chaos | 105563733da3a05eef4e63a8af883b600e071e5449c819f0780bec73d0c404bf

Resubmissions

31/03/2024, 14:49

240331-r687xsec7710

29/03/2024, 09:29

29/03/2024, 08:58

29/03/2024, 08:57

29/03/2024, 08:49

Analysis

max time kernel
313s
max time network
315s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
31/03/2024, 14:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
234.zip
Size 111KB
Sample240331-r687xsec77
SHA256 105563733da3a05eef4e63a8af883b600e071e5449c819f0780bec73d0c404bf
MD5 5e7e62594a2982835c7aea2fa131b393
SHA1 7319b88fc092922534b53ee7b37297ac4dfcf839
SHA512 08edf60a7e55a9e9d90f48baacc290e039952c1da45cf56a2b850cd740cd97b1f67bea6456730f2d8f20ca6e9787ed4b81740182ee771b5a9844e4fe53da82a3
SSDEEP 1536:VYLMdhI1JzP3TynJWM5xkcXp4siewExDNOm3nmHyJGwlILvFlAY/2BE54DqHAzXE:zUDWLx54s/nxDN1WECLzF4qHcPbJL6Bn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

chaos evasion ransomware spyware stealer

Malware Config

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 2 IoCs

resource	yara_rule
behavioral1/memory/2496-14-0x0000000000A90000-0x0000000000ABA000-memory.dmp	family_chaos
behavioral1/files/0x000300000002a7d3-20.dat	family_chaos

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5024	bcdedit.exe
1836	bcdedit.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3188	wbadmin.exe

Drops startup file 9 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hahaha.txt	Decrypter.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	svchost.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\svchost.url	taskmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\hahaha.txt	taskmgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hahaha.txt	svchost.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini.eow6	taskmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.eow6	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	Decrypter.exe

Executes dropped EXE 3 IoCs

pid	Process
2056	svchost.exe
2856	Decrypter.exe
1360	Decrypter.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	Decrypter.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-627134735-902745853-4257352768-1000\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	Decrypter.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-627134735-902745853-4257352768-1000\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-627134735-902745853-4257352768-1000\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	svchost.exe

Sets desktop wallpaper using registry 2 TTPs 4 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0vx1c5hr8.jpg"	Decrypter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nt63tvaky.jpg"	Decrypter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zvo8fursh.jpg"	Decrypter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yl9tj0vpk.jpg"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 7 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe

Checks processor information in registry 2 TTPs 32 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1936	vssadmin.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2668	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2056	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3076	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3076	taskmgr.exe
Token: SeSystemProfilePrivilege	3076	taskmgr.exe
Token: SeCreateGlobalPrivilege	3076	taskmgr.exe
Token: SeDebugPrivilege	2496	antivirus.exe
Token: SeDebugPrivilege	2056	svchost.exe
Token: SeBackupPrivilege	4580	vssvc.exe
Token: SeRestorePrivilege	4580	vssvc.exe
Token: SeAuditPrivilege	4580	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2132	WMIC.exe
Token: SeSecurityPrivilege	2132	WMIC.exe
Token: SeTakeOwnershipPrivilege	2132	WMIC.exe
Token: SeLoadDriverPrivilege	2132	WMIC.exe
Token: SeSystemProfilePrivilege	2132	WMIC.exe
Token: SeSystemtimePrivilege	2132	WMIC.exe
Token: SeProfSingleProcessPrivilege	2132	WMIC.exe
Token: SeIncBasePriorityPrivilege	2132	WMIC.exe
Token: SeCreatePagefilePrivilege	2132	WMIC.exe
Token: SeBackupPrivilege	2132	WMIC.exe
Token: SeRestorePrivilege	2132	WMIC.exe
Token: SeShutdownPrivilege	2132	WMIC.exe
Token: SeDebugPrivilege	2132	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2132	WMIC.exe
Token: SeRemoteShutdownPrivilege	2132	WMIC.exe
Token: SeUndockPrivilege	2132	WMIC.exe
Token: SeManageVolumePrivilege	2132	WMIC.exe
Token: 33	2132	WMIC.exe
Token: 34	2132	WMIC.exe
Token: 35	2132	WMIC.exe
Token: 36	2132	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2132	WMIC.exe
Token: SeSecurityPrivilege	2132	WMIC.exe
Token: SeTakeOwnershipPrivilege	2132	WMIC.exe
Token: SeLoadDriverPrivilege	2132	WMIC.exe
Token: SeSystemProfilePrivilege	2132	WMIC.exe
Token: SeSystemtimePrivilege	2132	WMIC.exe
Token: SeProfSingleProcessPrivilege	2132	WMIC.exe
Token: SeIncBasePriorityPrivilege	2132	WMIC.exe
Token: SeCreatePagefilePrivilege	2132	WMIC.exe
Token: SeBackupPrivilege	2132	WMIC.exe
Token: SeRestorePrivilege	2132	WMIC.exe
Token: SeShutdownPrivilege	2132	WMIC.exe
Token: SeDebugPrivilege	2132	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2132	WMIC.exe
Token: SeRemoteShutdownPrivilege	2132	WMIC.exe
Token: SeUndockPrivilege	2132	WMIC.exe
Token: SeManageVolumePrivilege	2132	WMIC.exe
Token: 33	2132	WMIC.exe
Token: 34	2132	WMIC.exe
Token: 35	2132	WMIC.exe
Token: 36	2132	WMIC.exe
Token: SeBackupPrivilege	1944	wbengine.exe
Token: SeRestorePrivilege	1944	wbengine.exe
Token: SeSecurityPrivilege	1944	wbengine.exe
Token: SeDebugPrivilege	4648	Decrypter.exe
Token: SeDebugPrivilege	2856	Decrypter.exe
Token: SeDebugPrivilege	2776	firefox.exe
Token: SeDebugPrivilege	2776	firefox.exe
Token: SeDebugPrivilege	4744	firefox.exe
Token: SeDebugPrivilege	4744	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	4848	firefox.exe
Token: SeDebugPrivilege	4848	firefox.exe
Token: SeDebugPrivilege	1360	Decrypter.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe

Suspicious use of SetWindowsHookEx 34 IoCs

pid	Process
2500	OpenWith.exe
5080	OpenWith.exe
5080	OpenWith.exe
5080	OpenWith.exe
5080	OpenWith.exe
5080	OpenWith.exe
5080	OpenWith.exe
5080	OpenWith.exe
5080	OpenWith.exe
5080	OpenWith.exe
5080	OpenWith.exe
5080	OpenWith.exe
2776	firefox.exe
4744	firefox.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
2636	firefox.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
4848	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2056	2496	antivirus.exe	90
PID 2496 wrote to memory of 2056	2496	antivirus.exe	90
PID 2056 wrote to memory of 3492	2056	svchost.exe	92
PID 2056 wrote to memory of 3492	2056	svchost.exe	92
PID 3492 wrote to memory of 1936	3492	cmd.exe	94
PID 3492 wrote to memory of 1936	3492	cmd.exe	94
PID 3492 wrote to memory of 2132	3492	cmd.exe	97
PID 3492 wrote to memory of 2132	3492	cmd.exe	97
PID 2056 wrote to memory of 3596	2056	svchost.exe	99
PID 2056 wrote to memory of 3596	2056	svchost.exe	99
PID 3596 wrote to memory of 5024	3596	cmd.exe	101
PID 3596 wrote to memory of 5024	3596	cmd.exe	101
PID 3596 wrote to memory of 1836	3596	cmd.exe	102
PID 3596 wrote to memory of 1836	3596	cmd.exe	102
PID 2056 wrote to memory of 3868	2056	svchost.exe	103
PID 2056 wrote to memory of 3868	2056	svchost.exe	103
PID 3868 wrote to memory of 3188	3868	cmd.exe	105
PID 3868 wrote to memory of 3188	3868	cmd.exe	105
PID 2056 wrote to memory of 2668	2056	svchost.exe	109
PID 2056 wrote to memory of 2668	2056	svchost.exe	109
PID 5080 wrote to memory of 2936	5080	OpenWith.exe	119
PID 5080 wrote to memory of 2936	5080	OpenWith.exe	119
PID 2936 wrote to memory of 2776	2936	firefox.exe	120
PID 2936 wrote to memory of 2776	2936	firefox.exe	120
PID 2936 wrote to memory of 2776	2936	firefox.exe	120
PID 2936 wrote to memory of 2776	2936	firefox.exe	120
PID 2936 wrote to memory of 2776	2936	firefox.exe	120
PID 2936 wrote to memory of 2776	2936	firefox.exe	120
PID 2936 wrote to memory of 2776	2936	firefox.exe	120
PID 2936 wrote to memory of 2776	2936	firefox.exe	120
PID 2936 wrote to memory of 2776	2936	firefox.exe	120
PID 2936 wrote to memory of 2776	2936	firefox.exe	120
PID 2936 wrote to memory of 2776	2936	firefox.exe	120
PID 2776 wrote to memory of 2780	2776	firefox.exe	121
PID 2776 wrote to memory of 2780	2776	firefox.exe	121
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\234.zip
1⤵
PID:5008

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Drops startup file
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:344

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" shell:::{52205fd8-5dfb-447d-801a-d0b52f2e83e1}
1⤵
PID:2312

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:2352

C:\Users\Admin\Desktop\antivirus.exe
"C:\Users\Admin\Desktop\antivirus.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Sets desktop wallpaper using registry
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3492
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:1936
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2132
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3596
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5024
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1836
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3868
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:3188
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\hahaha.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2668

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:652

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:2684

C:\Users\Admin\Desktop\decryptor-decrypter\Decrypter.exe
"C:\Users\Admin\Desktop\decryptor-decrypter\Decrypter.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Users\Admin\Desktop\decryptor-decrypter\Decrypter.exe
"C:\Users\Admin\Desktop\decryptor-decrypter\Decrypter.exe"
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2500

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\desktop.ini"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Desktop\desktop.ini
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2776.0.1260575939\780382671" -parentBuildID 20221007134813 -prefsHandle 1808 -prefMapHandle 1776 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c78ca84-f8c1-4b3b-8512-3a2ce29a3a4f} 2776 "\\.\pipe\gecko-crash-server-pipe.2776" 1888 194115e4d58 gpu
      4⤵
      PID:2780
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2776.1.1715282098\1744504029" -parentBuildID 20221007134813 -prefsHandle 2272 -prefMapHandle 2268 -prefsLen 21563 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {447b586e-11da-4458-936f-d71e75bfadb4} 2776 "\\.\pipe\gecko-crash-server-pipe.2776" 2284 194115e3858 socket
      4⤵
      Checks processor information in registry
      PID:252
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2776.2.350153117\448047596" -childID 1 -isForBrowser -prefsHandle 2896 -prefMapHandle 2736 -prefsLen 21601 -prefMapSize 233444 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed2ac286-91a5-4358-bb0f-268393267890} 2776 "\\.\pipe\gecko-crash-server-pipe.2776" 2740 19416b2e258 tab
      4⤵
      PID:3552
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2776.3.1546013111\365321995" -childID 2 -isForBrowser -prefsHandle 3500 -prefMapHandle 3408 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {912b901a-b0ed-456e-af17-48e395aff995} 2776 "\\.\pipe\gecko-crash-server-pipe.2776" 3496 1940585b258 tab
      4⤵
      PID:1452
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2776.4.426705939\1150251704" -childID 3 -isForBrowser -prefsHandle 4752 -prefMapHandle 4560 -prefsLen 26298 -prefMapSize 233444 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {130f6840-d18f-4169-a6e6-76c4dd59fe14} 2776 "\\.\pipe\gecko-crash-server-pipe.2776" 4768 1940585f858 tab
      4⤵
      PID:1908
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2776.5.745424597\315330880" -childID 4 -isForBrowser -prefsHandle 4932 -prefMapHandle 4784 -prefsLen 26298 -prefMapSize 233444 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {277c0caa-b46f-4831-b256-ce18846ecad1} 2776 "\\.\pipe\gecko-crash-server-pipe.2776" 3100 19418cccd58 tab
      4⤵
      PID:232
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2776.6.931370989\1800007599" -childID 5 -isForBrowser -prefsHandle 5100 -prefMapHandle 5104 -prefsLen 26298 -prefMapSize 233444 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {711b99f5-ed96-480c-a985-251a11fd4ebd} 2776 "\\.\pipe\gecko-crash-server-pipe.2776" 5112 19418cfce58 tab
      4⤵
      PID:1040

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2412
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4744.0.669266423\632767013" -parentBuildID 20221007134813 -prefsHandle 1760 -prefMapHandle 1752 -prefsLen 20871 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {86bc49d5-2ba5-4a2b-a199-737fd3742715} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" 1852 1fb6c5d3058 gpu
    3⤵
    PID:3068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4744.1.250070797\1460493009" -parentBuildID 20221007134813 -prefsHandle 2204 -prefMapHandle 2200 -prefsLen 20907 -prefMapSize 233496 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e0e820b-0f2b-4893-bc3a-b411843da0b9} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" 2216 1fb60671f58 socket
    3⤵
    - Checks processor information in registry
    PID:2500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4744.2.705004379\381451250" -childID 1 -isForBrowser -prefsHandle 2872 -prefMapHandle 2868 -prefsLen 21010 -prefMapSize 233496 -jsInitHandle 1372 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b400f214-438f-4f38-b326-93fe88099ff3} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" 3116 1fb71875e58 tab
    3⤵
    PID:4960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4744.3.327442204\1192375774" -childID 2 -isForBrowser -prefsHandle 972 -prefMapHandle 980 -prefsLen 26188 -prefMapSize 233496 -jsInitHandle 1372 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c24cd9a6-cc95-49de-b0ca-97e5331aa3e8} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" 3428 1fb6f1bdf58 tab
    3⤵
    PID:1908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4744.4.35824491\19157553" -childID 3 -isForBrowser -prefsHandle 4588 -prefMapHandle 4584 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 1372 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80d368a2-ac6b-4612-a48b-43a1187c560d} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" 4596 1fb73ba3658 tab
    3⤵
    PID:4216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4744.5.1938603717\1495638076" -childID 4 -isForBrowser -prefsHandle 4940 -prefMapHandle 4944 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 1372 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9cf8281-1496-4e2e-83e7-d9f758a429c2} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" 5012 1fb73dc5158 tab
    3⤵
    PID:4624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4744.6.1945250176\1609791854" -childID 5 -isForBrowser -prefsHandle 5104 -prefMapHandle 5108 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 1372 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {732d8687-0819-4445-8a1b-47f49756bb09} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" 4596 1fb73dc7858 tab
    3⤵
    PID:2776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4744.7.36332049\323680427" -childID 6 -isForBrowser -prefsHandle 5300 -prefMapHandle 5304 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 1372 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5c245d4-c0bc-489a-8108-94871a22ec35} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" 5292 1fb73dc6358 tab
    3⤵
    PID:3268

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:304
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\decryptor-decrypter\publicKey.chaos"
  2⤵
  PID:4780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Desktop\decryptor-decrypter\publicKey.chaos
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2636
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.0.1168250910\2098086839" -parentBuildID 20221007134813 -prefsHandle 1792 -prefMapHandle 1784 -prefsLen 20871 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c451a342-ac58-4520-b2f0-32fedaf6e601} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 1884 2592d1d3258 gpu
      4⤵
      PID:1968
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.1.213574535\2132388305" -parentBuildID 20221007134813 -prefsHandle 2272 -prefMapHandle 2268 -prefsLen 21687 -prefMapSize 233496 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73ed3134-5af9-4cca-99f8-12f11c30ffdb} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 2284 2592d103558 socket
      4⤵
      Checks processor information in registry
      PID:3400
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.2.1819206368\533366021" -childID 1 -isForBrowser -prefsHandle 3016 -prefMapHandle 3032 -prefsLen 21725 -prefMapSize 233496 -jsInitHandle 1364 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebdf3b89-13eb-4600-9db6-e70aa74ab27b} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 3008 259325b7258 tab
      4⤵
      PID:952
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.3.751442\481212144" -childID 2 -isForBrowser -prefsHandle 3408 -prefMapHandle 3404 -prefsLen 26188 -prefMapSize 233496 -jsInitHandle 1364 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a201769b-70c6-4d6b-9bfb-90b432413ea4} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 3420 2592fb97f58 tab
      4⤵
      PID:4652
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.4.2097382532\166082485" -childID 3 -isForBrowser -prefsHandle 4880 -prefMapHandle 4952 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 1364 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ca6baee-f704-4ebc-85e5-7d86d4983f63} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 4868 259329b3658 tab
      4⤵
      PID:4152
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.5.85176778\1719075760" -childID 4 -isForBrowser -prefsHandle 5060 -prefMapHandle 5064 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 1364 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43adfbcd-9d78-4087-8155-5f49c9c3d236} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 5056 259346c5258 tab
      4⤵
      PID:3524
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.6.1673256410\142025129" -childID 5 -isForBrowser -prefsHandle 5232 -prefMapHandle 5236 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 1364 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e87ebcee-0ad1-4655-914d-82d890fb617a} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 5220 259346c4c58 tab
      4⤵
      PID:4016

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1008
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\decryptor-decrypter\privateKey.chaos"
  2⤵
  PID:1132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Desktop\decryptor-decrypter\privateKey.chaos
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4848
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4848.0.1826188177\71170560" -parentBuildID 20221007134813 -prefsHandle 1748 -prefMapHandle 1740 -prefsLen 20871 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ceaa2805-81a4-48ca-8de0-188d4e69afe4} 4848 "\\.\pipe\gecko-crash-server-pipe.4848" 1844 261ffdce658 gpu
      4⤵
      PID:5052
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4848.1.108996179\548523956" -parentBuildID 20221007134813 -prefsHandle 2224 -prefMapHandle 2220 -prefsLen 21687 -prefMapSize 233496 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {13719bf1-2b01-4f5f-a8e1-cba70772edca} 4848 "\\.\pipe\gecko-crash-server-pipe.4848" 2236 261ffd03558 socket
      4⤵
      Checks processor information in registry
      PID:1952
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4848.2.1739847598\707084373" -childID 1 -isForBrowser -prefsHandle 3148 -prefMapHandle 3144 -prefsLen 21725 -prefMapSize 233496 -jsInitHandle 1040 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7831b6d5-ee82-44aa-b3dc-e317d2550b8a} 4848 "\\.\pipe\gecko-crash-server-pipe.4848" 3120 26187aa6858 tab
      4⤵
      PID:3948
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4848.3.1997289200\1933695109" -childID 2 -isForBrowser -prefsHandle 3460 -prefMapHandle 3456 -prefsLen 26188 -prefMapSize 233496 -jsInitHandle 1040 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {08db5166-5880-4bf5-b9ee-5e0be575aca2} 4848 "\\.\pipe\gecko-crash-server-pipe.4848" 3468 2618519cb58 tab
      4⤵
      PID:2044
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4848.4.741121552\2023786789" -childID 3 -isForBrowser -prefsHandle 4816 -prefMapHandle 4820 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 1040 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {faeca576-4bca-4665-b094-e898cbd35f5b} 4848 "\\.\pipe\gecko-crash-server-pipe.4848" 4844 26185148658 tab
      4⤵
      PID:3620
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4848.5.807667253\1991910720" -childID 4 -isForBrowser -prefsHandle 4976 -prefMapHandle 4980 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 1040 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e56c37d-a928-4b3e-aba1-02a077cf8564} 4848 "\\.\pipe\gecko-crash-server-pipe.4848" 4968 26189eb8a58 tab
      4⤵
      PID:3120
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4848.6.1021688470\1345810791" -childID 5 -isForBrowser -prefsHandle 5176 -prefMapHandle 5180 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 1040 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6dfde14-e4a6-409a-8b29-7171a6700911} 4848 "\\.\pipe\gecko-crash-server-pipe.4848" 5168 26189f67558 tab
      4⤵
      PID:4076

C:\Users\Admin\Desktop\decryptor-decrypter\Decrypter.exe
"C:\Users\Admin\Desktop\decryptor-decrypter\Decrypter.exe"
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
PID:1360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

urlCache-new.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\er0iywxg.default-release\startupCache\urlCache-new.bin
Size 2KB
SHA256 07c22665bb69c004fe53404c731b1f322c9f1eacc001ef951f838f0e0f405a41
MD5 7d91725a72e204041df16d9d4158a13e
SHA1 a1762423e5f70641ad70c81ff958113d5295ad32
SHA512 3cc3c94af068c72a3cde3cf35619d7e033de2adf83e87d97ad2972c35f86fc0299b5cb9a743d57601393c2657442f4826fd86c0a6dea0b6acceafe7ec6480974
MD5 SHA1 SHA512

Submit Download

desktop.ini.eow6

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.eow6
Size 436B
SHA256 f0be6f6afd756dce755a918ec770f4dc3b260266ee62d5f1ee1c008271f18187
MD5 78632940dc67408197bd596623ab4326
SHA1 2b2a6914c5bf0ce8c29c94e40d2ea362841f8a7d
SHA512 d79a7b9656468e19b2ee30a4f6e7558a2f08ce9ad0c44c8fafd9e0a93b84595ca320f329bf45dc86f4ee3abc4acf0cb1dc749f4633ddf8809220ff76dca22eaf
MD5 SHA1 SHA512

Submit Download

svchost.url

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url
Size 142B
SHA256 0a3bdc40dc0d243784bc5fa887b79110350b3d3200684f3ba99880fcea40e3b8
MD5 1a09a38485cbf1d59c29d8e3213e1ab9
SHA1 9cbe6ebd07b13a0d4b2565dc15a273629aa97251
SHA512 a33c228196a4b3f14e40ac6ccb6c43002de28063594c472db852bedac20a6725f4e7601b9f32516e2c6bea35f83746973b3f1d200d9e5d668bda7553b62ac616
MD5 SHA1 SHA512

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\db\data.safe.bin
Size 4KB
SHA256 937f93ea3f27e9711a61bd1347c9d869e0c6ecc7925a00250f5c530fadbdbe71
MD5 88cd17649b6e002ef425f6729d9138bf
SHA1 3bf1a26c14a4a12f779936e44de779a20b8d776d
SHA512 85fdfa05f8be4bb4988137e163a7a83413868f721edc0715ca954cf0bd5f54a01239317084bfacbbc1000d35c0d05008e2461b1ccc0b64a1d52f4c7c8a26ceb5
SSDEEP 96:hfiVkeoA0aiIeu/S7CSYxiISY5Xfi7gk2Pr1ckoSFF9TbkiOa5x/P:9u+Falf/SebxZb9Bu2vTbtOCJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\db\data.safe.bin
Size 5KB
SHA256 f5bb30a0f4c2811090c73c5a181cc8fffa101d97a834fcd8f15ed2ded1afc5ef
MD5 c0ee35abdace90624d66f8b5529894dc
SHA1 5ec32e6746b5481bde7e6860097e4ae5c937cdea
SHA512 5c7f592be5e2a95c55b4596cfa98e5368a1cfc81d6acee1b93ebc00df32c6c4fd0607d013d6182da3137bfbe611eb4d138e2ccede7e77b2403495c54ab641a4d
SSDEEP 96:Bgm51ckoSFF9TbkiOa5x/PG5leH0DFGaiIen8SU2ENS75SYxiISY5ASYWSYJK:42vTbtOmJQ5Galw8SpENSNbxZbKbWbI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\db\data.safe.bin
Size 5KB
SHA256 b7ad63e9ebbf4d09ff1e59a12173eecbd63d12abdf88039890b42aa2cc38fbc7
MD5 ad790c82927cfac86c627e9990e210cf
SHA1 a256db70d3e97894ff3dee4ee5f99857e90c7ff1
SHA512 d2e6c2c3e7859c57b311a360080b8bd1a4579956ea5c66760a8b3b622c9b13de65c2d1f4883d68597c1147b848e1734f0f5572d5f4d981f8091e24095df19f93
SSDEEP 96:59Jle2AgKddHai3ezSU2EdIS7NSYxihSY56SYWSYJoSFF9TbkiOaXx/PIgn31ckK:57WDHam6SpEiSJbxQbMbWbq2vTbtOMJc
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 4bb5d257a9b016c9f0d6b7d0dda6fe75e91a23fa696fe79787481d8a98ad5628
MD5 7da08e4c5c479d46d00e91ae917b91fd
SHA1 b2a4ec492ce118add450e9323afb47f0a62975df
SHA512 4646ed5d1a32fa509a826b8b132ef0f8f19518263021369e0abaf036b5e629e3c03203850a5744b9926912e50eeb2035b5f9a16bafa16866ccdac05eeb6b97f2
MD5 SHA1 SHA512

Submit Download

5d73b3dc-f8fd-406b-b677-8144eac469ca

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\pending_pings\5d73b3dc-f8fd-406b-b677-8144eac469ca
Size 657B
SHA256 f03e6c129f41ddaa0587cd951020eafa346eab54f1f19d507d0f2309b5ba7ac8
MD5 72b001e77591b38000e2064d0e2262d9
SHA1 20f31b5e7df4a0c3b3d0adf96724e2b41472aa31
SHA512 0bd85e3cb715468b65719d442b2433e966a3f6861b5badc5da2e05f82e213aa6f25618aeceee761c0aa674c340406c8f43d398cfe54f6973aad8bed62b84b676
MD5 SHA1 SHA512

Submit Download

5dd10937-a23e-4f74-8c51-9e2a1466d262

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\pending_pings\5dd10937-a23e-4f74-8c51-9e2a1466d262
Size 746B
SHA256 2e16b4250e4fb9d675c129c3310ac31f59d792d59a1e9380043ffd6dfe415389
MD5 c476c862fa49bc2d3ab97aef3ff155b5
SHA1 65ee8e291b067c215cf75fd44c3fed0acbe52305
SHA512 48f36567d052ef238e1af6941f5d8179614c8311832b58f89cfefb671f159c735c96477081e880504e6193ad33653b340cf1785792115b4967c1be9b9b464b45
MD5 SHA1 SHA512

Submit Download

68a230f6-04db-47f2-b561-3cdee02a64b6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\pending_pings\68a230f6-04db-47f2-b561-3cdee02a64b6
Size 734B
SHA256 2d74e8e45cbdeafdf976dad3469037d449a3d90260c2a7ca8c15c39981a71816
MD5 ddf252e23a688de06dade3d416d41c96
SHA1 e6f5a42e91328e275724e4611f49ecc7b351d567
SHA512 6ad9a59aff5ad9247d28cd967f275fa828961e617e98f5bf23c6548677b73f9965312be6dcf990c3791baaca421bc241b0c8825c52417adb5cec8e3d811f8c73
MD5 SHA1 SHA512

Submit Download

abee75b0-00cf-4f78-918d-8efe22824e0a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\pending_pings\abee75b0-00cf-4f78-918d-8efe22824e0a
Size 12KB
SHA256 2fa691e47cf3bb8189869598117f8a11dbc492199f1e69fbbacdef76d6acccbc
MD5 039a1d5ee79011b568df14175d3fe1d5
SHA1 e13acc5af68276f6b42e0961e42af073371b2661
SHA512 920975760fbf472277479250b6f44418d8d2a51ea3f05e1f583b63ee68d63f3ae7395ce59732002866791314275fd6daf6b4bd01b275aceae52cba5ee4eebba7
SSDEEP 192:qlW6oJ92A1bQsFFdR+eDDT1bYVL077vjM7IehA1gFB7DryWuH2fV5OXU3UbKmWNk:qQlGOR
MD5 SHA1 SHA512 SSDEEP

Submit Download

ff3d5087-edfa-44d3-9dcf-f0c00f799c28

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\pending_pings\ff3d5087-edfa-44d3-9dcf-f0c00f799c28
Size 657B
SHA256 f8863d1a1efd8566f451b6a7b7783736af2ea4889720791565dae62b101d5d64
MD5 8f4e092e07dc8bd381d42e085402079a
SHA1 8f4dbf72f385ffa03420a9a229abe2aa8456b91d
SHA512 a7a8d841805160179d059de848df323733172f73846bfd51c32548dd42d5bcfabe567d3df538d0ed298bfedafc24af71b1d8959a39d5d45f23056881937f4e2f
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\prefs-1.js
Size 6KB
SHA256 5716ef20b2b5144cf0f22d1ee02a23b736fd0e012a6bc99621b4fe4f5e685463
MD5 5862b402d4400fff0fffe6b57d2cc26b
SHA1 5f48c5eac27469ce57b37c7e648a0443ce9092ae
SHA512 8902f787348f66e6c2cd72ddc571a7b78106e91668e4880a7dfb4add335617e268ff47d67d2301b8ce46a8ca6aec9b3d21c0592094a2b2eef88ce515c31e0c31
SSDEEP 96:xHoi5nUTeqGqoFTdCQJeOTzS/PXAnpj9HnkIUIv03Bw8Hf2j:/5nIRYTdCQJeRPX+9q3Bw8H4
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\prefs-1.js
Size 6KB
SHA256 d6d319562a8e4713321d013f876ae797047ed0d6cc0bb67ce19b318362d60e02
MD5 3dec0d55b068d63c461507b44baedb07
SHA1 dca82bb2ddbe78783dca48946005a5132dab2cf6
SHA512 784c4d46a474c865826b72b7642b2055160b09417781e6edd71f24c24b04ff15febec8088b6ee3247451635ee439cde4467cd9345c59974b3205fbc7a28dbf6f
SSDEEP 96:xHoi5nUTeqGqoFTdCQJeOTzSZPXAnpj39HnkIUIv03Bw8Hf2c:/5nIRYTdCQJeXPXQh9q3Bw8H3
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\prefs-1.js
Size 6KB
SHA256 7d3a16822bd6107e104ee9f7c61fc80f51547c352856a99df71e61adbfb9e3d4
MD5 0b6abff75683bb7c737846edf865f608
SHA1 f806db7a0b1ceb0f97e115d7e1d880402e9449cb
SHA512 4b0cb794b79302bc64b5889089e5164a6bf7a00383e5dcde4d5d7e9a3551ced740372bc5fa041b62e9542f8aa4c82c217a884c0228ef67cc286b03e7a01ee62c
SSDEEP 96:xHoi5nUTeqGqoFTdCQJeOTzS8PXAnpjB3HnkIUIv03Bw8Hf2d:/5nIRYTdCQJemPXO39q3Bw8HC
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\prefs.js
Size 6KB
SHA256 8750c0453759f03b85e83fdacd519a10ac86bd4195716a09fd44a89a91724563
MD5 1d104e20221554931fb3a633ae0dd66d
SHA1 dc79fc161af6f6551d89a26ad87b2af5b58ce99d
SHA512 a1fe77dae9e9a6b6058edc345647cb6d1ab4a40445245c098de0e102a2069bf8ee01c062fbc95b872359d35f2bcb0cd31608b21156e31c52e991aca28ccf181c
SSDEEP 96:xHoi5nUTeqGqoFTdCq2eOTzSNPXAnpjlHnkIUIv0CBw8Vf2I:/5nIRYTdCq2eHPXO9qCBw8VH
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\prefs.js
Size 6KB
SHA256 a5f6a647329df44c177406146e1a2a9b9381aa50678b42db4a4c8abe16d31292
MD5 376ea20ec402cf89657b17ab73a4e205
SHA1 716332b7e8a8936d708990b3eb02a495540e9444
SHA512 e3d11b4972b5e3a18364a60a3ddad88eef9a92f50e4c9fc7f0fbb1ed55f98c32fc549cfea56b3e8a556c81cf4310faf72d6a52e5ef2318bedd172a4d88f7a136
SSDEEP 96:xHoi5nUTeqGqoFTdCQJeOTzSJPXAnpjjmHnkIUIv03Bw8Hf2j:/5nIRYTdCQJeLPX79q3Bw8H4
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionCheckpoints.json
Size 288B
SHA256 3a0285c8233ef0324b269f7291094e19fd9b77259f9419861ad796f7e9c979f3
MD5 6b77a9f779399e95d1cee931a2c8f8ff
SHA1 826efd4feb0d50fcce5696111af7c811b81adcd9
SHA512 ef537c75fab8e86483ac03cc0d2feaf41575e35f54b95669a26bf6dfbf58021dc9a5bbe54d9537b55da3fbb0e0262adf6c5efd4394faaec81a31604533afec4f
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionCheckpoints.json.tmp
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionCheckpoints.json.tmp
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionCheckpoints.json.tmp
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionCheckpoints.json.tmp
Size 259B
SHA256 4f5d849bdf4a5eeeb5da8836589e064e31c8e94129d4e55b1c69a6f98fb9f9ea
MD5 700fe59d2eb10b8cd28525fcc46bc0cc
SHA1 339badf0e1eba5332bff317d7cf8a41d5860390d
SHA512 3fa1b3fd4277d5900140e013b1035cb4c72065afcc6b6a8595b43101cfe7d09e75554a877e4a01bb80b0d7a58cdcfe553c4a9ef308c5695c5e77cb0ea99bada4
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionCheckpoints.json.tmp
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 d1a98a30522d1bf882574df5ed2793bba5c4fdf0381788babea0846f6946745c
MD5 e08ef355498ae2c73e75f5a7e60eada5
SHA1 c98b5ab80782513f6e72d95ab070e1ed7626c576
SHA512 a0550e83ecd1cf632b4e54bf43744ee9f7c0a8dfcf9a043e018c00d4ca0bba606cfcaaa469b204e7c9dffec1f79b91e16cd4f1c94ff512c45d3dd25b7174e859
MD5 SHA1 SHA512

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionstore.jsonlz4
Size 905B
SHA256 9ea5eb12e072699c47ef2464925bdd659fd0d535a4ea527e9323dcbe96698d8c
MD5 3ce1d9504cd9d9ba8ac2e745d8781779
SHA1 d3767a5e0ca8f5e3bf53d6d8c44d05039f7ee6bb
SHA512 4c6622826be2341e8be7561445c0c8a1733793127bb0f2bf149a1f48ccc7db13548146e4b7d3e1c85a9d61ecaede1bec090fb20f2249cb79398464658a583a29
MD5 SHA1 SHA512

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionstore.jsonlz4
Size 882B
SHA256 00323ca085dbe0a5c81f326fbaf2f74d442b4ecf3509a224e524971606e0f385
MD5 53203dda36cf3f1c1e72217fc43b9edf
SHA1 0dba15fd2fd6033d66b7a3f8e22a8dcb334d7f6d
SHA512 ed45bf8b34fb2175aedf7016b6b52d5fb6d6491a13801bd45596c6692831f9c1ac5e68d9c53da29a99c2222c307bd145eea75aeffdacb37f73b6b69cacff6f3e
MD5 SHA1 SHA512

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionstore.jsonlz4
Size 925B
SHA256 2d62060946ffaec53c0b2fe9ecec9b53f2718279182b1a31efea25f9c9f93edb
MD5 04b7d6e9911d0218e942c7661d960d05
SHA1 214c3f0996f7fc186603383d8d0f40768359833e
SHA512 8687b00a7ef0bbf9b13344edb0ce66b012c097d65919de95bd64b92ba546f20bb356bdee7787cf5917da047aa8d21d3b7df3b120a297349239c0b6452a8d150f
MD5 SHA1 SHA512

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionstore.jsonlz4
Size 926B
SHA256 bd4f906dc49e4b4efc9d3a79aeff31bd89ec6bba033caafcf802fc56c6786c22
MD5 0c419ebd59b4d01fa21c07578de9d767
SHA1 4d5bcb96c1a73b8db0317a577765a7efb507f717
SHA512 42c4c7ad4cc985ff7603bf0d4d44983aa94b8f84c7e92c267ea4c8b30b5b44cfcb9698f34790c5b082973bfe41351db018641b1dc41e395e012a3ee449f2a13b
MD5 SHA1 SHA512

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 184KB
SHA256 e4aa7f719abd800ab379a34ddc9e3693c81a3c1697c138fe28ce82ff3e3a065c
MD5 d7de83d556f5be1fabc10fc945805a20
SHA1 6da1838d22d9c980167b61c74080de913aa5a8af
SHA512 b072922ec7441344a0c39f612b594613420180bf0d6e1fba4824f19d075b467c1ba2eb0ce506979ab9e35907f37eb05b5d437c6c87ad9fa6c6afd6ba28050dfc
SSDEEP 3072:2GcHzPRuFPF3y3O6g39636uacM1eHtxS97F:2GcHzPR093y3O636uacM1eHy7
MD5 SHA1 SHA512 SSDEEP

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\xulstore.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

xulstore.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\xulstore.json.tmp
Size 120B
SHA256 1c2c5d5211674c3c8473e0589085499471399e53e9a85d7dd3b075fef6cbb6be
MD5 05e1ddb4298be4c948c3ae839859c3e9
SHA1 ea9195602eeed8d06644026809e07b3ad29335e5
SHA512 3177b48cd0c877821419d7e5eb247a4c899bc37258994f22257ceaafefb316e6f5959faae02e380e432d7752f0218d45d56d6878c1e751d201d9fdb3ff98612e
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 144KB
SHA256 fbbaef754d6dafaaf32ae5e7937135fe81075806e5e2b0db1d6f9441a1cd8633
MD5 4016477fd044882c78f3c1a47d7322e1
SHA1 6c75ffa25ef2d1d6a658ff415b2e47964032fc6a
SHA512 17706a8238817e135ffe378e60e1e52964a00aeee6c6b9bc7f288a0390ae97d958f053cf693a4d829a35acbe32e3ab9599c13150a3155c671490736e88d19df1
SSDEEP 3072:xokEUyr9ql5n3yU6S4M5Er8zwIMsoE0WNOBKHAHp+FBZ+:er9ql53y04QEwzh0FaAHQLZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

desktop.ini.ozs9

Path C:\Users\Admin\Contacts\desktop.ini.ozs9
Size 756B
SHA256 a93d7b5bc1cb2a84ef225d9938414bb2da56572d01db5b46ed1e176f39df67f7
MD5 d707d18a882e4ac222523178012257d6
SHA1 57378315d772493c9f2538e36955a24625ff55b4
SHA512 ed4b37e2409380214ab26b7d954f2a085aff53c72807e4166a7bd520f58afee5e4058176136dfa2517d5c791835c875f2bb12b86e53dc552e90febbb58f0762e
MD5 SHA1 SHA512

Submit Download

ApproveResume.xlsx.ky29

Path C:\Users\Admin\Desktop\ApproveResume.xlsx.ky29
Size 780KB
SHA256 8128bb8a7931eff19be4e1d947502ba9d78a66799665b408344ff1d9307f0424
MD5 ef931bdd5323936601bbb6bd35854c2c
SHA1 a978f8462a7a36a4aa3267f6c479a7ba5febb1ef
SHA512 05300cccb2aba824de2c3c559e7ad2b0c7b1d34b2a75f03c84bd5e85d710898a6514bb216a08084154cb3a27cefded52b0c928dacc9808235cd241fac7587cbf
SSDEEP 24576:38d9gRKk7bGPGXtW2gN1JK66/TIjy9pzp:3dAk7bA6U3Jb6/Kopzp
MD5 SHA1 SHA512 SSDEEP

Submit Download

ClearFormat.bmp.klbn

Path C:\Users\Admin\Desktop\ClearFormat.bmp.klbn
Size 1.5MB
SHA256 cc11a5145fb456a31de5c7b8348da4cf87d3ac99d586a9d4b35043a74f1b26bc
MD5 41f10bc1b338a1fd2abc41cf7f65307f
SHA1 9d2dca75f6ee6c48654b734e5b37ba0d34a3560a
SHA512 4ce9025e5190034c370ba0b8ca45e29f5169fbbb85bbef4615836c2e8074d08c78aa555e16e52871f295552baf3068dcce20979ddfa1dc72422e6e805f3a3ffc
SSDEEP 24576:5Im20RViUG0XcmKxvcQshtxcECQc9wwabPFmT2sTwfGWTPM9REMDfJxyUD:5qsBq53s/x1c9wnbPA/0bYREkD
MD5 SHA1 SHA512 SSDEEP

Submit Download

ClearUndo.cab.2de7

Path C:\Users\Admin\Desktop\ClearUndo.cab.2de7
Size 443KB
SHA256 acf06e981a9e124de2fa1b2e3395dcb8264a9d0b08d5c18d11419904439c0a23
MD5 1b77403e82992af913d032d626181813
SHA1 5aac02d7c6a472b7dfd8fbcb0f349e8bdb16f263
SHA512 4c33d9f78dbba40cfc09664adb1d9111784c8c64cf69eeedf235aef3bb811254de9535c65f26c65812bf37a862898844237e0123c446986aba753557ec7bda28
SSDEEP 12288:0f7+bo80KwV8wLYrxAoM+7xFxp4D4vBxGcZ:0jBUwyjyoM+5p4Us2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Edge.lnk.dfgj

Path C:\Users\Admin\Desktop\Microsoft Edge.lnk.dfgj
Size 3KB
SHA256 b99d6f4136580b45d128a6a4380b364afc7d58ed73ad379dce2826499fe31de9
MD5 48e6f243689f8b09ba8bfbdc5f00b87b
SHA1 31653cecf4de38e3a8a96d6bfbb8dbf274717548
SHA512 9a26eeb9ef5161c40394fbe1eacf42eb21750f9b28affecb6751be2a20b7b4fc834ae282843dceda64bd8cc2d9754de8a3bd969f3f33a26fbb7de3d016f0cda6
MD5 SHA1 SHA512

Submit Download

ReceiveDisconnect.xlsb.6wwe

Path C:\Users\Admin\Desktop\ReceiveDisconnect.xlsb.6wwe
Size 504KB
SHA256 db4cd001be07670ce67bcf9ac2458b592d8462306493b683c3218455cf231cc7
MD5 70943823c97a000f07ef91feba8ff585
SHA1 14d685e898e36d3d490903967a0e9c57fe551386
SHA512 5ebdd66d692ce7ef202d1ccb42fa66185855fd55df5d37d1f4994f4bce35f81ec3554770a9416be332681ded56e3074ea0664e6c40b57132eb3e1aa7575663e3
SSDEEP 12288:ytpsyIUsHJRSPtrX05vFoiwK+5HhkqFdSzW7VUlwGjn8:ytpswOmrko9V5Hh3Fj7VUlg
MD5 SHA1 SHA512 SSDEEP

Submit Download

RepairCheckpoint.asp.9k1t

Path C:\Users\Admin\Desktop\RepairCheckpoint.asp.9k1t
Size 1.1MB
SHA256 9c0aa2b6134b8cedd8b766df91d02044aeacad43e7f610309551765a7f8e34f0
MD5 a5dbd5103dc83bcf5be302ffb613ae7a
SHA1 96c2a35f44179713440fe97285323ec4781fac8b
SHA512 bb77c1f6d0f7223bdd288182c7ef31c87baf0a4eab6fbf8b6a49ed9785dbe4eb3aab7daf505440ff95be8e9c8a83990cda80d1687d9f2211e9b22e00e9a5bf42
SSDEEP 12288:CqFSG9LNSQIZVDn3x0YGsmT89GCQ9trQldhX0ADFvACFhzRYZqZi2M0qfk4+DnN3:CYS+Unjh06eLCWtG+kvP5jivp2NSiz
MD5 SHA1 SHA512 SSDEEP

Submit Download

RepairUpdate.avi.uffc

Path C:\Users\Admin\Desktop\RepairUpdate.avi.uffc
Size 474KB
SHA256 3bc2325834b5f6792f38e9d95331d9598fb80ea766eacb4603402ee366838ed4
MD5 886c5fc23b378b9c8f984a422563eb52
SHA1 1b64c1285711e3853897477fb20a805cdd2f12ce
SHA512 d93d34a6b40a02f0ac6af9a4ea90c38e343fecb6e5a8f1ec4b50785a6466aeb0b844c9d0375ee91fde90654f2ef65715f54f17f4c85f40943596147e2ed76de6
SSDEEP 12288:queb7tDJQ8vAnnQELEhdGEVax4ilXnDTOVh/VMiyJiCP4:7u7RJQ8v2QSEuEsGi1nYl0ix
MD5 SHA1 SHA512 SSDEEP

Submit Download

RequestMeasure.cab.lk18

Path C:\Users\Admin\Desktop\RequestMeasure.cab.lk18
Size 994KB
SHA256 449eb22197f875f8eee6965753fd1ac2a5e7f7f42ec5b0cd34ddcb7b09c5065b
MD5 1bfcae02aa2c949da9d40e0912c65b2f
SHA1 4d4e05ab2243b3d1f5dab3eafccd6d213eab75f1
SHA512 195af343d2827a4b5a674c93809b074c6db44c5b7888c030d17b2e7c8d9e5b03f33d9a8b56c65947b27aa0c609e8341c436af00845fc3d505e43d9b2698ef2d3
SSDEEP 24576:PL3B56hAg+77Zn6SsnnMC89zm+TfGHHsci4j8BfC98:zqhn+vZmehcxA68
MD5 SHA1 SHA512 SSDEEP

Submit Download

SelectUnlock.wma.ddbl

Path C:\Users\Admin\Desktop\SelectUnlock.wma.ddbl
Size 657KB
SHA256 c38447cfd86201fa001f6189c2ddb90d8069437e6daeaf69c0dc451d5b95c3a9
MD5 0de3cb5d657ac67896db81b09f5de758
SHA1 2f33a186b7f73170bb524b513c0cf842309956ac
SHA512 79f1c4d6266d7e352adab94905840b3b13e6ce43e245ae16f4cd1da2333f350458558290ab53e7416eaf3b3ebdf976e2dfbc69160469ebb54139b79a1050ae14
SSDEEP 12288:pLirZzKLLf+WQz5mNLcb0bnTUN8vfyU43E+Bq2OeoIWKnX7MRmCjdyAuNsetEg:pLgZzKLb+1z8N3DTUNw6U40+J2O
MD5 SHA1 SHA512 SSDEEP

Submit Download

SendRead.php.808l

Path C:\Users\Admin\Desktop\SendRead.php.808l
Size 535KB
SHA256 71faf560461e048c370065413df5c6275f5d7788a9a0d68c117a6098e5ec4933
MD5 4a6adb057307804970c06e893c0d64e4
SHA1 008b24552f3385f2e8182a97c4f2d981361dd27d
SHA512 e68bf940b59839a1d48bb2b7abc1a10143b2565ed0f67157ea3503118d158a4927408334f82d50709e7abc20d300d9ac46ee79f538e9f6ad01e710497f73327c
SSDEEP 12288:ywlySVoCErbZgZ/OJPLqwAJaFVzoRdsm/3K17k0Errx+FB1:uNJZOOQBQ/e3/3n0Ert8B1
MD5 SHA1 SHA512 SSDEEP

Submit Download

SkipWrite.mhtml.560j

Path C:\Users\Admin\Desktop\SkipWrite.mhtml.560j
Size 566KB
SHA256 244c2364a9fe1dee17dd81274ac149de3ca308632320014be1474860ee59cba2
MD5 1941b48aaa9d2e8f4bf6f4fd390e990f
SHA1 b470c27bc9e7e03cd901bac85d102bcc341bd8d9
SHA512 45907fc1526b7a1e042a68610e3408f33ddebf2b31d462f6a9fa2523620e0b58d356c670ab228433142367bb6843d9dd1fbc9e6585d92185473e48a8616ae446
SSDEEP 12288:4lhjlEVBfiw9ifHSZikUo8YlQBm1LV2/0O6+kh7ibRTv0+ck1zkil:cjlOnao8YlQA1LV2u5ibRTs9k1zkil
MD5 SHA1 SHA512 SSDEEP

Submit Download

SyncGet.docx.jnfj

Path C:\Users\Admin\Desktop\SyncGet.docx.jnfj
Size 470KB
SHA256 603bdd4c781c9c40a55e2b40083555ec09d14fcaf13b64c8a1633c09db32f8d9
MD5 167d100b061b0c0cb6f8d41ab74553d8
SHA1 40e515ebe0a55851660dd64254f9045ebe1e14b2
SHA512 313e75f7bbb3356317df230d0e63a68d029a168ac6f384297894c8df702f0547ac3e2a6ddaca69ff368a87304c4ae51a995b2c28a5ea5f0c9f5bca24f2d2deda
SSDEEP 12288:pYuwMmX9RwxKqElw8OgQ8nIVFQRfHlIcc:pYTvzqElw8OgQ8nCyfHOv
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnprotectResolve.ppsm.gzmx

Path C:\Users\Admin\Desktop\UnprotectResolve.ppsm.gzmx
Size 607KB
SHA256 df3cdf0eae1c2d9eca2bd90a41dbcf71d814a658cc0c69ecef80f62ec87a0598
MD5 ccf17ae2b5861a2b8c8538164f1af78e
SHA1 88c023d02ba719e6391247192dbd087e7d00a793
SHA512 435ece7fbbbe41689fdbee6912b4a9e195b0669f7fe14566fcd00be2a0d0604493c99f9ddc7921796dfce1a0e5fa7d26eaeee39d5e133bb41e3fe1a528d048ad
SSDEEP 12288:e/a71JpeM+b9lclXXg6lD6gMSqH/+0imOlKcNbHmiWKjJJ:e/IJp+bKXYf1G6YKSlJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

desktop.ini.vfyw

Path C:\Users\Admin\Desktop\desktop.ini.vfyw
Size 584B
SHA256 bf0665a049f5961a29fcfdca3d8f1272651e9de85cc72ce49ab496172a18a3b1
MD5 6c8b991dd0f7325e34c61d87b3e01265
SHA1 4fda34ab6a6e232f1d0fbe6947d2f99fa5527d69
SHA512 a8becd9bb49803f7b366164caad2f73caa55733990a409f9f27a8c5a1f9a30c39d9ddc9b93264a73e0eeca31c8a4d5453a5c4e7d84e77b1205a4d58500256448
MD5 SHA1 SHA512

Submit Download

Are.docx.e4lf

Path C:\Users\Admin\Documents\Are.docx.e4lf
Size 15KB
SHA256 5d0492adf9c1b6299ff1a86fb68d560a494e032a70d2670f11a8c9a4f94ba853
MD5 d212a2f4cf477f7e544416157f825dab
SHA1 dc967b69d3d28083a87cdd8ac5d612a8c6f06113
SHA512 150ae323fcd0566872bc437cd518ecb5ac170dadd7abe1f1b3c83ccc81a65c11cc5ef97c400eeb78e135edbce5a7ff64e8c44920d6a20e2b332759c6786d32cc
SSDEEP 384:O3Ieqj4OIEEqtm/74QDdZ+Cft1p7EhdU/GqNI:OYl8Ek74QSCfDpdW
MD5 SHA1 SHA512 SSDEEP

Submit Download

ConvertStop.xml.ykjd

Path C:\Users\Admin\Documents\ConvertStop.xml.ykjd
Size 1.0MB
SHA256 dd421481c564fca72869ad509af65fae404fc6eb5acd7cc3d7a9ad56ee237396
MD5 69d070a4ee87dc9e2ba3631e96116e4b
SHA1 a668f775cb547c55893e2c82d56d35d5082a46ce
SHA512 1b6f0d31361e10f72a8b45a24e35d57f21acfdbf36a173fddd05fae8a92cd0693fb8cf504d202c24bfdefed384ee8df782c4048b3efeb4d436c33154e1abfa79
SSDEEP 24576:F2AH2aTbdH7uHhgdKaqLgqomVo5K2FjA0uz3v2:FZTAgG7v2
MD5 SHA1 SHA512 SSDEEP

Submit Download

EnableOpen.odp.956v

Path C:\Users\Admin\Documents\EnableOpen.odp.956v
Size 1.4MB
SHA256 8a67568f04142d43272c8da7d48d50d7710190923588169a717f17a56bc98bbe
MD5 b21eefe79dd1b532b59bb263b35762b9
SHA1 fc61a0d93630cba1e146bfb77dc4043693a178c5
SHA512 3971b9c48fa379637503c8e902fa8c5ba772835724c4c0724dc5f504219b5feecc55a719fe21f2c5b22e5818d5c917f50abd2abf46f60e6cb055aa54b0650e8d
SSDEEP 24576:gN0desguMaw/YhGoTUU+P6F3t9rnTv93n5XOFUgONLL+:gNEB/hwU+Po7XZ7Ne
MD5 SHA1 SHA512 SSDEEP

Submit Download

Files.docx.7d7p

Path C:\Users\Admin\Documents\Files.docx.7d7p
Size 15KB
SHA256 ea7a17a847be8531ec50c45c4862cfa9573d25ac2bd61a322216d1256f33fef5
MD5 b36592aa6838e567993d4854efbf3801
SHA1 566c3c289c06e2a275e645e9fe70aac68e3c3244
SHA512 e7ddb9f0ee1388e8116ffc5918eb1f587f95908ff7fec23b533ab10aa7e1853d395747fbeced0b650cafd60d50a33fef05384cea02ecc4b3e09d584826cdfa6d
SSDEEP 384:U76FpPrwWiINLJ79de5YpMgSuMyC4YiIWnif/:RFpBF7be5YNCurniX
MD5 SHA1 SHA512 SSDEEP

Submit Download

HideGet.xml.db1q

Path C:\Users\Admin\Documents\HideGet.xml.db1q
Size 1.3MB
SHA256 6021abbf1b1d12d4d3e0f59f8a602ebf3f63b056433a0abff19b60900c6e4bd8
MD5 d0ec44002b9a43e55773cd7e8d0f1875
SHA1 dd6997d96e8af225fb0919ac5f01c25c59d64d3a
SHA512 57cc3adadc500fb3e4d4b492f70d2ef776f1b034da2f79e4cb4c63a4ed77dfaf2466ce3bb130197d9c3678389896629a40ee0045e1c3cd72a75691fa563806d1
SSDEEP 24576:Kep+mHanUZz2W9Qar2KNGco7b5ftFGGyi/4XEJAWjh0Uit9j0oARJH9:ymHanUsnKpoP5vf/AEJv0/WX9
MD5 SHA1 SHA512 SSDEEP

Submit Download

MeasureTrace.docm.30ug

Path C:\Users\Admin\Documents\MeasureTrace.docm.30ug
Size 1.2MB
SHA256 0d5db7d4536dd21d8dc9efe5da5e2a02820eaa75fbb24ba4b872298422c86c0f
MD5 08fe70f40cda5b510a59203a12958e6d
SHA1 28675754f48c87e7f786d936c588892069906ef1
SHA512 1b25f4029689695340924a84a271650d20a917f78d23d66f8d93f69b388b7e43a43b572b5e396ad48fe263c0578fd2f4223f12f20b9f3c9c61f4bbc7d2211275
SSDEEP 24576:QmjKIjBuPieyrLgfELb/hCZyKpXpLCrmmkMZPQBjUI98wEETeFy4NzhEQ2V5pDCg:LeqU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Open Notebook.onetoc2.wbyp

Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.wbyp
Size 8KB
SHA256 a808efe580ef09a13daa3316f0086448e3cc50cc96a6a26c49c9318ce150c28e
MD5 37300b2c50c1bbebc066b91c500f70b0
SHA1 3936af2c27f8b122edd19b29e2bd56a7069dfe62
SHA512 60185fe6cf44a142fb7128593e59eca3cdd1a50931c20e4f291eff83bd80b31e7c73a84a1c56a45711b3bff16620dcb438a285f55186d3d8a7ad55dbd5c14eac
SSDEEP 192:2fWIccVvOtiMPN3lajMnNivKi/6hfOJHnvVy3EcHmkB2u4:2uIcZtisNV0MnNcL/6hAnvE0cMu4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opened.docx.0efa

Path C:\Users\Admin\Documents\Opened.docx.0efa
Size 11KB
SHA256 272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6
MD5 bfbc1a403197ac8cfc95638c2da2cf0e
SHA1 634658f4dd9747e87fa540f5ba47e218acfc8af2
SHA512 b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1
SSDEEP 192:CtNCKZkVA03S7Ok0DaRmzRTJYbcBVm+T5TXX6iPBkeawLWdxd7oKJfW:aNrOA0C78EqdYbcBf6akwLWdxdEAfW
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReadTest.ppsm.hwxh

Path C:\Users\Admin\Documents\ReadTest.ppsm.hwxh
Size 626KB
SHA256 4085b89e16f91d6963dfcac5bc698d15503bc76e3d1e4d56e324e9ee7d82b303
MD5 f2ff6415d2301a422e96ab18d3489ccd
SHA1 6a98e44b1bf22929b78c0d38c8e6dbe13b87c749
SHA512 da0dcb1f500dc2e3dc606df2889ddaf9ee6281ff934db9978d789e44cae2919413cda6a997e903e3f11285a5ca89bb7c54f5b8b6cb87f396bb3ecb47aa126f0d
SSDEEP 12288:F9KLsc5YqNY0VGEIi53bxwUw8AAlkJFPmFeUpQ8vNL5bWN:FiZYqNuE7txJ5APTm3+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReceiveReset.potx.mwky

Path C:\Users\Admin\Documents\ReceiveReset.potx.mwky
Size 1.3MB
SHA256 4a68624cd2aa57db3a9696ee6c9cefc3c1ebda8cc0df3d31e03e4ea59f0bd690
MD5 feaee5a138640bdde0751dda1cbadc20
SHA1 03117f490f8ea166e7a2648ded384544d454dac4
SHA512 da8061427f65290dc90032303b4b9c09d5f7552aa9ee9ddf37b1b1f5cde159b96e75ee30592bdebedc4a393e84737dab4fc52aa3283b8277cac24af344f74382
SSDEEP 24576:ixwcC9Fj4y8ZfyvR1Yk9VnpId9oHcn7KLSobSZ2fLFoJx6MwraqF:ixwcC378ZavAk/iPoH8ueAfLFza8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Recently.docx.kbu1

Path C:\Users\Admin\Documents\Recently.docx.kbu1
Size 15KB
SHA256 b279652b60352e8d3f80602aba20bce83bde72e9df877bc02b3ef9f77316fc75
MD5 bd254678ff8438c6d346d74c090f5862
SHA1 285688b2b2cd1740db0fd994a4691a8713896924
SHA512 129d21379bf4a8d4b40938d5ea9e8c313f001c7a15267d790f078268fc7b2489f400cbe7b990f03b2125ced41e1f4441a0496c46bf6b13d329025d257cb0e199
SSDEEP 384:KBW2kZjPX07Z15rRbffEBnZSts3fdaH0e27vvEcS:bBZDk7Ztb3EBEts3f0HZ2zvA
MD5 SHA1 SHA512 SSDEEP

Submit Download

RepairPop.docx.2kbi

Path C:\Users\Admin\Documents\RepairPop.docx.2kbi
Size 1.8MB
SHA256 108ad1e543115cc13783b53d7fc43cbf1eacb4ca165e7ace0899f63cf560b0b0
MD5 f694065f48de45674f4fbfecbdf1ac33
SHA1 eba6ff470c5a2c707d0a719504e396ec92e24430
SHA512 bfbe8d04d2b86d9eb8f00913874c387ed794dd3b8497706936d55720dfb20fe4c59dd6767b75df021dc3c3ab85674f660e46096ff7783a29bc2324e699f3dfd6
SSDEEP 24576:4/PQ1C2NcBrYDU92kNuyTe+lTqcsSi1c2QkH87BVJqi2SniBw7tQ72/OxBSwRaX2:qP4O3lx6c0cdRiJy/6SbtxGJVpv0I
MD5 SHA1 SHA512 SSDEEP

Submit Download

ResizeSuspend.xlsm.t9w3

Path C:\Users\Admin\Documents\ResizeSuspend.xlsm.t9w3
Size 1.1MB
SHA256 795427fcbe3e7c0c805947192e818eca5bfc6a4d85f89a1efca38d0a1a9c9b27
MD5 82c63ad05daa12a4c8a4bcd8a2dadba8
SHA1 76d2c83df762ee8b70ae6d1bd0537752007c2e5f
SHA512 4044641e6d0ed908707bea14358c8386bff7a2ec81d915aac82ee13adb62c8a03ab4148816383e9f5670ca726dc6c2e67ce18cc54654dc76802389f85d555ec1
SSDEEP 24576:AuaARNdc4m0t6wCbUDsO3ha2AAffwX7uWPpMYP4AknyqEM:Jf40JLPWP6hlt
MD5 SHA1 SHA512 SSDEEP

Submit Download

RestartMount.pptx.9ekr

Path C:\Users\Admin\Documents\RestartMount.pptx.9ekr
Size 1.5MB
SHA256 70c6406b64114d5dde0bef5589ced4783b851a2c8b4bd79275cfe68b6db70cc3
MD5 68e41057dc39cba9fa83f7580c9f9be5
SHA1 fd12e535ad47131a93f69927e55ba49831916433
SHA512 9b49c23118a43504c1cf7fbdfbf101073f456a88992ef7916f7b32487023338da16161155c28f8ab36d7edaf3eed1e1e280f1f0e995cfbb0dc5a4e3e79de0088
SSDEEP 24576:Tiq4jK58MCUTGzKJiaCAsz1zN1ZYenFWlo2+QoaNUV9gEH6LSSufg899M3:0UzWr5lbURNQFHS2g
MD5 SHA1 SHA512 SSDEEP

Submit Download

SyncDismount.xlsm.sj4m

Path C:\Users\Admin\Documents\SyncDismount.xlsm.sj4m
Size 940KB
SHA256 8745a0eaac1912eba2f46ec90bc5e79b21895030de0d3faa15490f20f4c2c74e
MD5 1c7b99c6324899779e841acdf3afa25f
SHA1 ba2e3aefaa33ae7f8aa8de1708b5e6ecab1c286a
SHA512 9772af2b823e170477e082596e3eeabccc05afc79a63a875e230ff7a340c57ad877085cc32ac821bb883afd1f53158a20bec6706a335e668e1293621a321700b
SSDEEP 24576:px+HRitxuCYEEGBS+sPHXf19RjZ546v2QClKclznf:pQyoV3tN26eRf
MD5 SHA1 SHA512 SSDEEP

Submit Download

These.docx.u3xg

Path C:\Users\Admin\Documents\These.docx.u3xg
Size 15KB
SHA256 91b4a414fcc56f54111af640c03021beb8fbc9508daaa14beaae9ee64a77c6bc
MD5 03dbcbdd2db5356fe89b6ee9c4349659
SHA1 b2302378aaabdd339cdc6a2c3567e835a0310453
SHA512 cf0ad1b4a7384fcb515f63c6d052109a54590edf2d72d05c21eb0998914a9af83105d64abc1ca06ed94b2f212599e3ea59b1f225e18cd9f4f10438a996c20a86
SSDEEP 384:tOiTIX1Fuxaf6q52Y8rkgK+8xikG5bkMmKudLIy:NTIF6af6okrdKviL5bt+B
MD5 SHA1 SHA512 SSDEEP

Submit Download

desktop.ini.urjh

Path C:\Users\Admin\Documents\desktop.ini.urjh
Size 756B
SHA256 1f208921dab46adb07858d42a8c28dd4e46edb652b2324de31d37aaac60fcfc3
MD5 59edd1f66619df86f30a656b598754c8
SHA1 9850cdf4001c97be98985ceefc728e7658738f3f
SHA512 d082867af83c7794e6e7365a22211bcbbd89c89010b56ba2c5505dcbf39d3f23247f456aae9132fdb277d71117833f2dfe519305ec2c2093f60453e25f52895e
MD5 SHA1 SHA512

Submit Download

hahaha.txt

Path C:\Users\Admin\Documents\hahaha.txt
Size 63B
SHA256 7d6a89c0a71eb6607c0f9226cbdbc241a154a49e463e599ea8ff126c161ad6af
MD5 45dfa78907ccd5154a672941b7fd7805
SHA1 c96e039c5d260e3fc61d65da6718d3a832a182fd
SHA512 45b88dc885c14920f7e309566475c1c0d35b43dfade79ae951d41b422a4cba511f36b6305f0fde21af780399929f529661e1e9f1bcf0190e2b73472ed9950f2b
MD5 SHA1 SHA512

Submit Download

ConvertToOpen.dwg.pw50

Path C:\Users\Admin\Downloads\ConvertToOpen.dwg.pw50
Size 519KB
SHA256 b7c7671b761a0eb2199daa3747acef5697a8d9a8272eebd38b93ada8955eb9c6
MD5 e216701679703adef0229dfa0c146307
SHA1 53b6b6b9ff066053d8b22d62addcc892836355d0
SHA512 3b24dab4fe25132a82b321e515a604194ad78eff32e7620487e73dfc42ceca638233ebb7bdd50a6017a18d58ded729fbdadf6e727ec8c7f284a2493de8e4956a
SSDEEP 12288:8ZKHZecqQHwkjPhuhs2VD9djO9s6OmHaGOVokJ6AEzbwoqDhiI:8ZKHIcqQQ9s2LdjO7Hal9ef2
MD5 SHA1 SHA512 SSDEEP

Submit Download

InitializeBackup.cab.b8tt

Path C:\Users\Admin\Downloads\InitializeBackup.cab.b8tt
Size 540KB
SHA256 a213a36f700c09da169e3a91f1df269a69990e8e43848f2e49f9486861ada82c
MD5 d400cb193e4f4feb7aa22ca33a525d56
SHA1 cb0100ba4434d3d5ab342acc5c2adcbec0de2205
SHA512 319d5ff0567ca6818016e5484317d78150cdc94176fe4a5d582923a3ceeaa5500cb7654ae23501d9855ed0e67b36298720e5c45fb9e6b6e62ec964923ac95468
SSDEEP 12288:Qw9Tex7tNP2mKLj7Wq9MdmKX+PBt5qUhtKyNm9kzvz:T96bNP2msTMdmbLhtK1wvz
MD5 SHA1 SHA512 SSDEEP

Submit Download

OutConvertFrom.iso.zmw1

Path C:\Users\Admin\Downloads\OutConvertFrom.iso.zmw1
Size 879KB
SHA256 3945c2435d293e23130fb0a160795b214fa7b6e174d0b792828ca1ffd7b86fde
MD5 5818ef96f64a825548d6acd8fb72054d
SHA1 8615b8d80dabcdf4fc8879e876d18eaeac0db293
SHA512 5a85978e206c1929e233a02a82654173423e96d761f4a013c9f6a85744993381bba805d127a57155c42905d933d836fbabaa4850f1638d2c10ea92fe3e333e20
SSDEEP 24576:e6uYFUzvp0TET46qVlmBRVH72LF6CyFDeYX9qlhjR:Rozp0TykCO2YBR
MD5 SHA1 SHA512 SSDEEP

Submit Download

PopMeasure.css.rlbd

Path C:\Users\Admin\Downloads\PopMeasure.css.rlbd
Size 688KB
SHA256 94bd0bd30432a25d7a223141e758cc62505db90e0a9298a08e858b0193ec8fbd
MD5 dd9587969133be46a66b39f3766c4f19
SHA1 2c8925d43e4ae6870295cf3f3d16ad88c9a046d1
SHA512 f15b67e74ff7a45b56c0ee94eb852dc5d56b624d518e602e0986128cb207d4176e47d325211fe2ce320ac41cdee808d22ffb493db0f7d95e5538a66be0e64b8d
SSDEEP 12288:sGCjCyo5v67L00AJho6+4ANlM1GUFRPtnFsn/ZNOh7zCXcEaLf:LCjwvOJA2MMaPtia6XNab
MD5 SHA1 SHA512 SSDEEP

Submit Download

SkipDisconnect.3g2.mgzd

Path C:\Users\Admin\Downloads\SkipDisconnect.3g2.mgzd
Size 794KB
SHA256 bb7c9c140694f1b4fffc8db366471537ba769a91660048bc07d0f829d2fbf08b
MD5 b2b68f4233d64b5304c24b005e6ba71a
SHA1 20c7e05e33d7b02cf4ec26506727c209c7790b9d
SHA512 a278cf6bb4a78fb528993c8d2ce3c6773428bab565dac1b7fdc7e5845125f2588f37560c2793d86e757f8cb466582d6a84b9a36ff86fedc6411fa1e8cf52c0fb
SSDEEP 12288:4X5GBEMkmzsK12ngDH1udm0c6BYka1mfsEuw10x/bY2KB0CX5v7rVcEL4PB/hvWa:4QGDmAyHwdLKvmHLybY2DkZsxHX
MD5 SHA1 SHA512 SSDEEP

Submit Download

SplitStart.mp3.28dr

Path C:\Users\Admin\Downloads\SplitStart.mp3.28dr
Size 603KB
SHA256 791b3ee0a9fdf82d7f36733758dccb3d6afbdb838e7f89b970d110889511d05b
MD5 cdc0cd69068b980617ddc7a5cd373d98
SHA1 e455f7e66652ddfd20bc712807d5bf9a69cffa56
SHA512 77a9a4ad5d1db9c959f0d36cfdffb27266ffa7e9dd22499e6e0d5ddad9940ae2b9abeffaebaf57e864a5c0ef3d4c3e64570fbcffc159ae7cddb8395bccd60843
SSDEEP 12288:eKQ43z7jbxWV5TVZgC0/pYqwDHdzPQ6ouGaVE5GP:LQ43HxypIYddzPx3V5P
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartDisconnect.mht.one1

Path C:\Users\Admin\Downloads\StartDisconnect.mht.one1
Size 722KB
SHA256 adc2d8996ba3bd0cd928703c849d0e052baa02c820b731cf5fbb9cd63241b097
MD5 a27aa46b965e2700a884f6005dc4b60f
SHA1 1e048b61ec496015f450f4882534fbe4d62ce27d
SHA512 e86333ae0b68bb721a9ab8d0f71d063147bc4778872665901141c92875a2648208b5771a49f40e90a737a009cc95e6e20849991db9dc32ca25c52a2e1828e382
SSDEEP 12288:4tA//jAVzOFuQimjtOkqorLUyN9VU0Ea7Cg1TZpFUGDtdV3in9DkacrD4wZ:4u/aTQimRjHroqNC0XFUGDjhz7D4wZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartRedo.bmp.ww27

Path C:\Users\Admin\Downloads\StartRedo.bmp.ww27
Size 730KB
SHA256 f3b724d7c605053d501d4d80e00368048fbdf87d12d8c3075d7d594c4d5a1708
MD5 27761901278c084541c39f2ab7edebdb
SHA1 2e026e258c6d50fdbe8da3d042951d208812868f
SHA512 6e48830a93c73e83abcb760553d25b0e85d433806b11c55f9d57ab1e72c13dc9edf3aa786797b081f0dccbeebce6f7ff2cf2e92417b4bf1cbc12c4b62d9e5113
SSDEEP 12288:SN3WUMBJV5pgouSJZsrvAhFie2TQJLtj7jH1RlTy4XLWfCD+AFtjwAt:SA9JfqbSJZ+ep991DTBbWcF
MD5 SHA1 SHA512 SSDEEP

Submit Download

SwitchExit.lnk.e5gh

Path C:\Users\Admin\Downloads\SwitchExit.lnk.e5gh
Size 815KB
SHA256 218fbe16bf9151d180571aa5f17d23a060aeb280c273a231625a71049e60ad81
MD5 f40911eb84ed49159a110b4f97e62df9
SHA1 02c75314038aebad6cfe1209228d0b1d61c628aa
SHA512 91b7855bd17016666a14a93ca52e63c9aa7ae00c085892a5033966a2ab588c5cb3d660278700b3f49ad4209f77a07ca209fbd5e99cba1659e81b186403880ec3
SSDEEP 24576:htx/rPppbrzroDCO20eLCP2UdtJrAxOWUJ17wKC0FvXNqj:htJrHzLJC+UbWU3wKCINe
MD5 SHA1 SHA512 SSDEEP

Submit Download

UndoEdit.txt.wgpu

Path C:\Users\Admin\Downloads\UndoEdit.txt.wgpu
Size 497KB
SHA256 b943b2644efbe3b7d80abc35a1d518a48337424e6ee6e2ca7e5e137206b38a47
MD5 d8fb0c2f7350acf59bdd59d19c014b5f
SHA1 cfcb920a3e779ffb421c0096a74c0a6c64e9a268
SHA512 2fb68df6919649692402c1b3cadddc326f6acdfd87004bb0dcd0cb493eda77d3beb778b5033541ba42f4250da6d05104879b2740bde23a636f3eac1b8640628f
SSDEEP 12288:HlsgbTDIZcG6KGTq8XMU5aagTMm9xEgeIxZ:H9bnsafq8X9aagTt91eIxZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

UndoShow.raw.zlxi

Path C:\Users\Admin\Downloads\UndoShow.raw.zlxi
Size 921KB
SHA256 f67364928b26a515a8f5150a33ec25dbc0933350f9d036fc8a5bcba62598e674
MD5 5d8991939a05bcdd97fe32201f34c5e9
SHA1 2eaf2b20ba328ab194a3f1f22977a82d79e30d82
SHA512 3a67d449668475c3f4449b63a621df4c76d58b79f53cb5dcab252654d61cb69d9f58451ac043bbfa0cbd62c8aae90e134b916f4efbd8a04a00b23dd089a9c238
SSDEEP 24576:OHR8yjczpz0xSpDIDD0yCZxto4Q92fO7RC3pR:JpaN0Dxt9+2GcR
MD5 SHA1 SHA512 SSDEEP

Submit Download

UninstallJoin.zip.g5yk

Path C:\Users\Admin\Downloads\UninstallJoin.zip.g5yk
Size 773KB
SHA256 2dc55e83a210e67f5b309c4078b6976c9890b44bb4925c79e4fc9bb82b8b5860
MD5 b36870c1a6c64c7a298775c55d3e7f6b
SHA1 5562010c1fa63d4125b2314fc5d246d564d705d2
SHA512 4ccc29b4a41959b22a61af39ba47fd219ee5e716031ae2cc6fb1ff2575b8e20f163d7191d33897a7bf44f8445a564b955c7b76520b42d7a3978545e7a24adec2
SSDEEP 12288:I34Ge4igQnYnZZ0y4rZG/9m2OJeCjY3BErcep1CcGu9iaGCtOQQJmQh1S3APPwE+:I34p7JIZ0TZGDucepcKxltPQJmLEO
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnpublishOut.ppsm.9vdi

Path C:\Users\Admin\Downloads\UnpublishOut.ppsm.9vdi
Size 1.0MB
SHA256 5fbae5ea231386130d58b8ffb43d58f3ecb686c48ab7b8b473d0107a78ce66f0
MD5 4c5fc538adc86cd23df74907fcaf434a
SHA1 4fea3f3b835f93f2e50eb242cc592b81c32adf56
SHA512 03041441dec4542177b85e6239718e26788c7d764f074068243c9a069bf2c4382d2dae420c213fb49b72442b3edee7ba4c56046e53c28967653179ffc94e0d50
SSDEEP 24576:Spld2eDrH6zbgWHtsEsQ+5s2/DkL45zItiCT:425geZsDo
MD5 SHA1 SHA512 SSDEEP

Submit Download

desktop.ini.x1rd

Path C:\Users\Admin\Downloads\desktop.ini.x1rd
Size 584B
SHA256 dc6d75c6cf661b1741eee9a8fecb9a9b1538d814ab2a77eb839c07385d83031c
MD5 2b271c51277e706c28866422c0128efb
SHA1 86a2b1224e82f9f85c50f3abec2be04611cd5a43
SHA512 9ef4ac274b30e7e47c4a8478f169c113cf99e9ef450cc17b751c1897fdcfaa6ebed69c53abf13be19845340fc77a8601e271db16773836db7941df10515b57a7
MD5 SHA1 SHA512

Submit Download

Desktop.lnk.ur2x

Path C:\Users\Admin\Links\Desktop.lnk.ur2x
Size 501B
SHA256 e62b411f70a4f4773e9cac813f2ebcfe97a080aee86013fd9ada22d84b05315a
MD5 1994f8a6ca8c268e87a4397cddeb05e4
SHA1 64906a6d93243e4093a293465c7784e9a274ed3b
SHA512 a64a6775a97868ef0240140f8ed034978bece684aaf0bcf48bbad85cc7e0bb4aa9b2e0aab97a817de936f9c738dccc2b7c2edd92bc2d7817378b08bf2a12ed30
MD5 SHA1 SHA512

Submit Download

Downloads.lnk.8bwl

Path C:\Users\Admin\Links\Downloads.lnk.8bwl
Size 942B
SHA256 2b4dbcac42634ca013d4677c7080bdf1d1579d37bd6c84f65d76cdb8d01967be
MD5 498e9ff2e5045ada44fcadda601235e1
SHA1 351a0900619b32f0d0a2c2c0ff28f3989f6d2df8
SHA512 a1c49e2f7c512547dd4934200617d9747ac4aac02eefa39b8b48eb84bfcf4863db14f850f1ab71d2adcf7a207bb4f3401b145f4489e6ed4e18ca2d24ad01262c
MD5 SHA1 SHA512

Submit Download

desktop.ini.by99

Path C:\Users\Admin\Links\desktop.ini.by99
Size 884B
SHA256 40e72a7fbf17a2216486c792747725cc9a71e4d3ebbfa71e67a93c6993e9b19f
MD5 b7c881e4c5ed538600e9f649a8fe1347
SHA1 d04f201e2bb5cc543b9aede82d7deed4862c0eb3
SHA512 fb7f84cb5bdc1ed5b5ba8af4f44a9b79ec833fabb04232b9f98f6d1f30a5f9334817c84bdefc081c2e82e6310053c25a74eb88de03d1e19d05da911d4a19cd9f
MD5 SHA1 SHA512

Submit Download

desktop.ini.pm9j

Path F:\$RECYCLE.BIN\S-1-5-21-627134735-902745853-4257352768-1000\desktop.ini.pm9j
Size 392B
SHA256 4b9cda806330e471a62857d6338f789a40f096a228c76cf280430cc80f8f39a3
MD5 a02fadb675bba10e876c81e1c4658256
SHA1 e9488c06608315ef1ffd758f4b3bebcebf15252b
SHA512 dfbfc7d74c78688f60e038f4cee2e53e2ff62c9c5723cbfd5b5278fa0325f122b52cc6bb42357b2f54d8309ce23431862d9e609dfeb4b1dd40556085a9a264e6
MD5 SHA1 SHA512

Submit Download

memory/1360-1461-0x00007FF867970000-0x00007FF868432000-memory.dmp

Download

memory/1360-1459-0x00007FF867970000-0x00007FF868432000-memory.dmp

Download

memory/2056-568-0x00007FF867850000-0x00007FF868312000-memory.dmp

Download

memory/2056-901-0x00007FF867850000-0x00007FF868312000-memory.dmp

Download

memory/2056-29-0x00007FF867850000-0x00007FF868312000-memory.dmp

Download

memory/2496-14-0x0000000000A90000-0x0000000000ABA000-memory.dmp

Download

memory/2496-15-0x00007FF867850000-0x00007FF868312000-memory.dmp

Download

memory/2496-28-0x00007FF867850000-0x00007FF868312000-memory.dmp

Download

memory/2856-904-0x00007FF867850000-0x00007FF868312000-memory.dmp

Download

memory/2856-908-0x00007FF867850000-0x00007FF868312000-memory.dmp

Download

memory/3076-10-0x000001BB23780000-0x000001BB23781000-memory.dmp

Download

memory/3076-7-0x000001BB23780000-0x000001BB23781000-memory.dmp

Download

memory/3076-2-0x000001BB23780000-0x000001BB23781000-memory.dmp

Download

memory/3076-1-0x000001BB23780000-0x000001BB23781000-memory.dmp

Download

memory/3076-6-0x000001BB23780000-0x000001BB23781000-memory.dmp

Download

memory/3076-11-0x000001BB23780000-0x000001BB23781000-memory.dmp

Download

memory/3076-12-0x000001BB23780000-0x000001BB23781000-memory.dmp

Download

memory/3076-9-0x000001BB23780000-0x000001BB23781000-memory.dmp

Download

memory/3076-0-0x000001BB23780000-0x000001BB23781000-memory.dmp

Download

memory/3076-8-0x000001BB23780000-0x000001BB23781000-memory.dmp

Download

memory/4648-449-0x0000000000F90000-0x0000000000FCC000-memory.dmp

Download

memory/4648-902-0x00007FF867850000-0x00007FF868312000-memory.dmp

Download

memory/4648-453-0x000000001BF40000-0x000000001BF50000-memory.dmp

Download

memory/4648-450-0x00007FF867850000-0x00007FF868312000-memory.dmp

Download

memory/4648-903-0x000000001BF40000-0x000000001BF50000-memory.dmp

Download

memory/4648-906-0x00007FF867850000-0x00007FF868312000-memory.dmp

Download