chaos | 105563733da3a05eef4e63a8af883b600e071e5449c819f0780bec73d0c404bf

Resubmissions

31/03/2024, 14:49

240331-r687xsec77 10

29/03/2024, 09:29

29/03/2024, 08:58

29/03/2024, 08:57

29/03/2024, 08:49

Analysis

max time kernel
313s
max time network
315s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
31/03/2024, 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

234.zip
Size

111KB
MD5

5e7e62594a2982835c7aea2fa131b393
SHA1

7319b88fc092922534b53ee7b37297ac4dfcf839
SHA256

105563733da3a05eef4e63a8af883b600e071e5449c819f0780bec73d0c404bf
SHA512

08edf60a7e55a9e9d90f48baacc290e039952c1da45cf56a2b850cd740cd97b1f67bea6456730f2d8f20ca6e9787ed4b81740182ee771b5a9844e4fe53da82a3
SSDEEP

1536:VYLMdhI1JzP3TynJWM5xkcXp4siewExDNOm3nmHyJGwlILvFlAY/2BE54DqHAzXE:zUDWLx54s/nxDN1WECLzF4qHcPbJL6Bn

Score

10^/10

chaos evasion ransomware spyware stealer

Malware Config

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 2 IoCs

resource	yara_rule
behavioral1/memory/2496-14-0x0000000000A90000-0x0000000000ABA000-memory.dmp	family_chaos
behavioral1/files/0x000300000002a7d3-20.dat	family_chaos

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5024	bcdedit.exe
1836	bcdedit.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3188	wbadmin.exe

Drops startup file 9 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hahaha.txt	Decrypter.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	svchost.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\svchost.url	taskmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\hahaha.txt	taskmgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hahaha.txt	svchost.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini.eow6	taskmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.eow6	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	Decrypter.exe

Executes dropped EXE 3 IoCs

pid	Process
2056	svchost.exe
2856	Decrypter.exe
1360	Decrypter.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	Decrypter.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-627134735-902745853-4257352768-1000\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	Decrypter.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-627134735-902745853-4257352768-1000\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-627134735-902745853-4257352768-1000\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	svchost.exe

Sets desktop wallpaper using registry 2 TTPs 4 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0vx1c5hr8.jpg"	Decrypter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nt63tvaky.jpg"	Decrypter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zvo8fursh.jpg"	Decrypter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yl9tj0vpk.jpg"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 7 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe

Checks processor information in registry 2 TTPs 32 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1936	vssadmin.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2668	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2056	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3076	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3076	taskmgr.exe
Token: SeSystemProfilePrivilege	3076	taskmgr.exe
Token: SeCreateGlobalPrivilege	3076	taskmgr.exe
Token: SeDebugPrivilege	2496	antivirus.exe
Token: SeDebugPrivilege	2056	svchost.exe
Token: SeBackupPrivilege	4580	vssvc.exe
Token: SeRestorePrivilege	4580	vssvc.exe
Token: SeAuditPrivilege	4580	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2132	WMIC.exe
Token: SeSecurityPrivilege	2132	WMIC.exe
Token: SeTakeOwnershipPrivilege	2132	WMIC.exe
Token: SeLoadDriverPrivilege	2132	WMIC.exe
Token: SeSystemProfilePrivilege	2132	WMIC.exe
Token: SeSystemtimePrivilege	2132	WMIC.exe
Token: SeProfSingleProcessPrivilege	2132	WMIC.exe
Token: SeIncBasePriorityPrivilege	2132	WMIC.exe
Token: SeCreatePagefilePrivilege	2132	WMIC.exe
Token: SeBackupPrivilege	2132	WMIC.exe
Token: SeRestorePrivilege	2132	WMIC.exe
Token: SeShutdownPrivilege	2132	WMIC.exe
Token: SeDebugPrivilege	2132	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2132	WMIC.exe
Token: SeRemoteShutdownPrivilege	2132	WMIC.exe
Token: SeUndockPrivilege	2132	WMIC.exe
Token: SeManageVolumePrivilege	2132	WMIC.exe
Token: 33	2132	WMIC.exe
Token: 34	2132	WMIC.exe
Token: 35	2132	WMIC.exe
Token: 36	2132	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2132	WMIC.exe
Token: SeSecurityPrivilege	2132	WMIC.exe
Token: SeTakeOwnershipPrivilege	2132	WMIC.exe
Token: SeLoadDriverPrivilege	2132	WMIC.exe
Token: SeSystemProfilePrivilege	2132	WMIC.exe
Token: SeSystemtimePrivilege	2132	WMIC.exe
Token: SeProfSingleProcessPrivilege	2132	WMIC.exe
Token: SeIncBasePriorityPrivilege	2132	WMIC.exe
Token: SeCreatePagefilePrivilege	2132	WMIC.exe
Token: SeBackupPrivilege	2132	WMIC.exe
Token: SeRestorePrivilege	2132	WMIC.exe
Token: SeShutdownPrivilege	2132	WMIC.exe
Token: SeDebugPrivilege	2132	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2132	WMIC.exe
Token: SeRemoteShutdownPrivilege	2132	WMIC.exe
Token: SeUndockPrivilege	2132	WMIC.exe
Token: SeManageVolumePrivilege	2132	WMIC.exe
Token: 33	2132	WMIC.exe
Token: 34	2132	WMIC.exe
Token: 35	2132	WMIC.exe
Token: 36	2132	WMIC.exe
Token: SeBackupPrivilege	1944	wbengine.exe
Token: SeRestorePrivilege	1944	wbengine.exe
Token: SeSecurityPrivilege	1944	wbengine.exe
Token: SeDebugPrivilege	4648	Decrypter.exe
Token: SeDebugPrivilege	2856	Decrypter.exe
Token: SeDebugPrivilege	2776	firefox.exe
Token: SeDebugPrivilege	2776	firefox.exe
Token: SeDebugPrivilege	4744	firefox.exe
Token: SeDebugPrivilege	4744	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	4848	firefox.exe
Token: SeDebugPrivilege	4848	firefox.exe
Token: SeDebugPrivilege	1360	Decrypter.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe

Suspicious use of SetWindowsHookEx 34 IoCs

pid	Process
2500	OpenWith.exe
5080	OpenWith.exe
5080	OpenWith.exe
5080	OpenWith.exe
5080	OpenWith.exe
5080	OpenWith.exe
5080	OpenWith.exe
5080	OpenWith.exe
5080	OpenWith.exe
5080	OpenWith.exe
5080	OpenWith.exe
5080	OpenWith.exe
2776	firefox.exe
4744	firefox.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
2636	firefox.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
4848	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2056	2496	antivirus.exe	90
PID 2496 wrote to memory of 2056	2496	antivirus.exe	90
PID 2056 wrote to memory of 3492	2056	svchost.exe	92
PID 2056 wrote to memory of 3492	2056	svchost.exe	92
PID 3492 wrote to memory of 1936	3492	cmd.exe	94
PID 3492 wrote to memory of 1936	3492	cmd.exe	94
PID 3492 wrote to memory of 2132	3492	cmd.exe	97
PID 3492 wrote to memory of 2132	3492	cmd.exe	97
PID 2056 wrote to memory of 3596	2056	svchost.exe	99
PID 2056 wrote to memory of 3596	2056	svchost.exe	99
PID 3596 wrote to memory of 5024	3596	cmd.exe	101
PID 3596 wrote to memory of 5024	3596	cmd.exe	101
PID 3596 wrote to memory of 1836	3596	cmd.exe	102
PID 3596 wrote to memory of 1836	3596	cmd.exe	102
PID 2056 wrote to memory of 3868	2056	svchost.exe	103
PID 2056 wrote to memory of 3868	2056	svchost.exe	103
PID 3868 wrote to memory of 3188	3868	cmd.exe	105
PID 3868 wrote to memory of 3188	3868	cmd.exe	105
PID 2056 wrote to memory of 2668	2056	svchost.exe	109
PID 2056 wrote to memory of 2668	2056	svchost.exe	109
PID 5080 wrote to memory of 2936	5080	OpenWith.exe	119
PID 5080 wrote to memory of 2936	5080	OpenWith.exe	119
PID 2936 wrote to memory of 2776	2936	firefox.exe	120
PID 2936 wrote to memory of 2776	2936	firefox.exe	120
PID 2936 wrote to memory of 2776	2936	firefox.exe	120
PID 2936 wrote to memory of 2776	2936	firefox.exe	120
PID 2936 wrote to memory of 2776	2936	firefox.exe	120
PID 2936 wrote to memory of 2776	2936	firefox.exe	120
PID 2936 wrote to memory of 2776	2936	firefox.exe	120
PID 2936 wrote to memory of 2776	2936	firefox.exe	120
PID 2936 wrote to memory of 2776	2936	firefox.exe	120
PID 2936 wrote to memory of 2776	2936	firefox.exe	120
PID 2936 wrote to memory of 2776	2936	firefox.exe	120
PID 2776 wrote to memory of 2780	2776	firefox.exe	121
PID 2776 wrote to memory of 2780	2776	firefox.exe	121
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122
PID 2776 wrote to memory of 252	2776	firefox.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\234.zip
1⤵
PID:5008

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Drops startup file
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:344

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" shell:::{52205fd8-5dfb-447d-801a-d0b52f2e83e1}
1⤵
PID:2312

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:2352

C:\Users\Admin\Desktop\antivirus.exe
"C:\Users\Admin\Desktop\antivirus.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Sets desktop wallpaper using registry
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3492
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:1936
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2132
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3596
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5024
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1836
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3868
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:3188
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\hahaha.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2668

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:652

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:2684

C:\Users\Admin\Desktop\decryptor-decrypter\Decrypter.exe
"C:\Users\Admin\Desktop\decryptor-decrypter\Decrypter.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Users\Admin\Desktop\decryptor-decrypter\Decrypter.exe
"C:\Users\Admin\Desktop\decryptor-decrypter\Decrypter.exe"
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2500

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\desktop.ini"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Desktop\desktop.ini
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2776.0.1260575939\780382671" -parentBuildID 20221007134813 -prefsHandle 1808 -prefMapHandle 1776 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c78ca84-f8c1-4b3b-8512-3a2ce29a3a4f} 2776 "\\.\pipe\gecko-crash-server-pipe.2776" 1888 194115e4d58 gpu
      4⤵
      PID:2780
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2776.1.1715282098\1744504029" -parentBuildID 20221007134813 -prefsHandle 2272 -prefMapHandle 2268 -prefsLen 21563 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {447b586e-11da-4458-936f-d71e75bfadb4} 2776 "\\.\pipe\gecko-crash-server-pipe.2776" 2284 194115e3858 socket
      4⤵
      Checks processor information in registry
      PID:252
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2776.2.350153117\448047596" -childID 1 -isForBrowser -prefsHandle 2896 -prefMapHandle 2736 -prefsLen 21601 -prefMapSize 233444 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed2ac286-91a5-4358-bb0f-268393267890} 2776 "\\.\pipe\gecko-crash-server-pipe.2776" 2740 19416b2e258 tab
      4⤵
      PID:3552
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2776.3.1546013111\365321995" -childID 2 -isForBrowser -prefsHandle 3500 -prefMapHandle 3408 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {912b901a-b0ed-456e-af17-48e395aff995} 2776 "\\.\pipe\gecko-crash-server-pipe.2776" 3496 1940585b258 tab
      4⤵
      PID:1452
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2776.4.426705939\1150251704" -childID 3 -isForBrowser -prefsHandle 4752 -prefMapHandle 4560 -prefsLen 26298 -prefMapSize 233444 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {130f6840-d18f-4169-a6e6-76c4dd59fe14} 2776 "\\.\pipe\gecko-crash-server-pipe.2776" 4768 1940585f858 tab
      4⤵
      PID:1908
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2776.5.745424597\315330880" -childID 4 -isForBrowser -prefsHandle 4932 -prefMapHandle 4784 -prefsLen 26298 -prefMapSize 233444 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {277c0caa-b46f-4831-b256-ce18846ecad1} 2776 "\\.\pipe\gecko-crash-server-pipe.2776" 3100 19418cccd58 tab
      4⤵
      PID:232
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2776.6.931370989\1800007599" -childID 5 -isForBrowser -prefsHandle 5100 -prefMapHandle 5104 -prefsLen 26298 -prefMapSize 233444 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {711b99f5-ed96-480c-a985-251a11fd4ebd} 2776 "\\.\pipe\gecko-crash-server-pipe.2776" 5112 19418cfce58 tab
      4⤵
      PID:1040

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2412
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4744.0.669266423\632767013" -parentBuildID 20221007134813 -prefsHandle 1760 -prefMapHandle 1752 -prefsLen 20871 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {86bc49d5-2ba5-4a2b-a199-737fd3742715} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" 1852 1fb6c5d3058 gpu
    3⤵
    PID:3068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4744.1.250070797\1460493009" -parentBuildID 20221007134813 -prefsHandle 2204 -prefMapHandle 2200 -prefsLen 20907 -prefMapSize 233496 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e0e820b-0f2b-4893-bc3a-b411843da0b9} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" 2216 1fb60671f58 socket
    3⤵
    - Checks processor information in registry
    PID:2500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4744.2.705004379\381451250" -childID 1 -isForBrowser -prefsHandle 2872 -prefMapHandle 2868 -prefsLen 21010 -prefMapSize 233496 -jsInitHandle 1372 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b400f214-438f-4f38-b326-93fe88099ff3} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" 3116 1fb71875e58 tab
    3⤵
    PID:4960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4744.3.327442204\1192375774" -childID 2 -isForBrowser -prefsHandle 972 -prefMapHandle 980 -prefsLen 26188 -prefMapSize 233496 -jsInitHandle 1372 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c24cd9a6-cc95-49de-b0ca-97e5331aa3e8} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" 3428 1fb6f1bdf58 tab
    3⤵
    PID:1908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4744.4.35824491\19157553" -childID 3 -isForBrowser -prefsHandle 4588 -prefMapHandle 4584 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 1372 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80d368a2-ac6b-4612-a48b-43a1187c560d} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" 4596 1fb73ba3658 tab
    3⤵
    PID:4216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4744.5.1938603717\1495638076" -childID 4 -isForBrowser -prefsHandle 4940 -prefMapHandle 4944 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 1372 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9cf8281-1496-4e2e-83e7-d9f758a429c2} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" 5012 1fb73dc5158 tab
    3⤵
    PID:4624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4744.6.1945250176\1609791854" -childID 5 -isForBrowser -prefsHandle 5104 -prefMapHandle 5108 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 1372 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {732d8687-0819-4445-8a1b-47f49756bb09} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" 4596 1fb73dc7858 tab
    3⤵
    PID:2776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4744.7.36332049\323680427" -childID 6 -isForBrowser -prefsHandle 5300 -prefMapHandle 5304 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 1372 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5c245d4-c0bc-489a-8108-94871a22ec35} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" 5292 1fb73dc6358 tab
    3⤵
    PID:3268

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:304
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\decryptor-decrypter\publicKey.chaos"
  2⤵
  PID:4780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Desktop\decryptor-decrypter\publicKey.chaos
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2636
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.0.1168250910\2098086839" -parentBuildID 20221007134813 -prefsHandle 1792 -prefMapHandle 1784 -prefsLen 20871 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c451a342-ac58-4520-b2f0-32fedaf6e601} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 1884 2592d1d3258 gpu
      4⤵
      PID:1968
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.1.213574535\2132388305" -parentBuildID 20221007134813 -prefsHandle 2272 -prefMapHandle 2268 -prefsLen 21687 -prefMapSize 233496 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73ed3134-5af9-4cca-99f8-12f11c30ffdb} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 2284 2592d103558 socket
      4⤵
      Checks processor information in registry
      PID:3400
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.2.1819206368\533366021" -childID 1 -isForBrowser -prefsHandle 3016 -prefMapHandle 3032 -prefsLen 21725 -prefMapSize 233496 -jsInitHandle 1364 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebdf3b89-13eb-4600-9db6-e70aa74ab27b} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 3008 259325b7258 tab
      4⤵
      PID:952
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.3.751442\481212144" -childID 2 -isForBrowser -prefsHandle 3408 -prefMapHandle 3404 -prefsLen 26188 -prefMapSize 233496 -jsInitHandle 1364 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a201769b-70c6-4d6b-9bfb-90b432413ea4} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 3420 2592fb97f58 tab
      4⤵
      PID:4652
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.4.2097382532\166082485" -childID 3 -isForBrowser -prefsHandle 4880 -prefMapHandle 4952 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 1364 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ca6baee-f704-4ebc-85e5-7d86d4983f63} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 4868 259329b3658 tab
      4⤵
      PID:4152
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.5.85176778\1719075760" -childID 4 -isForBrowser -prefsHandle 5060 -prefMapHandle 5064 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 1364 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43adfbcd-9d78-4087-8155-5f49c9c3d236} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 5056 259346c5258 tab
      4⤵
      PID:3524
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.6.1673256410\142025129" -childID 5 -isForBrowser -prefsHandle 5232 -prefMapHandle 5236 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 1364 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e87ebcee-0ad1-4655-914d-82d890fb617a} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 5220 259346c4c58 tab
      4⤵
      PID:4016

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1008
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\decryptor-decrypter\privateKey.chaos"
  2⤵
  PID:1132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Desktop\decryptor-decrypter\privateKey.chaos
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4848
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4848.0.1826188177\71170560" -parentBuildID 20221007134813 -prefsHandle 1748 -prefMapHandle 1740 -prefsLen 20871 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ceaa2805-81a4-48ca-8de0-188d4e69afe4} 4848 "\\.\pipe\gecko-crash-server-pipe.4848" 1844 261ffdce658 gpu
      4⤵
      PID:5052
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4848.1.108996179\548523956" -parentBuildID 20221007134813 -prefsHandle 2224 -prefMapHandle 2220 -prefsLen 21687 -prefMapSize 233496 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {13719bf1-2b01-4f5f-a8e1-cba70772edca} 4848 "\\.\pipe\gecko-crash-server-pipe.4848" 2236 261ffd03558 socket
      4⤵
      Checks processor information in registry
      PID:1952
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4848.2.1739847598\707084373" -childID 1 -isForBrowser -prefsHandle 3148 -prefMapHandle 3144 -prefsLen 21725 -prefMapSize 233496 -jsInitHandle 1040 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7831b6d5-ee82-44aa-b3dc-e317d2550b8a} 4848 "\\.\pipe\gecko-crash-server-pipe.4848" 3120 26187aa6858 tab
      4⤵
      PID:3948
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4848.3.1997289200\1933695109" -childID 2 -isForBrowser -prefsHandle 3460 -prefMapHandle 3456 -prefsLen 26188 -prefMapSize 233496 -jsInitHandle 1040 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {08db5166-5880-4bf5-b9ee-5e0be575aca2} 4848 "\\.\pipe\gecko-crash-server-pipe.4848" 3468 2618519cb58 tab
      4⤵
      PID:2044
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4848.4.741121552\2023786789" -childID 3 -isForBrowser -prefsHandle 4816 -prefMapHandle 4820 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 1040 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {faeca576-4bca-4665-b094-e898cbd35f5b} 4848 "\\.\pipe\gecko-crash-server-pipe.4848" 4844 26185148658 tab
      4⤵
      PID:3620
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4848.5.807667253\1991910720" -childID 4 -isForBrowser -prefsHandle 4976 -prefMapHandle 4980 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 1040 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e56c37d-a928-4b3e-aba1-02a077cf8564} 4848 "\\.\pipe\gecko-crash-server-pipe.4848" 4968 26189eb8a58 tab
      4⤵
      PID:3120
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4848.6.1021688470\1345810791" -childID 5 -isForBrowser -prefsHandle 5176 -prefMapHandle 5180 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 1040 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6dfde14-e4a6-409a-8b29-7171a6700911} 4848 "\\.\pipe\gecko-crash-server-pipe.4848" 5168 26189f67558 tab
      4⤵
      PID:4076

C:\Users\Admin\Desktop\decryptor-decrypter\Decrypter.exe
"C:\Users\Admin\Desktop\decryptor-decrypter\Decrypter.exe"
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
PID:1360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\er0iywxg.default-release\startupCache\urlCache-new.bin

Filesize
2KB

MD5
7d91725a72e204041df16d9d4158a13e

SHA1
a1762423e5f70641ad70c81ff958113d5295ad32

SHA256
07c22665bb69c004fe53404c731b1f322c9f1eacc001ef951f838f0e0f405a41

SHA512
3cc3c94af068c72a3cde3cf35619d7e033de2adf83e87d97ad2972c35f86fc0299b5cb9a743d57601393c2657442f4826fd86c0a6dea0b6acceafe7ec6480974

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.eow6

Filesize
436B

MD5
78632940dc67408197bd596623ab4326

SHA1
2b2a6914c5bf0ce8c29c94e40d2ea362841f8a7d

SHA256
f0be6f6afd756dce755a918ec770f4dc3b260266ee62d5f1ee1c008271f18187

SHA512
d79a7b9656468e19b2ee30a4f6e7558a2f08ce9ad0c44c8fafd9e0a93b84595ca320f329bf45dc86f4ee3abc4acf0cb1dc749f4633ddf8809220ff76dca22eaf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url

Filesize
142B

MD5
1a09a38485cbf1d59c29d8e3213e1ab9

SHA1
9cbe6ebd07b13a0d4b2565dc15a273629aa97251

SHA256
0a3bdc40dc0d243784bc5fa887b79110350b3d3200684f3ba99880fcea40e3b8

SHA512
a33c228196a4b3f14e40ac6ccb6c43002de28063594c472db852bedac20a6725f4e7601b9f32516e2c6bea35f83746973b3f1d200d9e5d668bda7553b62ac616

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\db\data.safe.bin

Filesize
4KB

MD5
88cd17649b6e002ef425f6729d9138bf

SHA1
3bf1a26c14a4a12f779936e44de779a20b8d776d

SHA256
937f93ea3f27e9711a61bd1347c9d869e0c6ecc7925a00250f5c530fadbdbe71

SHA512
85fdfa05f8be4bb4988137e163a7a83413868f721edc0715ca954cf0bd5f54a01239317084bfacbbc1000d35c0d05008e2461b1ccc0b64a1d52f4c7c8a26ceb5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\db\data.safe.bin

Filesize
5KB

MD5
c0ee35abdace90624d66f8b5529894dc

SHA1
5ec32e6746b5481bde7e6860097e4ae5c937cdea

SHA256
f5bb30a0f4c2811090c73c5a181cc8fffa101d97a834fcd8f15ed2ded1afc5ef

SHA512
5c7f592be5e2a95c55b4596cfa98e5368a1cfc81d6acee1b93ebc00df32c6c4fd0607d013d6182da3137bfbe611eb4d138e2ccede7e77b2403495c54ab641a4d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\db\data.safe.bin

Filesize
5KB

MD5
ad790c82927cfac86c627e9990e210cf

SHA1
a256db70d3e97894ff3dee4ee5f99857e90c7ff1

SHA256
b7ad63e9ebbf4d09ff1e59a12173eecbd63d12abdf88039890b42aa2cc38fbc7

SHA512
d2e6c2c3e7859c57b311a360080b8bd1a4579956ea5c66760a8b3b622c9b13de65c2d1f4883d68597c1147b848e1734f0f5572d5f4d981f8091e24095df19f93

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
7da08e4c5c479d46d00e91ae917b91fd

SHA1
b2a4ec492ce118add450e9323afb47f0a62975df

SHA256
4bb5d257a9b016c9f0d6b7d0dda6fe75e91a23fa696fe79787481d8a98ad5628

SHA512
4646ed5d1a32fa509a826b8b132ef0f8f19518263021369e0abaf036b5e629e3c03203850a5744b9926912e50eeb2035b5f9a16bafa16866ccdac05eeb6b97f2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\pending_pings\5d73b3dc-f8fd-406b-b677-8144eac469ca

Filesize
657B

MD5
72b001e77591b38000e2064d0e2262d9

SHA1
20f31b5e7df4a0c3b3d0adf96724e2b41472aa31

SHA256
f03e6c129f41ddaa0587cd951020eafa346eab54f1f19d507d0f2309b5ba7ac8

SHA512
0bd85e3cb715468b65719d442b2433e966a3f6861b5badc5da2e05f82e213aa6f25618aeceee761c0aa674c340406c8f43d398cfe54f6973aad8bed62b84b676

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\pending_pings\5dd10937-a23e-4f74-8c51-9e2a1466d262

Filesize
746B

MD5
c476c862fa49bc2d3ab97aef3ff155b5

SHA1
65ee8e291b067c215cf75fd44c3fed0acbe52305

SHA256
2e16b4250e4fb9d675c129c3310ac31f59d792d59a1e9380043ffd6dfe415389

SHA512
48f36567d052ef238e1af6941f5d8179614c8311832b58f89cfefb671f159c735c96477081e880504e6193ad33653b340cf1785792115b4967c1be9b9b464b45

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\pending_pings\68a230f6-04db-47f2-b561-3cdee02a64b6

Filesize
734B

MD5
ddf252e23a688de06dade3d416d41c96

SHA1
e6f5a42e91328e275724e4611f49ecc7b351d567

SHA256
2d74e8e45cbdeafdf976dad3469037d449a3d90260c2a7ca8c15c39981a71816

SHA512
6ad9a59aff5ad9247d28cd967f275fa828961e617e98f5bf23c6548677b73f9965312be6dcf990c3791baaca421bc241b0c8825c52417adb5cec8e3d811f8c73

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\pending_pings\abee75b0-00cf-4f78-918d-8efe22824e0a

Filesize
12KB

MD5
039a1d5ee79011b568df14175d3fe1d5

SHA1
e13acc5af68276f6b42e0961e42af073371b2661

SHA256
2fa691e47cf3bb8189869598117f8a11dbc492199f1e69fbbacdef76d6acccbc

SHA512
920975760fbf472277479250b6f44418d8d2a51ea3f05e1f583b63ee68d63f3ae7395ce59732002866791314275fd6daf6b4bd01b275aceae52cba5ee4eebba7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\pending_pings\ff3d5087-edfa-44d3-9dcf-f0c00f799c28

Filesize
657B

MD5
8f4e092e07dc8bd381d42e085402079a

SHA1
8f4dbf72f385ffa03420a9a229abe2aa8456b91d

SHA256
f8863d1a1efd8566f451b6a7b7783736af2ea4889720791565dae62b101d5d64

SHA512
a7a8d841805160179d059de848df323733172f73846bfd51c32548dd42d5bcfabe567d3df538d0ed298bfedafc24af71b1d8959a39d5d45f23056881937f4e2f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\prefs-1.js

Filesize
6KB

MD5
5862b402d4400fff0fffe6b57d2cc26b

SHA1
5f48c5eac27469ce57b37c7e648a0443ce9092ae

SHA256
5716ef20b2b5144cf0f22d1ee02a23b736fd0e012a6bc99621b4fe4f5e685463

SHA512
8902f787348f66e6c2cd72ddc571a7b78106e91668e4880a7dfb4add335617e268ff47d67d2301b8ce46a8ca6aec9b3d21c0592094a2b2eef88ce515c31e0c31

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\prefs-1.js

Filesize
6KB

MD5
3dec0d55b068d63c461507b44baedb07

SHA1
dca82bb2ddbe78783dca48946005a5132dab2cf6

SHA256
d6d319562a8e4713321d013f876ae797047ed0d6cc0bb67ce19b318362d60e02

SHA512
784c4d46a474c865826b72b7642b2055160b09417781e6edd71f24c24b04ff15febec8088b6ee3247451635ee439cde4467cd9345c59974b3205fbc7a28dbf6f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\prefs-1.js

Filesize
6KB

MD5
0b6abff75683bb7c737846edf865f608

SHA1
f806db7a0b1ceb0f97e115d7e1d880402e9449cb

SHA256
7d3a16822bd6107e104ee9f7c61fc80f51547c352856a99df71e61adbfb9e3d4

SHA512
4b0cb794b79302bc64b5889089e5164a6bf7a00383e5dcde4d5d7e9a3551ced740372bc5fa041b62e9542f8aa4c82c217a884c0228ef67cc286b03e7a01ee62c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\prefs.js

Filesize
6KB

MD5
1d104e20221554931fb3a633ae0dd66d

SHA1
dc79fc161af6f6551d89a26ad87b2af5b58ce99d

SHA256
8750c0453759f03b85e83fdacd519a10ac86bd4195716a09fd44a89a91724563

SHA512
a1fe77dae9e9a6b6058edc345647cb6d1ab4a40445245c098de0e102a2069bf8ee01c062fbc95b872359d35f2bcb0cd31608b21156e31c52e991aca28ccf181c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\prefs.js

Filesize
6KB

MD5
376ea20ec402cf89657b17ab73a4e205

SHA1
716332b7e8a8936d708990b3eb02a495540e9444

SHA256
a5f6a647329df44c177406146e1a2a9b9381aa50678b42db4a4c8abe16d31292

SHA512
e3d11b4972b5e3a18364a60a3ddad88eef9a92f50e4c9fc7f0fbb1ed55f98c32fc549cfea56b3e8a556c81cf4310faf72d6a52e5ef2318bedd172a4d88f7a136

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionCheckpoints.json

Filesize
288B

MD5
6b77a9f779399e95d1cee931a2c8f8ff

SHA1
826efd4feb0d50fcce5696111af7c811b81adcd9

SHA256
3a0285c8233ef0324b269f7291094e19fd9b77259f9419861ad796f7e9c979f3

SHA512
ef537c75fab8e86483ac03cc0d2feaf41575e35f54b95669a26bf6dfbf58021dc9a5bbe54d9537b55da3fbb0e0262adf6c5efd4394faaec81a31604533afec4f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionCheckpoints.json.tmp

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionCheckpoints.json.tmp

Filesize
122B

MD5
99601438ae1349b653fcd00278943f90

SHA1
8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9

SHA256
72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a

SHA512
ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionCheckpoints.json.tmp

Filesize
146B

MD5
65690c43c42921410ec8043e34f09079

SHA1
362add4dbd0c978ae222a354a4e8d35563da14b4

SHA256
7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d

SHA512
c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
700fe59d2eb10b8cd28525fcc46bc0cc

SHA1
339badf0e1eba5332bff317d7cf8a41d5860390d

SHA256
4f5d849bdf4a5eeeb5da8836589e064e31c8e94129d4e55b1c69a6f98fb9f9ea

SHA512
3fa1b3fd4277d5900140e013b1035cb4c72065afcc6b6a8595b43101cfe7d09e75554a877e4a01bb80b0d7a58cdcfe553c4a9ef308c5695c5e77cb0ea99bada4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionCheckpoints.json.tmp

Filesize
288B

MD5
e08ef355498ae2c73e75f5a7e60eada5

SHA1
c98b5ab80782513f6e72d95ab070e1ed7626c576

SHA256
d1a98a30522d1bf882574df5ed2793bba5c4fdf0381788babea0846f6946745c

SHA512
a0550e83ecd1cf632b4e54bf43744ee9f7c0a8dfcf9a043e018c00d4ca0bba606cfcaaa469b204e7c9dffec1f79b91e16cd4f1c94ff512c45d3dd25b7174e859

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionstore.jsonlz4

Filesize
905B

MD5
3ce1d9504cd9d9ba8ac2e745d8781779

SHA1
d3767a5e0ca8f5e3bf53d6d8c44d05039f7ee6bb

SHA256
9ea5eb12e072699c47ef2464925bdd659fd0d535a4ea527e9323dcbe96698d8c

SHA512
4c6622826be2341e8be7561445c0c8a1733793127bb0f2bf149a1f48ccc7db13548146e4b7d3e1c85a9d61ecaede1bec090fb20f2249cb79398464658a583a29

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionstore.jsonlz4

Filesize
882B

MD5
53203dda36cf3f1c1e72217fc43b9edf

SHA1
0dba15fd2fd6033d66b7a3f8e22a8dcb334d7f6d

SHA256
00323ca085dbe0a5c81f326fbaf2f74d442b4ecf3509a224e524971606e0f385

SHA512
ed45bf8b34fb2175aedf7016b6b52d5fb6d6491a13801bd45596c6692831f9c1ac5e68d9c53da29a99c2222c307bd145eea75aeffdacb37f73b6b69cacff6f3e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionstore.jsonlz4

Filesize
925B

MD5
04b7d6e9911d0218e942c7661d960d05

SHA1
214c3f0996f7fc186603383d8d0f40768359833e

SHA256
2d62060946ffaec53c0b2fe9ecec9b53f2718279182b1a31efea25f9c9f93edb

SHA512
8687b00a7ef0bbf9b13344edb0ce66b012c097d65919de95bd64b92ba546f20bb356bdee7787cf5917da047aa8d21d3b7df3b120a297349239c0b6452a8d150f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionstore.jsonlz4

Filesize
926B

MD5
0c419ebd59b4d01fa21c07578de9d767

SHA1
4d5bcb96c1a73b8db0317a577765a7efb507f717

SHA256
bd4f906dc49e4b4efc9d3a79aeff31bd89ec6bba033caafcf802fc56c6786c22

SHA512
42c4c7ad4cc985ff7603bf0d4d44983aa94b8f84c7e92c267ea4c8b30b5b44cfcb9698f34790c5b082973bfe41351db018641b1dc41e395e012a3ee449f2a13b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
d7de83d556f5be1fabc10fc945805a20

SHA1
6da1838d22d9c980167b61c74080de913aa5a8af

SHA256
e4aa7f719abd800ab379a34ddc9e3693c81a3c1697c138fe28ce82ff3e3a065c

SHA512
b072922ec7441344a0c39f612b594613420180bf0d6e1fba4824f19d075b467c1ba2eb0ce506979ab9e35907f37eb05b5d437c6c87ad9fa6c6afd6ba28050dfc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\xulstore.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\xulstore.json.tmp

Filesize
120B

MD5
05e1ddb4298be4c948c3ae839859c3e9

SHA1
ea9195602eeed8d06644026809e07b3ad29335e5

SHA256
1c2c5d5211674c3c8473e0589085499471399e53e9a85d7dd3b075fef6cbb6be

SHA512
3177b48cd0c877821419d7e5eb247a4c899bc37258994f22257ceaafefb316e6f5959faae02e380e432d7752f0218d45d56d6878c1e751d201d9fdb3ff98612e

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
144KB

MD5
4016477fd044882c78f3c1a47d7322e1

SHA1
6c75ffa25ef2d1d6a658ff415b2e47964032fc6a

SHA256
fbbaef754d6dafaaf32ae5e7937135fe81075806e5e2b0db1d6f9441a1cd8633

SHA512
17706a8238817e135ffe378e60e1e52964a00aeee6c6b9bc7f288a0390ae97d958f053cf693a4d829a35acbe32e3ab9599c13150a3155c671490736e88d19df1

Download Submit
C:\Users\Admin\Contacts\desktop.ini.ozs9

Filesize
756B

MD5
d707d18a882e4ac222523178012257d6

SHA1
57378315d772493c9f2538e36955a24625ff55b4

SHA256
a93d7b5bc1cb2a84ef225d9938414bb2da56572d01db5b46ed1e176f39df67f7

SHA512
ed4b37e2409380214ab26b7d954f2a085aff53c72807e4166a7bd520f58afee5e4058176136dfa2517d5c791835c875f2bb12b86e53dc552e90febbb58f0762e

Download Submit
C:\Users\Admin\Desktop\ApproveResume.xlsx.ky29

Filesize
780KB

MD5
ef931bdd5323936601bbb6bd35854c2c

SHA1
a978f8462a7a36a4aa3267f6c479a7ba5febb1ef

SHA256
8128bb8a7931eff19be4e1d947502ba9d78a66799665b408344ff1d9307f0424

SHA512
05300cccb2aba824de2c3c559e7ad2b0c7b1d34b2a75f03c84bd5e85d710898a6514bb216a08084154cb3a27cefded52b0c928dacc9808235cd241fac7587cbf

Download Submit
C:\Users\Admin\Desktop\ClearFormat.bmp.klbn

Filesize
1.5MB

MD5
41f10bc1b338a1fd2abc41cf7f65307f

SHA1
9d2dca75f6ee6c48654b734e5b37ba0d34a3560a

SHA256
cc11a5145fb456a31de5c7b8348da4cf87d3ac99d586a9d4b35043a74f1b26bc

SHA512
4ce9025e5190034c370ba0b8ca45e29f5169fbbb85bbef4615836c2e8074d08c78aa555e16e52871f295552baf3068dcce20979ddfa1dc72422e6e805f3a3ffc

Download Submit
C:\Users\Admin\Desktop\ClearUndo.cab.2de7

Filesize
443KB

MD5
1b77403e82992af913d032d626181813

SHA1
5aac02d7c6a472b7dfd8fbcb0f349e8bdb16f263

SHA256
acf06e981a9e124de2fa1b2e3395dcb8264a9d0b08d5c18d11419904439c0a23

SHA512
4c33d9f78dbba40cfc09664adb1d9111784c8c64cf69eeedf235aef3bb811254de9535c65f26c65812bf37a862898844237e0123c446986aba753557ec7bda28

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk.dfgj

Filesize
3KB

MD5
48e6f243689f8b09ba8bfbdc5f00b87b

SHA1
31653cecf4de38e3a8a96d6bfbb8dbf274717548

SHA256
b99d6f4136580b45d128a6a4380b364afc7d58ed73ad379dce2826499fe31de9

SHA512
9a26eeb9ef5161c40394fbe1eacf42eb21750f9b28affecb6751be2a20b7b4fc834ae282843dceda64bd8cc2d9754de8a3bd969f3f33a26fbb7de3d016f0cda6

Download Submit
C:\Users\Admin\Desktop\ReceiveDisconnect.xlsb.6wwe

Filesize
504KB

MD5
70943823c97a000f07ef91feba8ff585

SHA1
14d685e898e36d3d490903967a0e9c57fe551386

SHA256
db4cd001be07670ce67bcf9ac2458b592d8462306493b683c3218455cf231cc7

SHA512
5ebdd66d692ce7ef202d1ccb42fa66185855fd55df5d37d1f4994f4bce35f81ec3554770a9416be332681ded56e3074ea0664e6c40b57132eb3e1aa7575663e3

Download Submit
C:\Users\Admin\Desktop\RepairCheckpoint.asp.9k1t

Filesize
1.1MB

MD5
a5dbd5103dc83bcf5be302ffb613ae7a

SHA1
96c2a35f44179713440fe97285323ec4781fac8b

SHA256
9c0aa2b6134b8cedd8b766df91d02044aeacad43e7f610309551765a7f8e34f0

SHA512
bb77c1f6d0f7223bdd288182c7ef31c87baf0a4eab6fbf8b6a49ed9785dbe4eb3aab7daf505440ff95be8e9c8a83990cda80d1687d9f2211e9b22e00e9a5bf42

Download Submit
C:\Users\Admin\Desktop\RepairUpdate.avi.uffc

Filesize
474KB

MD5
886c5fc23b378b9c8f984a422563eb52

SHA1
1b64c1285711e3853897477fb20a805cdd2f12ce

SHA256
3bc2325834b5f6792f38e9d95331d9598fb80ea766eacb4603402ee366838ed4

SHA512
d93d34a6b40a02f0ac6af9a4ea90c38e343fecb6e5a8f1ec4b50785a6466aeb0b844c9d0375ee91fde90654f2ef65715f54f17f4c85f40943596147e2ed76de6

Download Submit
C:\Users\Admin\Desktop\RequestMeasure.cab.lk18

Filesize
994KB

MD5
1bfcae02aa2c949da9d40e0912c65b2f

SHA1
4d4e05ab2243b3d1f5dab3eafccd6d213eab75f1

SHA256
449eb22197f875f8eee6965753fd1ac2a5e7f7f42ec5b0cd34ddcb7b09c5065b

SHA512
195af343d2827a4b5a674c93809b074c6db44c5b7888c030d17b2e7c8d9e5b03f33d9a8b56c65947b27aa0c609e8341c436af00845fc3d505e43d9b2698ef2d3

Download Submit
C:\Users\Admin\Desktop\SelectUnlock.wma.ddbl

Filesize
657KB

MD5
0de3cb5d657ac67896db81b09f5de758

SHA1
2f33a186b7f73170bb524b513c0cf842309956ac

SHA256
c38447cfd86201fa001f6189c2ddb90d8069437e6daeaf69c0dc451d5b95c3a9

SHA512
79f1c4d6266d7e352adab94905840b3b13e6ce43e245ae16f4cd1da2333f350458558290ab53e7416eaf3b3ebdf976e2dfbc69160469ebb54139b79a1050ae14

Download Submit
C:\Users\Admin\Desktop\SendRead.php.808l

Filesize
535KB

MD5
4a6adb057307804970c06e893c0d64e4

SHA1
008b24552f3385f2e8182a97c4f2d981361dd27d

SHA256
71faf560461e048c370065413df5c6275f5d7788a9a0d68c117a6098e5ec4933

SHA512
e68bf940b59839a1d48bb2b7abc1a10143b2565ed0f67157ea3503118d158a4927408334f82d50709e7abc20d300d9ac46ee79f538e9f6ad01e710497f73327c

Download Submit
C:\Users\Admin\Desktop\SkipWrite.mhtml.560j

Filesize
566KB

MD5
1941b48aaa9d2e8f4bf6f4fd390e990f

SHA1
b470c27bc9e7e03cd901bac85d102bcc341bd8d9

SHA256
244c2364a9fe1dee17dd81274ac149de3ca308632320014be1474860ee59cba2

SHA512
45907fc1526b7a1e042a68610e3408f33ddebf2b31d462f6a9fa2523620e0b58d356c670ab228433142367bb6843d9dd1fbc9e6585d92185473e48a8616ae446

Download Submit
C:\Users\Admin\Desktop\SyncGet.docx.jnfj

Filesize
470KB

MD5
167d100b061b0c0cb6f8d41ab74553d8

SHA1
40e515ebe0a55851660dd64254f9045ebe1e14b2

SHA256
603bdd4c781c9c40a55e2b40083555ec09d14fcaf13b64c8a1633c09db32f8d9

SHA512
313e75f7bbb3356317df230d0e63a68d029a168ac6f384297894c8df702f0547ac3e2a6ddaca69ff368a87304c4ae51a995b2c28a5ea5f0c9f5bca24f2d2deda

Download Submit
C:\Users\Admin\Desktop\UnprotectResolve.ppsm.gzmx

Filesize
607KB

MD5
ccf17ae2b5861a2b8c8538164f1af78e

SHA1
88c023d02ba719e6391247192dbd087e7d00a793

SHA256
df3cdf0eae1c2d9eca2bd90a41dbcf71d814a658cc0c69ecef80f62ec87a0598

SHA512
435ece7fbbbe41689fdbee6912b4a9e195b0669f7fe14566fcd00be2a0d0604493c99f9ddc7921796dfce1a0e5fa7d26eaeee39d5e133bb41e3fe1a528d048ad

Download Submit
C:\Users\Admin\Desktop\desktop.ini.vfyw

Filesize
584B

MD5
6c8b991dd0f7325e34c61d87b3e01265

SHA1
4fda34ab6a6e232f1d0fbe6947d2f99fa5527d69

SHA256
bf0665a049f5961a29fcfdca3d8f1272651e9de85cc72ce49ab496172a18a3b1

SHA512
a8becd9bb49803f7b366164caad2f73caa55733990a409f9f27a8c5a1f9a30c39d9ddc9b93264a73e0eeca31c8a4d5453a5c4e7d84e77b1205a4d58500256448

Download Submit
C:\Users\Admin\Documents\Are.docx.e4lf

Filesize
15KB

MD5
d212a2f4cf477f7e544416157f825dab

SHA1
dc967b69d3d28083a87cdd8ac5d612a8c6f06113

SHA256
5d0492adf9c1b6299ff1a86fb68d560a494e032a70d2670f11a8c9a4f94ba853

SHA512
150ae323fcd0566872bc437cd518ecb5ac170dadd7abe1f1b3c83ccc81a65c11cc5ef97c400eeb78e135edbce5a7ff64e8c44920d6a20e2b332759c6786d32cc

Download Submit
C:\Users\Admin\Documents\ConvertStop.xml.ykjd

Filesize
1.0MB

MD5
69d070a4ee87dc9e2ba3631e96116e4b

SHA1
a668f775cb547c55893e2c82d56d35d5082a46ce

SHA256
dd421481c564fca72869ad509af65fae404fc6eb5acd7cc3d7a9ad56ee237396

SHA512
1b6f0d31361e10f72a8b45a24e35d57f21acfdbf36a173fddd05fae8a92cd0693fb8cf504d202c24bfdefed384ee8df782c4048b3efeb4d436c33154e1abfa79

Download Submit
C:\Users\Admin\Documents\EnableOpen.odp.956v

Filesize
1.4MB

MD5
b21eefe79dd1b532b59bb263b35762b9

SHA1
fc61a0d93630cba1e146bfb77dc4043693a178c5

SHA256
8a67568f04142d43272c8da7d48d50d7710190923588169a717f17a56bc98bbe

SHA512
3971b9c48fa379637503c8e902fa8c5ba772835724c4c0724dc5f504219b5feecc55a719fe21f2c5b22e5818d5c917f50abd2abf46f60e6cb055aa54b0650e8d

Download Submit
C:\Users\Admin\Documents\Files.docx.7d7p

Filesize
15KB

MD5
b36592aa6838e567993d4854efbf3801

SHA1
566c3c289c06e2a275e645e9fe70aac68e3c3244

SHA256
ea7a17a847be8531ec50c45c4862cfa9573d25ac2bd61a322216d1256f33fef5

SHA512
e7ddb9f0ee1388e8116ffc5918eb1f587f95908ff7fec23b533ab10aa7e1853d395747fbeced0b650cafd60d50a33fef05384cea02ecc4b3e09d584826cdfa6d

Download Submit
C:\Users\Admin\Documents\HideGet.xml.db1q

Filesize
1.3MB

MD5
d0ec44002b9a43e55773cd7e8d0f1875

SHA1
dd6997d96e8af225fb0919ac5f01c25c59d64d3a

SHA256
6021abbf1b1d12d4d3e0f59f8a602ebf3f63b056433a0abff19b60900c6e4bd8

SHA512
57cc3adadc500fb3e4d4b492f70d2ef776f1b034da2f79e4cb4c63a4ed77dfaf2466ce3bb130197d9c3678389896629a40ee0045e1c3cd72a75691fa563806d1

Download Submit
C:\Users\Admin\Documents\MeasureTrace.docm.30ug

Filesize
1.2MB

MD5
08fe70f40cda5b510a59203a12958e6d

SHA1
28675754f48c87e7f786d936c588892069906ef1

SHA256
0d5db7d4536dd21d8dc9efe5da5e2a02820eaa75fbb24ba4b872298422c86c0f

SHA512
1b25f4029689695340924a84a271650d20a917f78d23d66f8d93f69b388b7e43a43b572b5e396ad48fe263c0578fd2f4223f12f20b9f3c9c61f4bbc7d2211275

Download Submit
C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.wbyp

Filesize
8KB

MD5
37300b2c50c1bbebc066b91c500f70b0

SHA1
3936af2c27f8b122edd19b29e2bd56a7069dfe62

SHA256
a808efe580ef09a13daa3316f0086448e3cc50cc96a6a26c49c9318ce150c28e

SHA512
60185fe6cf44a142fb7128593e59eca3cdd1a50931c20e4f291eff83bd80b31e7c73a84a1c56a45711b3bff16620dcb438a285f55186d3d8a7ad55dbd5c14eac

Download Submit
C:\Users\Admin\Documents\Opened.docx.0efa

Filesize
11KB

MD5
bfbc1a403197ac8cfc95638c2da2cf0e

SHA1
634658f4dd9747e87fa540f5ba47e218acfc8af2

SHA256
272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6

SHA512
b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

Download Submit
C:\Users\Admin\Documents\ReadTest.ppsm.hwxh

Filesize
626KB

MD5
f2ff6415d2301a422e96ab18d3489ccd

SHA1
6a98e44b1bf22929b78c0d38c8e6dbe13b87c749

SHA256
4085b89e16f91d6963dfcac5bc698d15503bc76e3d1e4d56e324e9ee7d82b303

SHA512
da0dcb1f500dc2e3dc606df2889ddaf9ee6281ff934db9978d789e44cae2919413cda6a997e903e3f11285a5ca89bb7c54f5b8b6cb87f396bb3ecb47aa126f0d

Download Submit
C:\Users\Admin\Documents\ReceiveReset.potx.mwky

Filesize
1.3MB

MD5
feaee5a138640bdde0751dda1cbadc20

SHA1
03117f490f8ea166e7a2648ded384544d454dac4

SHA256
4a68624cd2aa57db3a9696ee6c9cefc3c1ebda8cc0df3d31e03e4ea59f0bd690

SHA512
da8061427f65290dc90032303b4b9c09d5f7552aa9ee9ddf37b1b1f5cde159b96e75ee30592bdebedc4a393e84737dab4fc52aa3283b8277cac24af344f74382

Download Submit
C:\Users\Admin\Documents\Recently.docx.kbu1

Filesize
15KB

MD5
bd254678ff8438c6d346d74c090f5862

SHA1
285688b2b2cd1740db0fd994a4691a8713896924

SHA256
b279652b60352e8d3f80602aba20bce83bde72e9df877bc02b3ef9f77316fc75

SHA512
129d21379bf4a8d4b40938d5ea9e8c313f001c7a15267d790f078268fc7b2489f400cbe7b990f03b2125ced41e1f4441a0496c46bf6b13d329025d257cb0e199

Download Submit
C:\Users\Admin\Documents\RepairPop.docx.2kbi

Filesize
1.8MB

MD5
f694065f48de45674f4fbfecbdf1ac33

SHA1
eba6ff470c5a2c707d0a719504e396ec92e24430

SHA256
108ad1e543115cc13783b53d7fc43cbf1eacb4ca165e7ace0899f63cf560b0b0

SHA512
bfbe8d04d2b86d9eb8f00913874c387ed794dd3b8497706936d55720dfb20fe4c59dd6767b75df021dc3c3ab85674f660e46096ff7783a29bc2324e699f3dfd6

Download Submit
C:\Users\Admin\Documents\ResizeSuspend.xlsm.t9w3

Filesize
1.1MB

MD5
82c63ad05daa12a4c8a4bcd8a2dadba8

SHA1
76d2c83df762ee8b70ae6d1bd0537752007c2e5f

SHA256
795427fcbe3e7c0c805947192e818eca5bfc6a4d85f89a1efca38d0a1a9c9b27

SHA512
4044641e6d0ed908707bea14358c8386bff7a2ec81d915aac82ee13adb62c8a03ab4148816383e9f5670ca726dc6c2e67ce18cc54654dc76802389f85d555ec1

Download Submit
C:\Users\Admin\Documents\RestartMount.pptx.9ekr

Filesize
1.5MB

MD5
68e41057dc39cba9fa83f7580c9f9be5

SHA1
fd12e535ad47131a93f69927e55ba49831916433

SHA256
70c6406b64114d5dde0bef5589ced4783b851a2c8b4bd79275cfe68b6db70cc3

SHA512
9b49c23118a43504c1cf7fbdfbf101073f456a88992ef7916f7b32487023338da16161155c28f8ab36d7edaf3eed1e1e280f1f0e995cfbb0dc5a4e3e79de0088

Download Submit
C:\Users\Admin\Documents\SyncDismount.xlsm.sj4m

Filesize
940KB

MD5
1c7b99c6324899779e841acdf3afa25f

SHA1
ba2e3aefaa33ae7f8aa8de1708b5e6ecab1c286a

SHA256
8745a0eaac1912eba2f46ec90bc5e79b21895030de0d3faa15490f20f4c2c74e

SHA512
9772af2b823e170477e082596e3eeabccc05afc79a63a875e230ff7a340c57ad877085cc32ac821bb883afd1f53158a20bec6706a335e668e1293621a321700b

Download Submit
C:\Users\Admin\Documents\These.docx.u3xg

Filesize
15KB

MD5
03dbcbdd2db5356fe89b6ee9c4349659

SHA1
b2302378aaabdd339cdc6a2c3567e835a0310453

SHA256
91b4a414fcc56f54111af640c03021beb8fbc9508daaa14beaae9ee64a77c6bc

SHA512
cf0ad1b4a7384fcb515f63c6d052109a54590edf2d72d05c21eb0998914a9af83105d64abc1ca06ed94b2f212599e3ea59b1f225e18cd9f4f10438a996c20a86

Download Submit
C:\Users\Admin\Documents\desktop.ini.urjh

Filesize
756B

MD5
59edd1f66619df86f30a656b598754c8

SHA1
9850cdf4001c97be98985ceefc728e7658738f3f

SHA256
1f208921dab46adb07858d42a8c28dd4e46edb652b2324de31d37aaac60fcfc3

SHA512
d082867af83c7794e6e7365a22211bcbbd89c89010b56ba2c5505dcbf39d3f23247f456aae9132fdb277d71117833f2dfe519305ec2c2093f60453e25f52895e

Download Submit
C:\Users\Admin\Documents\hahaha.txt

Filesize
63B

MD5
45dfa78907ccd5154a672941b7fd7805

SHA1
c96e039c5d260e3fc61d65da6718d3a832a182fd

SHA256
7d6a89c0a71eb6607c0f9226cbdbc241a154a49e463e599ea8ff126c161ad6af

SHA512
45b88dc885c14920f7e309566475c1c0d35b43dfade79ae951d41b422a4cba511f36b6305f0fde21af780399929f529661e1e9f1bcf0190e2b73472ed9950f2b

Download Submit
C:\Users\Admin\Downloads\ConvertToOpen.dwg.pw50

Filesize
519KB

MD5
e216701679703adef0229dfa0c146307

SHA1
53b6b6b9ff066053d8b22d62addcc892836355d0

SHA256
b7c7671b761a0eb2199daa3747acef5697a8d9a8272eebd38b93ada8955eb9c6

SHA512
3b24dab4fe25132a82b321e515a604194ad78eff32e7620487e73dfc42ceca638233ebb7bdd50a6017a18d58ded729fbdadf6e727ec8c7f284a2493de8e4956a

Download Submit
C:\Users\Admin\Downloads\InitializeBackup.cab.b8tt

Filesize
540KB

MD5
d400cb193e4f4feb7aa22ca33a525d56

SHA1
cb0100ba4434d3d5ab342acc5c2adcbec0de2205

SHA256
a213a36f700c09da169e3a91f1df269a69990e8e43848f2e49f9486861ada82c

SHA512
319d5ff0567ca6818016e5484317d78150cdc94176fe4a5d582923a3ceeaa5500cb7654ae23501d9855ed0e67b36298720e5c45fb9e6b6e62ec964923ac95468

Download Submit
C:\Users\Admin\Downloads\OutConvertFrom.iso.zmw1

Filesize
879KB

MD5
5818ef96f64a825548d6acd8fb72054d

SHA1
8615b8d80dabcdf4fc8879e876d18eaeac0db293

SHA256
3945c2435d293e23130fb0a160795b214fa7b6e174d0b792828ca1ffd7b86fde

SHA512
5a85978e206c1929e233a02a82654173423e96d761f4a013c9f6a85744993381bba805d127a57155c42905d933d836fbabaa4850f1638d2c10ea92fe3e333e20

Download Submit
C:\Users\Admin\Downloads\PopMeasure.css.rlbd

Filesize
688KB

MD5
dd9587969133be46a66b39f3766c4f19

SHA1
2c8925d43e4ae6870295cf3f3d16ad88c9a046d1

SHA256
94bd0bd30432a25d7a223141e758cc62505db90e0a9298a08e858b0193ec8fbd

SHA512
f15b67e74ff7a45b56c0ee94eb852dc5d56b624d518e602e0986128cb207d4176e47d325211fe2ce320ac41cdee808d22ffb493db0f7d95e5538a66be0e64b8d

Download Submit
C:\Users\Admin\Downloads\SkipDisconnect.3g2.mgzd

Filesize
794KB

MD5
b2b68f4233d64b5304c24b005e6ba71a

SHA1
20c7e05e33d7b02cf4ec26506727c209c7790b9d

SHA256
bb7c9c140694f1b4fffc8db366471537ba769a91660048bc07d0f829d2fbf08b

SHA512
a278cf6bb4a78fb528993c8d2ce3c6773428bab565dac1b7fdc7e5845125f2588f37560c2793d86e757f8cb466582d6a84b9a36ff86fedc6411fa1e8cf52c0fb

Download Submit
C:\Users\Admin\Downloads\SplitStart.mp3.28dr

Filesize
603KB

MD5
cdc0cd69068b980617ddc7a5cd373d98

SHA1
e455f7e66652ddfd20bc712807d5bf9a69cffa56

SHA256
791b3ee0a9fdf82d7f36733758dccb3d6afbdb838e7f89b970d110889511d05b

SHA512
77a9a4ad5d1db9c959f0d36cfdffb27266ffa7e9dd22499e6e0d5ddad9940ae2b9abeffaebaf57e864a5c0ef3d4c3e64570fbcffc159ae7cddb8395bccd60843

Download Submit
C:\Users\Admin\Downloads\StartDisconnect.mht.one1

Filesize
722KB

MD5
a27aa46b965e2700a884f6005dc4b60f

SHA1
1e048b61ec496015f450f4882534fbe4d62ce27d

SHA256
adc2d8996ba3bd0cd928703c849d0e052baa02c820b731cf5fbb9cd63241b097

SHA512
e86333ae0b68bb721a9ab8d0f71d063147bc4778872665901141c92875a2648208b5771a49f40e90a737a009cc95e6e20849991db9dc32ca25c52a2e1828e382

Download Submit
C:\Users\Admin\Downloads\StartRedo.bmp.ww27

Filesize
730KB

MD5
27761901278c084541c39f2ab7edebdb

SHA1
2e026e258c6d50fdbe8da3d042951d208812868f

SHA256
f3b724d7c605053d501d4d80e00368048fbdf87d12d8c3075d7d594c4d5a1708

SHA512
6e48830a93c73e83abcb760553d25b0e85d433806b11c55f9d57ab1e72c13dc9edf3aa786797b081f0dccbeebce6f7ff2cf2e92417b4bf1cbc12c4b62d9e5113

Download Submit
C:\Users\Admin\Downloads\SwitchExit.lnk.e5gh

Filesize
815KB

MD5
f40911eb84ed49159a110b4f97e62df9

SHA1
02c75314038aebad6cfe1209228d0b1d61c628aa

SHA256
218fbe16bf9151d180571aa5f17d23a060aeb280c273a231625a71049e60ad81

SHA512
91b7855bd17016666a14a93ca52e63c9aa7ae00c085892a5033966a2ab588c5cb3d660278700b3f49ad4209f77a07ca209fbd5e99cba1659e81b186403880ec3

Download Submit
C:\Users\Admin\Downloads\UndoEdit.txt.wgpu

Filesize
497KB

MD5
d8fb0c2f7350acf59bdd59d19c014b5f

SHA1
cfcb920a3e779ffb421c0096a74c0a6c64e9a268

SHA256
b943b2644efbe3b7d80abc35a1d518a48337424e6ee6e2ca7e5e137206b38a47

SHA512
2fb68df6919649692402c1b3cadddc326f6acdfd87004bb0dcd0cb493eda77d3beb778b5033541ba42f4250da6d05104879b2740bde23a636f3eac1b8640628f

Download Submit
C:\Users\Admin\Downloads\UndoShow.raw.zlxi

Filesize
921KB

MD5
5d8991939a05bcdd97fe32201f34c5e9

SHA1
2eaf2b20ba328ab194a3f1f22977a82d79e30d82

SHA256
f67364928b26a515a8f5150a33ec25dbc0933350f9d036fc8a5bcba62598e674

SHA512
3a67d449668475c3f4449b63a621df4c76d58b79f53cb5dcab252654d61cb69d9f58451ac043bbfa0cbd62c8aae90e134b916f4efbd8a04a00b23dd089a9c238

Download Submit
C:\Users\Admin\Downloads\UninstallJoin.zip.g5yk

Filesize
773KB

MD5
b36870c1a6c64c7a298775c55d3e7f6b

SHA1
5562010c1fa63d4125b2314fc5d246d564d705d2

SHA256
2dc55e83a210e67f5b309c4078b6976c9890b44bb4925c79e4fc9bb82b8b5860

SHA512
4ccc29b4a41959b22a61af39ba47fd219ee5e716031ae2cc6fb1ff2575b8e20f163d7191d33897a7bf44f8445a564b955c7b76520b42d7a3978545e7a24adec2

Download Submit
C:\Users\Admin\Downloads\UnpublishOut.ppsm.9vdi

Filesize
1.0MB

MD5
4c5fc538adc86cd23df74907fcaf434a

SHA1
4fea3f3b835f93f2e50eb242cc592b81c32adf56

SHA256
5fbae5ea231386130d58b8ffb43d58f3ecb686c48ab7b8b473d0107a78ce66f0

SHA512
03041441dec4542177b85e6239718e26788c7d764f074068243c9a069bf2c4382d2dae420c213fb49b72442b3edee7ba4c56046e53c28967653179ffc94e0d50

Download Submit
C:\Users\Admin\Downloads\desktop.ini.x1rd

Filesize
584B

MD5
2b271c51277e706c28866422c0128efb

SHA1
86a2b1224e82f9f85c50f3abec2be04611cd5a43

SHA256
dc6d75c6cf661b1741eee9a8fecb9a9b1538d814ab2a77eb839c07385d83031c

SHA512
9ef4ac274b30e7e47c4a8478f169c113cf99e9ef450cc17b751c1897fdcfaa6ebed69c53abf13be19845340fc77a8601e271db16773836db7941df10515b57a7

Download Submit
C:\Users\Admin\Links\Desktop.lnk.ur2x

Filesize
501B

MD5
1994f8a6ca8c268e87a4397cddeb05e4

SHA1
64906a6d93243e4093a293465c7784e9a274ed3b

SHA256
e62b411f70a4f4773e9cac813f2ebcfe97a080aee86013fd9ada22d84b05315a

SHA512
a64a6775a97868ef0240140f8ed034978bece684aaf0bcf48bbad85cc7e0bb4aa9b2e0aab97a817de936f9c738dccc2b7c2edd92bc2d7817378b08bf2a12ed30

Download Submit
C:\Users\Admin\Links\Downloads.lnk.8bwl

Filesize
942B

MD5
498e9ff2e5045ada44fcadda601235e1

SHA1
351a0900619b32f0d0a2c2c0ff28f3989f6d2df8

SHA256
2b4dbcac42634ca013d4677c7080bdf1d1579d37bd6c84f65d76cdb8d01967be

SHA512
a1c49e2f7c512547dd4934200617d9747ac4aac02eefa39b8b48eb84bfcf4863db14f850f1ab71d2adcf7a207bb4f3401b145f4489e6ed4e18ca2d24ad01262c

Download Submit
C:\Users\Admin\Links\desktop.ini.by99

Filesize
884B

MD5
b7c881e4c5ed538600e9f649a8fe1347

SHA1
d04f201e2bb5cc543b9aede82d7deed4862c0eb3

SHA256
40e72a7fbf17a2216486c792747725cc9a71e4d3ebbfa71e67a93c6993e9b19f

SHA512
fb7f84cb5bdc1ed5b5ba8af4f44a9b79ec833fabb04232b9f98f6d1f30a5f9334817c84bdefc081c2e82e6310053c25a74eb88de03d1e19d05da911d4a19cd9f

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-627134735-902745853-4257352768-1000\desktop.ini.pm9j

Filesize
392B

MD5
a02fadb675bba10e876c81e1c4658256

SHA1
e9488c06608315ef1ffd758f4b3bebcebf15252b

SHA256
4b9cda806330e471a62857d6338f789a40f096a228c76cf280430cc80f8f39a3

SHA512
dfbfc7d74c78688f60e038f4cee2e53e2ff62c9c5723cbfd5b5278fa0325f122b52cc6bb42357b2f54d8309ce23431862d9e609dfeb4b1dd40556085a9a264e6

Download Submit
memory/1360-1461-0x00007FF867970000-0x00007FF868432000-memory.dmp

Filesize
10.8MB

Download
memory/1360-1459-0x00007FF867970000-0x00007FF868432000-memory.dmp

Filesize
10.8MB

Download
memory/2056-568-0x00007FF867850000-0x00007FF868312000-memory.dmp

Filesize
10.8MB

Download
memory/2056-901-0x00007FF867850000-0x00007FF868312000-memory.dmp

Filesize
10.8MB

Download
memory/2056-29-0x00007FF867850000-0x00007FF868312000-memory.dmp

Filesize
10.8MB

Download
memory/2496-14-0x0000000000A90000-0x0000000000ABA000-memory.dmp

Filesize
168KB

Download
memory/2496-15-0x00007FF867850000-0x00007FF868312000-memory.dmp

Filesize
10.8MB

Download
memory/2496-28-0x00007FF867850000-0x00007FF868312000-memory.dmp

Filesize
10.8MB

Download
memory/2856-904-0x00007FF867850000-0x00007FF868312000-memory.dmp

Filesize
10.8MB

Download
memory/2856-908-0x00007FF867850000-0x00007FF868312000-memory.dmp

Filesize
10.8MB

Download
memory/3076-10-0x000001BB23780000-0x000001BB23781000-memory.dmp

Filesize
4KB

Download
memory/3076-7-0x000001BB23780000-0x000001BB23781000-memory.dmp

Filesize
4KB

Download
memory/3076-2-0x000001BB23780000-0x000001BB23781000-memory.dmp

Filesize
4KB

Download
memory/3076-1-0x000001BB23780000-0x000001BB23781000-memory.dmp

Filesize
4KB

Download
memory/3076-6-0x000001BB23780000-0x000001BB23781000-memory.dmp

Filesize
4KB

Download
memory/3076-11-0x000001BB23780000-0x000001BB23781000-memory.dmp

Filesize
4KB

Download
memory/3076-12-0x000001BB23780000-0x000001BB23781000-memory.dmp

Filesize
4KB

Download
memory/3076-9-0x000001BB23780000-0x000001BB23781000-memory.dmp

Filesize
4KB

Download
memory/3076-0-0x000001BB23780000-0x000001BB23781000-memory.dmp

Filesize
4KB

Download
memory/3076-8-0x000001BB23780000-0x000001BB23781000-memory.dmp

Filesize
4KB

Download
memory/4648-449-0x0000000000F90000-0x0000000000FCC000-memory.dmp

Filesize
240KB

Download
memory/4648-902-0x00007FF867850000-0x00007FF868312000-memory.dmp

Filesize
10.8MB

Download
memory/4648-453-0x000000001BF40000-0x000000001BF50000-memory.dmp

Filesize
64KB

Download
memory/4648-450-0x00007FF867850000-0x00007FF868312000-memory.dmp

Filesize
10.8MB

Download
memory/4648-903-0x000000001BF40000-0x000000001BF50000-memory.dmp

Filesize
64KB

Download
memory/4648-906-0x00007FF867850000-0x00007FF868312000-memory.dmp

Filesize
10.8MB

Download