Overview

overview

10

Static

static

10

2026-09-03...ry.exe

windows11-ltsc_2024-x64

10

Resubmissions

05/09/2026, 22:29

260905-2eqavateph10

05/09/2026, 22:25

260905-2b33jatelc10

Analysis

  • user interaction
    yes
  • max time kernel
    102s
  • max time network
    87s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/09/2026, 22:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-03_a2b013014ac56157d3a97ea3889b8406_elex_wannacry.exe
  • Size 60KB
  • Sample260905-2eqavateph
  • SHA256 def77bd8d0f97e12f07173110e0ebd3a5540f83e0cdf98574426ff7e3c470570
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryexecutionstormserpersistenceworm

Malware Config

Signatures

  • Family: Stormser, StormDDoS, StormAttack, Stormer

    Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.

    wormstormser
  • Detects Stormser aka Storm DDoS and StormAttack 16 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 34 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 16 IoCs
  • Drops file in Windows directory 17 IoCs
  • Executes a command shell one-liner 1 TTPs 16 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 25 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-03_a2b013014ac56157d3a97ea3889b8406_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-03_a2b013014ac56157d3a97ea3889b8406_elex_wannacry.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4260
    • C:\Windows\{5FA5AF1C-2FF1-4a1c-8AD7-42C47CF17BA8}.exe
      C:\Windows\{5FA5AF1C-2FF1-4a1c-8AD7-42C47CF17BA8}.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1704
      • C:\Windows\{AC958511-30A4-44e0-9D8D-55CAE2C55FC6}.exe
        C:\Windows\{AC958511-30A4-44e0-9D8D-55CAE2C55FC6}.exe
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:404
        • C:\Windows\{30887941-9CBF-47ce-AA12-23B15008C585}.exe
          C:\Windows\{30887941-9CBF-47ce-AA12-23B15008C585}.exe
          4⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5296
          • C:\Windows\{9A0448E6-78C7-4b01-B2D7-863EECA63971}.exe
            C:\Windows\{9A0448E6-78C7-4b01-B2D7-863EECA63971}.exe
            5⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4300
            • C:\Windows\{F20C637D-E465-4e65-8C92-4DF50F37AF0C}.exe
              C:\Windows\{F20C637D-E465-4e65-8C92-4DF50F37AF0C}.exe
              6⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1128
              • C:\Windows\{763180DF-4E44-4a1f-BB64-3635FA90DC85}.exe
                C:\Windows\{763180DF-4E44-4a1f-BB64-3635FA90DC85}.exe
                7⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1740
                • C:\Windows\{9BDAC3CE-36C1-4238-A8FE-2E988EB93568}.exe
                  C:\Windows\{9BDAC3CE-36C1-4238-A8FE-2E988EB93568}.exe
                  8⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4812
                  • C:\Windows\{AE3B45D3-77FE-453c-A90E-141CBCFE3C24}.exe
                    C:\Windows\{AE3B45D3-77FE-453c-A90E-141CBCFE3C24}.exe
                    9⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:3144
                    • C:\Windows\{F4884C45-D344-4d74-AD85-DFF10CF80811}.exe
                      C:\Windows\{F4884C45-D344-4d74-AD85-DFF10CF80811}.exe
                      10⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:700
                      • C:\Windows\{21D64AD4-651E-4e21-8205-D421D21D0FA6}.exe
                        C:\Windows\{21D64AD4-651E-4e21-8205-D421D21D0FA6}.exe
                        11⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:3620
                        • C:\Windows\{54DA2662-5AC6-448e-AB8A-75EB5FBD31C5}.exe
                          C:\Windows\{54DA2662-5AC6-448e-AB8A-75EB5FBD31C5}.exe
                          12⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:4612
                          • C:\Windows\{4E98163B-8D55-4235-8A68-257EBE8C52E8}.exe
                            C:\Windows\{4E98163B-8D55-4235-8A68-257EBE8C52E8}.exe
                            13⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:892
                            • C:\Windows\{8F786864-E7B1-4179-9BAE-3AF932CA06DD}.exe
                              C:\Windows\{8F786864-E7B1-4179-9BAE-3AF932CA06DD}.exe
                              14⤵
                              • Boot or Logon Autostart Execution: Active Setup
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:5496
                              • C:\Windows\{0885B534-D602-4bdc-81A1-5E925A87FFD2}.exe
                                C:\Windows\{0885B534-D602-4bdc-81A1-5E925A87FFD2}.exe
                                15⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4796
                                • C:\Windows\{ADC24D72-2F65-4a56-8B9C-F4F971934487}.exe
                                  C:\Windows\{ADC24D72-2F65-4a56-8B9C-F4F971934487}.exe
                                  16⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:900
                                  • C:\Windows\{C9F10C46-5EE0-4cd7-B208-E3E83BE8B0FE}.exe
                                    C:\Windows\{C9F10C46-5EE0-4cd7-B208-E3E83BE8B0FE}.exe
                                    17⤵
                                    • Boot or Logon Autostart Execution: Active Setup
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    PID:3612
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c del C:\Windows\{ADC24~1.EXE > nul
                                    17⤵
                                    • Executes a command shell one-liner
                                    • System Location Discovery: System Language Discovery
                                    PID:5832
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c del C:\Windows\{0885B~1.EXE > nul
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  PID:6032
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{8F786~1.EXE > nul
                                15⤵
                                • Executes a command shell one-liner
                                • System Location Discovery: System Language Discovery
                                PID:3764
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c del C:\Windows\{4E981~1.EXE > nul
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              PID:3736
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{54DA2~1.EXE > nul
                            13⤵
                            • Executes a command shell one-liner
                            • System Location Discovery: System Language Discovery
                            PID:5976
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{21D64~1.EXE > nul
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          PID:3416
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c del C:\Windows\{F4884~1.EXE > nul
                        11⤵
                        • Executes a command shell one-liner
                        • System Location Discovery: System Language Discovery
                        PID:976
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{AE3B4~1.EXE > nul
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      PID:5412
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c del C:\Windows\{9BDAC~1.EXE > nul
                    9⤵
                    • Executes a command shell one-liner
                    • System Location Discovery: System Language Discovery
                    PID:4632
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c del C:\Windows\{76318~1.EXE > nul
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  PID:5932
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c del C:\Windows\{F20C6~1.EXE > nul
                7⤵
                • Executes a command shell one-liner
                • System Location Discovery: System Language Discovery
                PID:3540
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c del C:\Windows\{9A044~1.EXE > nul
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              PID:5888
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c del C:\Windows\{30887~1.EXE > nul
            5⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            PID:1160
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del C:\Windows\{AC958~1.EXE > nul
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          PID:5772
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5FA5A~1.EXE > nul
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:1952
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:4552
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3656
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1596
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {03cc7f96-6c4d-4db9-8746-451f43d313a2} -parentPid 1596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1596" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        3⤵
          PID:1096
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {2ed0e309-aa0f-44ae-9dd9-bf90380ddace} -parentPid 1596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
          3⤵
          • Checks processor information in registry
          PID:4364
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3968 -prefsLen 27274 -prefMapHandle 3972 -prefMapSize 270279 -jsInitHandle 3976 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3984 -initialChannelId {a169b247-5cae-4235-ace3-72e285807c15} -parentPid 1596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
          3⤵
          • Checks processor information in registry
          PID:3016
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4124 -prefsLen 27274 -prefMapHandle 4128 -prefMapSize 270279 -ipcHandle 4220 -initialChannelId {fe9c9b3c-ea67-4bfa-8612-94368923b411} -parentPid 1596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1596" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
          3⤵
            PID:296
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4492 -prefsLen 34773 -prefMapHandle 4496 -prefMapSize 270279 -jsInitHandle 4500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4508 -initialChannelId {aed28162-0de1-4ee8-83d4-0f40c058e673} -parentPid 1596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
            3⤵
            • Checks processor information in registry
            PID:4780
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5040 -prefsLen 35010 -prefMapHandle 5044 -prefMapSize 270279 -ipcHandle 4984 -initialChannelId {419e1ef6-fd37-43de-850f-a2f3c3f4308e} -parentPid 1596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
            3⤵
            • Checks processor information in registry
            PID:2624
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5236 -prefsLen 32900 -prefMapHandle 5240 -prefMapSize 270279 -jsInitHandle 5244 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5248 -initialChannelId {ad609736-08aa-4af7-b644-676328bc0efa} -parentPid 1596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
            3⤵
            • Checks processor information in registry
            PID:4124
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5440 -prefsLen 32900 -prefMapHandle 5444 -prefMapSize 270279 -jsInitHandle 5448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5456 -initialChannelId {647e0728-bf1c-4cd1-b706-a2b5ebda46e7} -parentPid 1596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
            3⤵
            • Checks processor information in registry
            PID:6052
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5632 -prefsLen 32900 -prefMapHandle 5636 -prefMapSize 270279 -jsInitHandle 5640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5644 -initialChannelId {1a633dbd-bdf7-4699-aae1-62a65c3ff298} -parentPid 1596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
            3⤵
            • Checks processor information in registry
            PID:3344
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        1⤵
        • Checks SCSI registry key(s)
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2180
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k GPSvcGroup
        1⤵
          PID:5552

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\db\data.safe.tmp
              • Size 7KB
              • SHA256 46497f172591ecbb91e6cb498101d573003a27188dd98c81aab1d4f9b9b3af50
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              events
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\events\events
              • Size 1KB
              • SHA256 3342ac66450a7c468850b485317d0d5d0fa16325c62b176444ed54b3e32212ef
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              31eea3a8-db13-4125-9e37-dd6f2422ef7a
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\31eea3a8-db13-4125-9e37-dd6f2422ef7a
              • Size 16KB
              • SHA256 ea0ebaa1cf884634fb7680433bbc8b730c87c657352801b67d21aa2f9c1be1f1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              4b549d79-8748-4c74-a36c-ebd97518f430
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\4b549d79-8748-4c74-a36c-ebd97518f430
              • Size 2KB
              • SHA256 eb0b7d940e2038cbca9de17bdc9d23c5c6e572a34ed8c66385ec6493397aaeb3
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              627e1920-d18f-4042-950b-b3d1832f9c18
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\627e1920-d18f-4042-950b-b3d1832f9c18
              • Size 886B
              • SHA256 a2563ef7a259629047d69d1a0a3e039f72c8b1582e2cc70825b45fbb408b1524
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              d29b6755-f40d-4d45-b5b4-ab5cb08e39ff
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\d29b6755-f40d-4d45-b5b4-ab5cb08e39ff
              • Size 235B
              • SHA256 d3f9ada631abc2593e4f4e3a45367c99869e8d3456a05a63b070bd12c32d895d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              e4a254fd-dd10-4029-9e27-9c3799cd6876
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\e4a254fd-dd10-4029-9e27-9c3799cd6876
              • Size 883B
              • SHA256 af549328bf5d7c5f2219a494bf8e1e31fc3eef6026655322460896375583ab26
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              f26e1b22-c8b3-4012-8e99-1cc957f8bd91
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\f26e1b22-c8b3-4012-8e99-1cc957f8bd91
              • Size 235B
              • SHA256 36afd75aefa9373074fb2afd3397ecfb9745bea079486eafc8d888643ef4b9f0
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              prefs.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\prefs.js
              • Size 6KB
              • SHA256 9bcc791802b729f7fa6a412c9676f905e70586918277a2bef9c8d7856e727607
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\prefs.js
              • Size 6KB
              • SHA256 fd78d902bfc38b6b1000c4ff7a5ea32babaed31901fcac166e0798fa48dc3e15
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              3870112724rsegmnoittet-es.sqlite
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 5.0MB
              • SHA256 d83e1ea157627a3324607ea23169c4100c373fae50974aa45ffa8df8920387ee
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              {0885B534-D602-4bdc-81A1-5E925A87FFD2}.exe
              • Path C:\Windows\{0885B534-D602-4bdc-81A1-5E925A87FFD2}.exe
              • Size 60KB
              • SHA256 0274ae87ba3b9ba8dd8d4b2d600e5e4873e6c734cf19d5a99d6c54cd3fc593d6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              {21D64AD4-651E-4e21-8205-D421D21D0FA6}.exe
              • Path C:\Windows\{21D64AD4-651E-4e21-8205-D421D21D0FA6}.exe
              • Size 60KB
              • SHA256 a72cc6349f4ba36a5e0f7005ba568a7fc4270f87f8a2fdc0f88c2ec88a3ad712
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              {30887941-9CBF-47ce-AA12-23B15008C585}.exe
              • Path C:\Windows\{30887941-9CBF-47ce-AA12-23B15008C585}.exe
              • Size 60KB
              • SHA256 7557f043382c6d7a4ee129cc3c2d25722b68aa5f9fc6458d8afe0430ea17ed96
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              {4E98163B-8D55-4235-8A68-257EBE8C52E8}.exe
              • Path C:\Windows\{4E98163B-8D55-4235-8A68-257EBE8C52E8}.exe
              • Size 60KB
              • SHA256 83762e5de14b37991c0dfd5bbd00534001d2411a10cd631796d59584c7192171
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              {54DA2662-5AC6-448e-AB8A-75EB5FBD31C5}.exe
              • Path C:\Windows\{54DA2662-5AC6-448e-AB8A-75EB5FBD31C5}.exe
              • Size 60KB
              • SHA256 df7330d721b0a859a3293378fd3cb494a49cbfdf304e1f85bb8559e178396343
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              {5FA5AF1C-2FF1-4a1c-8AD7-42C47CF17BA8}.exe
              • Path C:\Windows\{5FA5AF1C-2FF1-4a1c-8AD7-42C47CF17BA8}.exe
              • Size 60KB
              • SHA256 1800754088094fa18cde822048d19221dcc192eb5c772421598e25e38faf42c3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              {763180DF-4E44-4a1f-BB64-3635FA90DC85}.exe
              • Path C:\Windows\{763180DF-4E44-4a1f-BB64-3635FA90DC85}.exe
              • Size 60KB
              • SHA256 00adbbb781c8133db164e37c28936ecf99775300827f6ca595b11d0e22c96d0c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              {8F786864-E7B1-4179-9BAE-3AF932CA06DD}.exe
              • Path C:\Windows\{8F786864-E7B1-4179-9BAE-3AF932CA06DD}.exe
              • Size 60KB
              • SHA256 083b6067452fec7fa516afb671b8427180c9e2f4244616281c6d8fa640b5b3af
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              {9A0448E6-78C7-4b01-B2D7-863EECA63971}.exe
              • Path C:\Windows\{9A0448E6-78C7-4b01-B2D7-863EECA63971}.exe
              • Size 60KB
              • SHA256 80d8a59d4cccc837fc10b0e41b8e3dcd12205aef0bad6c7d35eb5b03445614b7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              {9BDAC3CE-36C1-4238-A8FE-2E988EB93568}.exe
              • Path C:\Windows\{9BDAC3CE-36C1-4238-A8FE-2E988EB93568}.exe
              • Size 60KB
              • SHA256 6b5ca2753411bc105e1f42e2d4dc4e7c8d1028aaf6a6b53cef6d7d4580ed7f6d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              {AC958511-30A4-44e0-9D8D-55CAE2C55FC6}.exe
              • Path C:\Windows\{AC958511-30A4-44e0-9D8D-55CAE2C55FC6}.exe
              • Size 60KB
              • SHA256 f7533d859476412ce651a84ebbdfe037fa0eb7ac84d3f84c160993cd0f95b733
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              {ADC24D72-2F65-4a56-8B9C-F4F971934487}.exe
              • Path C:\Windows\{ADC24D72-2F65-4a56-8B9C-F4F971934487}.exe
              • Size 60KB
              • SHA256 798bed4c15616bf37d49dbdfed56b13ac139821cf602cb3ff2856f11fbaae786
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              {AE3B45D3-77FE-453c-A90E-141CBCFE3C24}.exe
              • Path C:\Windows\{AE3B45D3-77FE-453c-A90E-141CBCFE3C24}.exe
              • Size 60KB
              • SHA256 3260a6afa7243d56ff865e4f0897bae609e9283c0051879e0bd09d83867fece1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              {C9F10C46-5EE0-4cd7-B208-E3E83BE8B0FE}.exe
              • Path C:\Windows\{C9F10C46-5EE0-4cd7-B208-E3E83BE8B0FE}.exe
              • Size 60KB
              • SHA256 5679f6aa6587c2089f057b0c60f7cdf57c54c7493c2d615aefb1d9f3478c5174
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              {F20C637D-E465-4e65-8C92-4DF50F37AF0C}.exe
              • Path C:\Windows\{F20C637D-E465-4e65-8C92-4DF50F37AF0C}.exe
              • Size 60KB
              • SHA256 9f95412ae73bf797474988c28d3881e2625edb1cf75183d0b96e7d315b1d64a5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              {F4884C45-D344-4d74-AD85-DFF10CF80811}.exe
              • Path C:\Windows\{F4884C45-D344-4d74-AD85-DFF10CF80811}.exe
              • Size 60KB
              • SHA256 e36b6bb9ef4b5e1cdea0b37b372c0bd0920bd8ee7eae90dfd4f67014597c50f0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/2180-464-0x0000026836A20000-0x0000026836A21000-memory.dmp
              Download

              memory/2180-462-0x0000026836A20000-0x0000026836A21000-memory.dmp
              Download

              memory/2180-471-0x0000026836A20000-0x0000026836A21000-memory.dmp
              Download

              memory/2180-469-0x0000026836A20000-0x0000026836A21000-memory.dmp
              Download

              memory/2180-473-0x0000026836A20000-0x0000026836A21000-memory.dmp
              Download

              memory/2180-472-0x0000026836A20000-0x0000026836A21000-memory.dmp
              Download

              memory/2180-470-0x0000026836A20000-0x0000026836A21000-memory.dmp
              Download

              memory/2180-468-0x0000026836A20000-0x0000026836A21000-memory.dmp
              Download

              memory/2180-487-0x00000268380F0000-0x0000026838296000-memory.dmp
              Download