbb94bd394

SHA512
8fe0f269daf94feaa246a644dbeeda52916855f1d2bfd2c6c876c7c9c80b0ceb7e42caf0b64a70bda9a64d4529b885aaa38998a515d6abbe88ad367e72324136

Download Submit
memory/384-1732-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/384-1180-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/864-1684-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/864-1671-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1344-1188-0x000001D810CC0000-0x000001D810CC1000-memory.dmp

Filesize
4KB

Download
memory/1344-1183-0x000001D810CC0000-0x000001D810CC1000-memory.dmp

Filesize
4KB

Download
memory/1344-1191-0x000001D810CC0000-0x000001D810CC1000-memory.dmp

Filesize
4KB

Download
memory/1344-1192-0x000001D810CC0000-0x000001D810CC1000-memory.dmp

Filesize
4KB

Download
memory/1344-1193-0x000001D810CC0000-0x000001D810CC1000-memory.dmp

Filesize
4KB

Download
memory/1344-1190-0x000001D810CC0000-0x000001D810CC1000-memory.dmp

Filesize
4KB

Download
memory/1344-1181-0x000001D810CC0000-0x000001D810CC1000-memory.dmp

Filesize
4KB

Download
memory/1344-1182-0x000001D810CC0000-0x000001D810CC1000-memory.dmp

Filesize
4KB

Download
memory/1344-1189-0x000001D810CC0000-0x000001D810CC1000-memory.dmp

Filesize
4KB

Download
memory/2280-1122-0x000001FD6D4E0000-0x000001FD6D4E1000-memory.dmp

Filesize
4KB

Download
memory/2280-1114-0x000001FD6D4E0000-0x000001FD6D4E1000-memory.dmp

Filesize
4KB

Download
memory/2280-1112-0x000001FD6D4E0000-0x000001FD6D4E1000-memory.dmp

Filesize
4KB

Download
memory/2280-1113-0x000001FD6D4E0000-0x000001FD6D4E1000-memory.dmp

Filesize
4KB

Download
memory/2280-1118-0x000001FD6D4E0000-0x000001FD6D4E1000-memory.dmp

Filesize
4KB

Download
memory/2280-1121-0x000001FD6D4E0000-0x000001FD6D4E1000-memory.dmp

Filesize
4KB

Download
memory/2280-1119-0x000001FD6D4E0000-0x000001FD6D4E1000-memory.dmp

Filesize
4KB

Download
memory/2280-1124-0x000001FD6D4E0000-0x000001FD6D4E1000-memory.dmp

Filesize
4KB

Download
memory/2280-1120-0x000001FD6D4E0000-0x000001FD6D4E1000-memory.dmp

Filesize
4KB

Download
memory/2280-1123-0x000001FD6D4E0000-0x000001FD6D4E1000-memory.dmp

Filesize
4KB

Download
memory/3484-1682-0x00000296CB370000-0x00000296CB371000-memory.dmp

Filesize
4KB

Download
memory/3484-1678-0x00000296CB370000-0x00000296CB371000-memory.dmp

Filesize
4KB

Download
memory/3484-1677-0x00000296CB370000-0x00000296CB371000-memory.dmp

Filesize
4KB

Download
memory/3484-1679-0x00000296CB370000-0x00000296CB371000-memory.dmp

Filesize
4KB

Download
memory/3484-1680-0x00000296CB370000-0x00000296CB371000-memory.dmp

Filesize
4KB

Download
memory/3484-1674-0x00000296CB370000-0x00000296CB371000-memory.dmp

Filesize
4KB

Download
memory/3484-1673-0x00000296CB370000-0x00000296CB371000-memory.dmp

Filesize
4KB

Download
memory/3484-1672-0x00000296CB370000-0x00000296CB371000-memory.dmp

Filesize
4KB

Download
memory/3484-1681-0x00000296CB370000-0x00000296CB371000-memory.dmp

Filesize
4KB

Download
memory/3876-1560-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4144-1590-0x000002013DFA0000-0x000002013DFA1000-memory.dmp

Filesize
4KB

Download
memory/4144-1605-0x000002013DFA0000-0x000002013DFA1000-memory.dmp

Filesize
4KB

Download
memory/4144-1606-0x000002013DFA0000-0x000002013DFA1000-memory.dmp

Filesize
4KB

Download
memory/4144-1616-0x000002013DFA0000-0x000002013DFA1000-memory.dmp

Filesize
4KB

Download
memory/4144-1663-0x000002013DFA0000-0x000002013DFA1000-memory.dmp

Filesize
4KB

Download
memory/4144-1585-0x000002013DFA0000-0x000002013DFA1000-memory.dmp

Filesize
4KB

Download
memory/4144-1582-0x000002013DFA0000-0x000002013DFA1000-memory.dmp

Filesize
4KB

Download
memory/4144-1730-0x000002013DFA0000-0x000002013DFA1000-memory.dmp

Filesize
4KB

Download