fantom | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-10-2024 08:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/

Score

10^/10

fantom gandcrab infinitylock backdoor credential_access defense_evasion discovery evasion persistence ransomware spyware stealer

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\BEGIAXZBR-MANUAL.txt

Family

gandcrab

Ransom Note

---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .BEGIAXZBR The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/37aff50a56c30f97 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAL6dtSYaj7QBbriL6w6Qa8Urmk84DBiYp0un95TgHMkcCmOM3skPvq+Dg3BtxBlMerv2/JlYwYs2oVW0E1zUUTR60mV0jPc2S6QhLizOrR1NWozMbKUCE3M3rnGo9L/E29PcJXHQwEoFRx9w4a55mjgu36GZTBpT89cLunDDb9gL33vl09MRyXvi5D0x8R7kkdJactPFv1rVIe8TIqBQc8hr/orm8A/XEtFRSJhTup78z2K/n6zI63G1r6F/Y804Y8++hbXTin1+ApD7vSa069sOmjTJlYjpwQgVNJ2Ke81Rep2KAeMrb+365er8S6LOKLH6oQQGYA/U5NzLs0HjZJQZImn+Fl2TINl4KCeMMZsBjiO98ESJonpZ6LBZrwU05Ijn3QHJDuIIdl/QuWBjn9q5LE8WVNZ7KVshneS2ZmRJuKzqsqmozGg6k6P3C4iP7oyZOulnhzY+mQiuzoR4IQqFiT3uASIKjclS4bij1pz1PVgRARsfvp/iTc6H1WlhKCFER4o50RS2Yh3mIDQXURJ6Z/47nw49qXychEFs/Lp5CiwtOVAq8+grHqh4PBv63sTsnjU3OLEdAc0ZjmHrHgm6qyk28azD6xLvOm+rhbYrqzpE6XsLEhlcGk5IV1rmTVeoaTMXEHvScCia60jatYMprf+akEHVC69xw4DaWMYtUlPo2esGgra0blISHnu+gV0DfWx0Ue9xiMgI9wAmBdc7Ww7Pm5d62oiL0gQd0b7jgrngcwwxBlfEhMakp0ohS15JES+PvEFASCr86TIQKXGobzMYq0rTsuhYP0YxVVyuobCu4sE58uzObu+b0ARZ0tCfxDOSTHgox/BqJULAPspLrrxSTXpKTkqnwpb97BNEt+xrfbiAQvANDYcIifm8a2uGqMJOjeHYtGaD/6zw2SaDx+7jYxM82284pVbKhLUZ/TgG8s/7uCxeIl356PeoDkMlcuqeFStm8uJsCW+teP7IG15BGsHDKYKPXVSCn5K19cJx7V+ECSxw9UIkymEHf2Vz71HyCfqSPpI3hlryCMPKhA5S4rTXEAPXnr1lkKb5XopAHWG4jmyIa708HTLAkSI6GKATvSj24GxGAa62PfKx7OjFZlkfGkKpWDmkAFI7vuM2I7aayffwKtuab7To8qwF9WHsBY0jVER8w0BVJJiUYapcfrzVJdxsRmsfPOe4taqj3T2uKhuDzviqMx8kLSBx5M6cidfY/kSGK7wkzco7ZEogdRNEkJFAgb6semNcAC+jF97VktZ72Vs/H/E41fGmPBSgDT6e+yubRJkdBZMpj3wK3uEhsfu4a0649n1SmDOZ/Kw3nrlYykvxtpYd/CcV9iOhTGBMXdAJVafh6A+TG30w6Gt/u4EVVgIiYdfFVd/0iooeOuD0la2LRqLZeOvowOKCLO1mqPZRaKNojenuayCLE3YO9ZN9FZy27K9O8CYOJE1/CWYPLQxB/OrtrryApkgMhbuY7kyECfu/rMnvwjIiIsMOoBaw9/7yb2qMM4QoRoOA/xtd2tK2OmgvZVkSmhPuaH9g/uhfV1bcv+CItgWXenZzWCky2zn2OCOndRfooz3HN0p7UFYJgJaQ5xFYQnLNm3AXdXkkQbNIMVFKSEuZLH/lWP2mnPpLmEXOqjCmuCdHXj/EPyYD5zyB+YizFTbSjXwROAIVTV3GgqG1pQCmWOfXnYCAvSTJ0EpSJQA25sqyWHdf3e9VE1iHVLOzTpLkIdy4+tr7PlKFsh0/mJJ5tUdeBnVVu5bnVCHHl+GM0Gx4ladWwhnmRs/GjhpYL+jWikACOxU8R2EC6GVED9KfNfRRuHiBdgaXZ+8hEM7iXCN8vS9MXBOHu9HVu+K9o2RQLLDY370hX3wKlHna3xJ3M2sMftg+0RBkTlQwwkMZmWFgbe+FM94B3VfsuaYEZp5w521NiioHDehF8yDSYlGidJefPKSyzSP9R8if3l6Axf6PRdTzRMwjhos5ZMmoElbPDLzi3qMKKBK0EKRk7+n8wo6R8B+3bazhcTA6XpraIAY8KFW18OTY5Y650OG6bvAB/FA9GfUosN7xa5EKe5Utq6wN8E+AQ5JE+l3iDxRgSjCzB67IhcroZGgdslT+GouD7l6eJNMmk1/F7oZuj6mQfchjTBXB8kF7JrFfoAUYy9Uq1N6a9T1R/EA2kHZ6qkw21ZCrcKQ1zkWHtm5kc5mBkJXeZWfMJlQlUZL2uNEzuFNjhi7GUsNk7Gfrsl9XQUE= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmD09M/JMZDPAvaVq+DQRX/IKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2mU0R7+dxfWLoypoW25ypHEnKnMMuBl1Cmehqo5VrrnNSZu19KSVzOtTAymPz79ICyGBkpCKj0RQwVePfN00RSBSDCtOuJK9BbBiFqrsZvR+W3N7GfmdeRjEfWP9Dy+/NzLOzjDaO2rwVWxuZ2TzbJpvbdL0N0zPfgSzCzhqApoTPFpp2CPDOx6ihEudzoNVoM6j2VyOmqqBlvZbwHrtMypC8E1f2lWTmX7qt4GuxOgTOwQUyhb/ofzNwkLQejqrjTwFji9zPbKPSghI2dWKf+5gkQvDGihIFdEvpEtCM6ANnhwdQRIFj1CUHPyeWMbZ0K1g0/7uRQeyoEinT3CrvrP9dFPEuVIcosLqYb4AnecHqVubCDEZSsSLSNnIyaZEI9b5008FGYczrSlaIGDBHFzoGoqA9wiUaNxMzG ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/37aff50a56c30f97

Extracted

Path

C:\g6QpgrhJDdQZeF0\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>lsQZHplhqLa3yUPsjdRnhduFcbu09mfwNiALJL3GpF0gB/z78r+KQwTUM89y7VM6N/GqEpBXXqxCm5CuNLo0G4AE5+7vFRkvHLvWtkD8ZYfqB2ehNCZDynEuSSB9ZK3+fqfKkkpX8HD31aJ1u33yPsWI+pOGKXBelDf9KU9f9A7BVUw0VfuT67AUnXm9qTp8yyhWbxREhLO6zpoZXzJ0GitEaATUIDyzdLhJdM29SjmDwOOkmC3s/8E+/T8FOiS0U2vWXkVjKq4x2fRS3lQJvA8/nZJFM058K8c1EZTeZ3MhlPB1Lcfl52zesgShZAYf1HX161zwBtNGJOe2iYEshg==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Signatures

Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
ransomware fantom
Fantom family
fantom
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab
Gandcrab family
gandcrab
InfinityLock Ransomware
Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
ransomware infinitylock
Infinitylock family
infinitylock
Renames multiple (330) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Renames multiple (908) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Disables RegEdit via registry modification 4 IoCs

evasion

Processes:

Krotten.exeKrotten.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Krotten.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Krotten.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Krotten.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Sets service image path in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

mssql.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\mssqlaq\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\mssqlaq.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\mssql\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\mssql.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\xglflzbxqiofai\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\xglflzbxqiofai.sys"	mssql.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 3 IoCs

Processes:

GandCrab.exeDeriaLock.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\56c3087a56c30f9b112.lock	GandCrab.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LOGON.exe	DeriaLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\BEGIAXZBR-MANUAL.txt	GandCrab.exe

Executes dropped EXE 12 IoCs

Processes:

DeriaLock.exeDharma.exenc123.exemssql.exemssql2.exeSearchHost.exeFantom.exeGandCrab.exeInfinityCrypt.exeKrotten.exeKrotten.exeWindowsUpdate.exe

pid	process
1348	DeriaLock.exe
1536	Dharma.exe
1836	nc123.exe
1844	mssql.exe
2912	mssql2.exe
1752	SearchHost.exe
1304	Fantom.exe
3512	GandCrab.exe
3452	InfinityCrypt.exe
3280	Krotten.exe
3488	Krotten.exe
1220	WindowsUpdate.exe

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

defense_evasion

Safe Mode Boot

T1562.009

Processes:

mssql.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\xglflzbxqiofai.sys	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SAFEBOOT\MINIMAL\XGLFLZBXQIOFAI.SYS	mssql.exe

Loads dropped DLL 14 IoCs

Processes:

Dharma.exeFantom.exe

pid	process
1536	Dharma.exe
1536	Dharma.exe
1536	Dharma.exe
1536	Dharma.exe
1536	Dharma.exe
1536	Dharma.exe
1536	Dharma.exe
1536	Dharma.exe
1536	Dharma.exe
1536	Dharma.exe
1536	Dharma.exe
1536	Dharma.exe
1536	Dharma.exe
1304	Fantom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Krotten.exeKrotten.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\WINDOWS\\Web\\rundll32.exe"	Krotten.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AVPCC = "C:\\WINDOWS\\Cursors\\avp.exe"	Krotten.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\WINDOWS\\Web\\rundll32.exe"	Krotten.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AVPCC = "C:\\WINDOWS\\Cursors\\avp.exe"	Krotten.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

GandCrab.exeSearchHost.exe

description	ioc	process
File opened (read-only)	\??\E:	GandCrab.exe
File opened (read-only)	\??\H:	GandCrab.exe
File opened (read-only)	\??\K:	GandCrab.exe
File opened (read-only)	\??\S:	GandCrab.exe
File opened (read-only)	\??\U:	GandCrab.exe
File opened (read-only)	\??\W:	GandCrab.exe
File opened (read-only)	\??\X:	GandCrab.exe
File opened (read-only)	\??\G:	GandCrab.exe
File opened (read-only)	\??\L:	GandCrab.exe
File opened (read-only)	\??\N:	GandCrab.exe
File opened (read-only)	\??\Q:	GandCrab.exe
File opened (read-only)	\??\R:	GandCrab.exe
File opened (read-only)	\??\T:	GandCrab.exe
File opened (read-only)	\??\V:	GandCrab.exe
File opened (read-only)	\??\D:	SearchHost.exe
File opened (read-only)	\??\I:	GandCrab.exe
File opened (read-only)	\??\J:	GandCrab.exe
File opened (read-only)	\??\Y:	GandCrab.exe
File opened (read-only)	\??\A:	GandCrab.exe
File opened (read-only)	\??\B:	GandCrab.exe
File opened (read-only)	\??\M:	GandCrab.exe
File opened (read-only)	\??\O:	GandCrab.exe
File opened (read-only)	\??\P:	GandCrab.exe
File opened (read-only)	\??\Z:	GandCrab.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

Processes:

flow	ioc
63	raw.githubusercontent.com
64	raw.githubusercontent.com
65	raw.githubusercontent.com
66	raw.githubusercontent.com
67	raw.githubusercontent.com
68	raw.githubusercontent.com
69	raw.githubusercontent.com
70	raw.githubusercontent.com

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

Krotten.exeKrotten.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "DANGER"	Krotten.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Äëÿ òîãî ÷òîáû âîññòàíîâèòü íîðìàëüíóþ ðàáîòó ñâîåãî êîìïüþòåðà íå ïîòåðÿâ ÂÑÞ èíôîðìàöèþ! È ñ ýêîíîìèâ äåíüãè, ïðèøëè ìíå íà e-mail [email protected] êîä ïîïîëíåíèÿ ñ÷åòà êèåâñòàð íà 25 ãðèâåíü. Â îòâåò â òå÷åíèå äâåíàäöàòè ÷àñîâ íà ñâîé e-mail òû ïîëó÷èøü ôàèë äëÿ óäàëåíèÿ ýòîé ïðîãðàììû."	Krotten.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "DANGER"	Krotten.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Äëÿ òîãî ÷òîáû âîññòàíîâèòü íîðìàëüíóþ ðàáîòó ñâîåãî êîìïüþòåðà íå ïîòåðÿâ ÂÑÞ èíôîðìàöèþ! È ñ ýêîíîìèâ äåíüãè, ïðèøëè ìíå íà e-mail [email protected] êîä ïîïîëíåíèÿ ñ÷åòà êèåâñòàð íà 25 ãðèâåíü. Â îòâåò â òå÷åíèå äâåíàäöàòè ÷àñîâ íà ñâîé e-mail òû ïîëó÷èøü ôàèë äëÿ óäàëåíèÿ ýòîé ïðîãðàììû."	Krotten.exe

Drops file in Program Files directory 64 IoCs

Processes:

InfinityCrypt.exeFantom.exeGandCrab.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\LAYERS.ELM.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107314.WMF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153307.WMF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215210.WMF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0217698.WMF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21421_.GIF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\localedata.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core.xml	Fantom.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\WATER.INF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309705.JPG.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00444_.WMF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0281904.WMF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21301_.GIF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\IntroducingPowerPoint2010.potx.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser_5.5.0.165303.jar	Fantom.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\BEGIAXZBR-MANUAL.txt	GandCrab.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.msi.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105502.WMF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0171847.WMF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14828_.GIF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar	Fantom.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107148.WMF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0298653.WMF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\AddIns.store.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145373.JPG.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143754.GIF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Median.thmx.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0315447.JPG.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.sun.el_2.2.0.v201303151357.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluTSFrame.png	Fantom.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\ARCTIC.ELM.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00633_.WMF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\MpAsDesc.dll.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	Fantom.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar	Fantom.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.CGM.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196354.WMF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02270_.WMF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-settings.xml	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02116_.WMF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099149.WMF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0216612.WMF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15056_.GIF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21322_.GIF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21348_.GIF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\mr.pak	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml	Fantom.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01635_.WMF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01563_.WMF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02187_.GIF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Urban.thmx.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityReport.Dotx.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html	Fantom.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198712.WMF.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB	InfinityCrypt.exe

Drops file in Windows directory 2 IoCs

Processes:

Krotten.exeKrotten.exe

description ioc process

File opened for modification C:\WINDOWS\Web Krotten.exe
File opened for modification C:\WINDOWS\Web Krotten.exe

description	ioc	process
File opened for modification	C:\WINDOWS\Web	Krotten.exe
File opened for modification	C:\WINDOWS\Web	Krotten.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 8 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

Processes:

firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\Locky.AZ.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\NoMoreRansom.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\DeriaLock.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Dharma.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Fantom.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\GandCrab.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\InfinityCrypt.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Krotten.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

DeriaLock.exenc123.exeFantom.exeGandCrab.exeDharma.exemssql2.exeSearchHost.execmd.exeInfinityCrypt.exeKrotten.exeKrotten.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DeriaLock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nc123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fantom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GandCrab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dharma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssql2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SearchHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfinityCrypt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Krotten.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Krotten.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

GandCrab.exeInfinityCrypt.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GandCrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	GandCrab.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InfinityCrypt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InfinityCrypt.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GandCrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Control Panel 12 IoCs

evasion

Processes:

Krotten.exeKrotten.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Desktop\WallpaperOriginY = "187"	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Desktop\MenuShowDelay = "9999"	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Desktop\WallpaperOriginY = "187"	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\International\sTimeFormat = "ÕÓÉ"	Krotten.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Desktop	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Desktop\WallpaperOriginX = "210"	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Desktop\MenuShowDelay = "9999"	Krotten.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\International	Krotten.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Desktop	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Desktop\WallpaperOriginX = "210"	Krotten.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\International	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\International\sTimeFormat = "ÕÓÉ"	Krotten.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

Krotten.exeKrotten.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window title = ":::::::::::::::::: ÌÎÉ ÕÓÉ ÏÐÎÒÓÕ À ÏÈÇÄÀ ÃÍÈÅÒ ::::::::::::::::::"	Krotten.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	Krotten.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Window title = ":::::::::::::::::: ÌÎÉ ÕÓÉ ÏÐÎÒÓÕ À ÏÈÇÄÀ ÃÍÈÅÒ ::::::::::::::::::"	Krotten.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window title = ":::::::::::::::::: ÌÎÉ ÕÓÉ ÏÐÎÒÓÕ À ÏÈÇÄÀ ÃÍÈÅÒ ::::::::::::::::::"	Krotten.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	Krotten.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Window title = ":::::::::::::::::: ÌÎÉ ÕÓÉ ÏÐÎÒÓÕ À ÏÈÇÄÀ ÃÍÈÅÒ ::::::::::::::::::"	Krotten.exe

Modifies Internet Explorer start page 1 TTPs 4 IoCs

stealer

Modify Registry

T1112

Processes:

Krotten.exeKrotten.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://poetry.rotten.com/lightning/"	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://poetry.rotten.com/lightning/"	Krotten.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://poetry.rotten.com/lightning/"	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://poetry.rotten.com/lightning/"	Krotten.exe

Modifies registry class 2 IoCs

Processes:

firefox.exeKrotten.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	firefox.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\REGFILE\SHELL\OPEN\COMMAND	Krotten.exe

NTFS ADS 8 IoCs

Processes:

firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\Locky.AZ.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\NoMoreRansom.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\DeriaLock.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Dharma.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Fantom.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\GandCrab.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\InfinityCrypt.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Krotten.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

DeriaLock.exe

pid	process
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe

Suspicious behavior: LoadsDriver 3 IoCs

Processes:

mssql.exe

pid process

1844 mssql.exe
1844 mssql.exe
1844 mssql.exe

pid	process
1844	mssql.exe
1844	mssql.exe
1844	mssql.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

firefox.exeDeriaLock.exemssql.exemssql2.exeFantom.exeKrotten.exeKrotten.exeInfinityCrypt.exe

description	pid	process
Token: SeDebugPrivilege	2360	firefox.exe
Token: SeDebugPrivilege	2360	firefox.exe
Token: SeDebugPrivilege	1348	DeriaLock.exe
Token: SeDebugPrivilege	1844	mssql.exe
Token: SeLoadDriverPrivilege	1844	mssql.exe
Token: SeLoadDriverPrivilege	1844	mssql.exe
Token: SeLoadDriverPrivilege	1844	mssql.exe
Token: SeDebugPrivilege	2912	mssql2.exe
Token: SeDebugPrivilege	1304	Fantom.exe
Token: SeSystemtimePrivilege	3280	Krotten.exe
Token: SeSystemtimePrivilege	3280	Krotten.exe
Token: SeSystemtimePrivilege	3280	Krotten.exe
Token: SeSystemtimePrivilege	3488	Krotten.exe
Token: SeSystemtimePrivilege	3488	Krotten.exe
Token: SeSystemtimePrivilege	3488	Krotten.exe
Token: SeDebugPrivilege	3452	InfinityCrypt.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

firefox.exeDeriaLock.exeSearchHost.exe

pid	process
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
1348	DeriaLock.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
1752	SearchHost.exe
1752	SearchHost.exe
1752	SearchHost.exe
1752	SearchHost.exe
1752	SearchHost.exe
1752	SearchHost.exe
1752	SearchHost.exe
1752	SearchHost.exe
1752	SearchHost.exe
1752	SearchHost.exe
1752	SearchHost.exe
1752	SearchHost.exe
1752	SearchHost.exe
1752	SearchHost.exe
1752	SearchHost.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

2360 firefox.exe
2360 firefox.exe
2360 firefox.exe

Suspicious use of SetWindowsHookEx 31 IoCs

Processes:

firefox.exemssql.exemssql2.exeSearchHost.exe

pid	process
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
1844	mssql.exe
2912	mssql2.exe
1752	SearchHost.exe
1844	mssql.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe
2360	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 2316 wrote to memory of 2360	2316	firefox.exe	firefox.exe
PID 2316 wrote to memory of 2360	2316	firefox.exe	firefox.exe
PID 2316 wrote to memory of 2360	2316	firefox.exe	firefox.exe
PID 2316 wrote to memory of 2360	2316	firefox.exe	firefox.exe
PID 2316 wrote to memory of 2360	2316	firefox.exe	firefox.exe
PID 2316 wrote to memory of 2360	2316	firefox.exe	firefox.exe
PID 2316 wrote to memory of 2360	2316	firefox.exe	firefox.exe
PID 2316 wrote to memory of 2360	2316	firefox.exe	firefox.exe
PID 2316 wrote to memory of 2360	2316	firefox.exe	firefox.exe
PID 2316 wrote to memory of 2360	2316	firefox.exe	firefox.exe
PID 2316 wrote to memory of 2360	2316	firefox.exe	firefox.exe
PID 2316 wrote to memory of 2360	2316	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2656	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2656	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2656	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 2700	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 3012	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 3012	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 3012	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 3012	2360	firefox.exe	firefox.exe
PID 2360 wrote to memory of 3012	2360	firefox.exe	firefox.exe

System policy modification 1 TTPs 64 IoCs

evasion

Modify Registry

T1112

Processes:

Krotten.exeKrotten.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuPinnedList = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetHood = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoManageMyComputerVerb = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPrinters = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{450D8FBA-AD25-11D0-98A8-0800361B1103} = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Uninstall\NoAddRemovePrograms = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktop = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuPinnedList = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMMyDocs = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPrinterTabs = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "1044"	Krotten.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPrinterTabs = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMyMusic = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSaveSettings = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D} = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuSubFolders = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewOnDrive = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoThemesTab = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoUserNameInStartMenu = "1"	Krotten.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum	Krotten.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Uninstall	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPrinters = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsMenu = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMMyPictures = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktop = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "1044"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogOff = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSaveSettings = "1"	Krotten.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMFUprogramsList = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFavoritesMenu = "1"	Krotten.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMyMusic = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Uninstall\NoAddRemovePrograms = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetHood = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{450D8FBA-AD25-11D0-98A8-0800361B1103} = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoThemesTab = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoUserNameInStartMenu = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFavoritesMenu = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMFUprogramsList = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	Krotten.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMMyPictures = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D} = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL = "1"	Krotten.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Krotten.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/Da2dalus/The-MALWARE-Repo/"
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/Da2dalus/The-MALWARE-Repo/
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2360.0.629571185\233055388" -parentBuildID 20221007134813 -prefsHandle 1284 -prefMapHandle 1276 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c5faf4d-72ba-4b7e-bd00-3375f8b0c5a6} 2360 "\\.\pipe\gecko-crash-server-pipe.2360" 1356 102d9458 gpu
    3⤵
    PID:2656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2360.1.931207713\1575517763" -parentBuildID 20221007134813 -prefsHandle 1560 -prefMapHandle 1556 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e075778-efdc-488d-aa3f-440b46df1f5e} 2360 "\\.\pipe\gecko-crash-server-pipe.2360" 1572 42eca58 socket
    3⤵
    PID:2700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2360.2.1183534743\1597447325" -childID 1 -isForBrowser -prefsHandle 2236 -prefMapHandle 2232 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 588 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e981935-b8ca-4f67-8d3d-1e1a43c37e17} 2360 "\\.\pipe\gecko-crash-server-pipe.2360" 2248 19ac4158 tab
    3⤵
    PID:3012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2360.3.639909756\321941235" -childID 2 -isForBrowser -prefsHandle 768 -prefMapHandle 528 -prefsLen 26151 -prefMapSize 233444 -jsInitHandle 588 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c243dde6-180d-4df2-a6d6-7323d9aa28f4} 2360 "\\.\pipe\gecko-crash-server-pipe.2360" 2624 e6be58 tab
    3⤵
    PID:300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2360.4.530423818\1369383420" -childID 3 -isForBrowser -prefsHandle 3800 -prefMapHandle 3612 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 588 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {141ddf36-f2a5-4661-b861-9d198adc041c} 2360 "\\.\pipe\gecko-crash-server-pipe.2360" 3796 1ea7dd58 tab
    3⤵
    PID:996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2360.5.2015542301\1771925969" -childID 4 -isForBrowser -prefsHandle 3904 -prefMapHandle 3908 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 588 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {908ee0aa-c75c-4073-9eef-4673ec0eeb0c} 2360 "\\.\pipe\gecko-crash-server-pipe.2360" 3892 1ea7e058 tab
    3⤵
    PID:2924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2360.6.1335714367\1608684454" -childID 5 -isForBrowser -prefsHandle 4072 -prefMapHandle 4076 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 588 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1aa0dbbd-a3c2-4179-b056-0caf949e463d} 2360 "\\.\pipe\gecko-crash-server-pipe.2360" 4064 20ec6258 tab
    3⤵
    PID:872
- - C:\Users\Admin\Downloads\DeriaLock.exe
    "C:\Users\Admin\Downloads\DeriaLock.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1348
- - C:\Users\Admin\Downloads\Dharma.exe
    "C:\Users\Admin\Downloads\Dharma.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1536
  - - C:\Users\Admin\Downloads\ac\nc123.exe
      "C:\Users\Admin\Downloads\ac\nc123.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1836
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        
        PID:1132
  - - C:\Users\Admin\Downloads\ac\mssql.exe
      "C:\Users\Admin\Downloads\ac\mssql.exe"
      4⤵
      Sets service image path in registry
      Executes dropped EXE
      Impair Defenses: Safe Mode Boot
      Suspicious behavior: LoadsDriver
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1844
  - - C:\Users\Admin\Downloads\ac\mssql2.exe
      "C:\Users\Admin\Downloads\ac\mssql2.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2912
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\Downloads\ac\Shadow.bat" "
      4⤵
      PID:288
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\Downloads\ac\systembackup.bat" "
      4⤵
      PID:1304
  - - C:\Users\Admin\Downloads\ac\EVER\SearchHost.exe
      "C:\Users\Admin\Downloads\ac\EVER\SearchHost.exe"
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1752
- - C:\Users\Admin\Downloads\Fantom.exe
    "C:\Users\Admin\Downloads\Fantom.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1304
  - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      4⤵
      Executes dropped EXE
      PID:1220
- - C:\Users\Admin\Downloads\GandCrab.exe
    "C:\Users\Admin\Downloads\GandCrab.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:3512
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
      4⤵
      System Location Discovery: System Language Discovery
      PID:1828
- - C:\Users\Admin\Downloads\InfinityCrypt.exe
    "C:\Users\Admin\Downloads\InfinityCrypt.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:3452
- - C:\Users\Admin\Downloads\Krotten.exe
    "C:\Users\Admin\Downloads\Krotten.exe"
    3⤵
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies WinLogon
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:3280
- - C:\Users\Admin\Downloads\Krotten.exe
    "C:\Users\Admin\Downloads\Krotten.exe"
    3⤵
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies WinLogon
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:3488

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1896

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
1⤵
PID:1848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\BEGIAXZBR-MANUAL.txt

Filesize
8KB

MD5
7289c49071bb1e5202556dd8a4573366

SHA1
74cc9d4f56571abae51d97e5f0de3eb0ccabea32

SHA256
d55e2f872e7b99b6c331abe681787472afce0315a4b8007c158edaba9bb2e958

SHA512
b0a35aa783f1ade381496255c6c4cb6fd257bf20e10a9223ccb6ca06d44606328f709feed3495a921ca0c5db4604a6a76ab9f20666efb48dbfc6345261a8b929

Download Submit
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\BEGIAXZBR-MANUAL.txt.326FC98C8FE7007EDFBA2F85DD2BBDDCB9B278551CC84ADD120B80DC8A4808DB

Filesize
8KB

MD5
f73c300d9e03af5015f00f9821f904fe

SHA1
6d0936c2d0dc6bac84dc590448465578a31c2280

SHA256
33586c2e67f2a4712f0bab5c757e13ff2595ef366bbe8f1f002d83494091c3b0

SHA512
dd8642b339604d39e475baa8a9c57ed1c7ee65f34ba98f2e4254253896a4d2431b30baa0a3fa9aa6e4e2f58616910e36477169a8f2e6dd21d124cb42b79a4cfd

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
160B

MD5
da6928fdb74239260389ce0f73e7d103

SHA1
59a6367ec41fdb36d2bdf640aefe2dd69e704e3f

SHA256
d19485514d17e625c451e59355f81b55ff2e41055ba14d5a2aa8bd5b33a22826

SHA512
508bf15b71e1f1cb787f6c730c7211e201ef80e55dae5727adfe5b9ff97540bb5892a6c58ec10948afad847abf202d6eea6c82fa6fd6545856690948ad0892a5

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
c25b4f8dbf973a9ed306d37898d2b2ae

SHA1
0d33d1fbf93b9b011f166c4c74c292fe0dd92627

SHA256
957372285ed1b75d82310ff2afc82266d21c5f1c6bcb2cac4526b23267c0d956

SHA512
d270080b8bd21e2bb1e7a69d081688b4cd9d829c6459e870a0a15ef4ae47d1a7e3c53f29ccbd3038d574eb84bb106dbb4e268f08e5f581fc027f2bae03c04ee6

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
bff37a26ad646e766c78dfa71f210980

SHA1
080541fd554a7d8f7d311d6bc1949601a248710a

SHA256
d65ad7200ea3c63c366da7553b093534dd3812ff0de9c84caaa94799f34d9f59

SHA512
93fee9ba28d48763caf53c8f62dc71df1b8a7e64bab1da7d1c5f2a36e74d6a627039ba943f9967bc2e43001ea5922824a5d77698dd71908cb3c2607574afee19

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
013c5332445a6dd7fed37a28a3518b05

SHA1
f3e3609ac20585883bba35c13c208cefe519ed8d

SHA256
3351efb2133d9676e5df791fa0f2d4fa15337b85f9c7f8a038fa7e87c3ae37fd

SHA512
313fcc6ee00e8a47a027ebc17a6b8a1d00817ac1249acd9dee288337de88523e2324235adc30fdefad3562a477302a782d6b1b6f646bfe6b64fb7a2aa2e750fc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\activity-stream.discovery_stream.json.tmp

Filesize
35KB

MD5
4d897f484bcc3d4dab17deeacaa01e30

SHA1
f5a99a41520edb5b07869f64aeaa724f1ec56959

SHA256
70c492efd7c5ccc1c06f31cc1185f3b57321389d63744a6e37703d158a57fdfb

SHA512
71c08e6b4c07274d0bf571fd2f677f3081c9746e5ed1aef98fdaf51b63f3fff4fc9f2ccfff4db96d5a415e7977f64a64a67acea858df1a6aad91601d826d2486

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\cache2\entries\79679B23E6BBEB689E1C79E27C32C20C5EC9DF47

Filesize
22KB

MD5
208530ae6deea07235d81b8d803e827e

SHA1
3c05e5e1e3c54d77d2b8924248477f374fbd1715

SHA256
a0624b3868ed205b0c514df105718db5f2531b84101e06faa03a46d47814d53c

SHA512
e959cde07ad73913a652d600d7f965998ca1a694aad6135ccbfe575883c58bfe6723b8edf63a9c5ec288bbce87a4c4673d1a7bfe6e52d084f7eb0d87fd1eb9e3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\jumpListCache\jOOLs1xEBRP5TbBqGX_21g==.ico

Filesize
25KB

MD5
6b120367fa9e50d6f91f30601ee58bb3

SHA1
9a32726e2496f78ef54f91954836b31b9a0faa50

SHA256
92c62d192e956e966fd01a0c1f721d241b9b6f256b308a2be06187a7b925f9e0

SHA512
c8d55a2c10a2ef484dedded911b8f3c2f5ecb996be6f6f425c5bd4b4f53eb620a2baccd48bac1915a81da9a792971d95ff36c3f216075d93e5fd7a462ecd784f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\addonStartup.json.lz4

Filesize
5KB

MD5
35860b7440797fdf92b6b343858fae39

SHA1
62c24f43eedf6e71b226f0159dbbfeecc152f47f

SHA256
fa8d0fffa1b53a2ef40a65da9e28fe04dd91f053f4784f542714e60b4290f498

SHA512
5ae3d1a8279ae0fdf7954c3cf2279ea9c525e36547c4ed92049f741be6bd46bfef82b40763c7d01e0620dcf356fc9fc45b12be4dce319d4d9b354f6fa15d1a69

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\crashes\store.json.mozlz4

Filesize
66B

MD5
a6338865eb252d0ef8fcf11fa9af3f0d

SHA1
cecdd4c4dcae10c2ffc8eb938121b6231de48cd3

SHA256
078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965

SHA512
d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
5408d669dec5f18b1e8c342767cc9495

SHA1
5d2b10dce205d237434e582451cf26330ea0596d

SHA256
25de750f6f0e3b9fc4e759c2be732bca79c4c4757030eaf13b46ad5bb8968c4b

SHA512
6260addd5064a40a95a8c63e12088b8ac55964c6934d6fb4fcd1ec30de86bb38b02a7505b5b5ce82772f196ce7309c956a2b4b89f7d0ab718822ee155671986c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\pending_pings\60a2615d-72e7-4fef-b16b-c030c52aeb0c

Filesize
11KB

MD5
78094de2a275bc4660790a12711e79cb

SHA1
0e383da75c3ce9dd4ff81c0e7f3b68cfdb9943a1

SHA256
b4cad6ac99b67d01af02b52b3426b4eb00b19b07c307630ffd074b6916e93ac3

SHA512
749159888f04b0e6658b92de38ee59f7a67551c3b4e780aab0a9a03b1ff45412fbdc7abf29e6b36cb4facafc7a4e6f9ab49b86429d69fdf6aadfb5800ecaff7f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\pending_pings\86c9c3a2-f4d6-40a1-bd5b-bc47d0b2eace

Filesize
745B

MD5
8a4ce02e3844d1ab6447f921aed9158d

SHA1
208e843a3da3e35ad8746726258bc5eacf4ad37d

SHA256
cfe787e230d9e679583c078d8bfb938a9f52e41f8bab5ad059b35b7cd69d9d76

SHA512
40b64b17f5e373ca80cdc43dd40bd96b0fadd6db844d1820f98c8097951693e2af5f267104565930a29c6c5ece5c3bc6d65f7f09c3679a0f3f52e27147eddc6a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs.js

Filesize
6KB

MD5
35b507245227141107bbc48aa5b2b6bb

SHA1
5977537f0c37345342bf1fa21993e2b18da30adf

SHA256
7d73ec5578cec914c53263240a2aa13cc69eccd2072f319cc2044e356a1559c1

SHA512
1f355d6ef31dafcc36ff3cb6afa3d3789b866e362d9fa94cfad918baa927da3f814748e9518ba30920c5e75d0f1f1827b82c8f0e1fbab286620647205af70012

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs.js

Filesize
6KB

MD5
f68425192143c2d58c9a4a9e4629d957

SHA1
888307c4636e37b257a1ae8c4185c6eec5803baa

SHA256
23e084c718d3f3232ff5f7aff6c1a904efb8407433f98476dd82e16e97c98c7a

SHA512
dd468367cfbbc792730e4a955a79bcabbb18d6c6d4550d50d1d1f1036e70cdeb6c20bfa8e5a955769d93d85b2ec1be04335697cf9fbe0aed5234f514c773212d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs.js

Filesize
6KB

MD5
ecaa5d57ded9ce31ed796e0559bca208

SHA1
322a5d28612288629a58a5a31ca88de9afc84462

SHA256
a007487379790ddba33fca5a1ed2013ec00fc574b36995ef869ec66e674725a6

SHA512
36afa8a8ac0a781be38d0ad76b1e5e4ece86056eb0b6a5598cf6124e84492c40211f7d0a6953e2afd2c42210e24faa9907cb277121751deafa0ec192f12c4f3d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
c31e2b56bb3ec91b1930f156cffa0eaf

SHA1
286b7141619a389811f0835c9afe849d194940a8

SHA256
c1ac15b7395a24b5b2c107215c193c62997fcdd763152ff352ac8e89091b0a05

SHA512
9738af34b65f1d2d37d522bef1580c266532a9ef2f2bb5f4cb30fd90bace4e3c1cc3aa73334a8973ca077896d4483ab0e7b603ef0c8fdeafdc4d96b0c14c5121

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
e55266cdafbc2c0bcff179c82b52029e

SHA1
01f872346c07eba182468bca520aff06ca31e744

SHA256
8ca4ccb15e8a7822f540157e2aaa10eae4539fd5187c866dbd9b762010c6b43c

SHA512
66e3d4731e7eb01eafbfd272b7dd89352dabb8e3391c7e1a7fa2d63aa3852f83fb31fc3f054426c4fa67d0be2c97ab98b57d648a615bc51b2f79a9ca7af96d74

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
bb5c7401fd86d778b62ad43691ac8925

SHA1
d7e49f6045dbffda6325535c1cdf9b093e5492a2

SHA256
1c83d56fca28cb093aa5fa0163649da8c61b9a1ec932cfac2298c61ddd3cdc5c

SHA512
fcb7b11813e14ad86053314d5f3c3ec7b0320034bba30e244a054a73231968b9d8d2ac15b2d6d967df2e03730770b5c9bf950df84dfcf01801f96c72ced67823

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
612acc7e009893640795ddf27af41c01

SHA1
18bb4916bf7d4f022a8de6337af9b64a491397d5

SHA256
3f75d2b3ddd78031a01f216e0ebf176285e8c79e988804e2b85996d9756f3a85

SHA512
60160926e3edbebcdb0c14101924e31b7bbde838d3e529386f2aa5fb26689763403ee1a592decb76274d4b75bfcad01c818170ed58f689bdda833a846c9d4a2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
67df51dbbdd698d6dc03c855f7c02072

SHA1
b46ef9effa3ecd02a703fa35bd00b346dab3b1dc

SHA256
5bcf2393e19ed3a1a048ab84fa888eadcf3ecae7af68628c9b31f3090cb5be54

SHA512
f4a692cc462fae9ee46d14c325db8de70cfe2a4b12a37dd29151180b794890fb65e5b8655db65c1b273904a5a9f73779a1e461ec18298dd7d0717133a1d23153

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
35bc6424ca1a3b72a35adbcfd5c3d26c

SHA1
6919049e34216eee4aff2e2423fa803c9757a499

SHA256
8a2c99117b616f424e66b37a275e7387746ad3ad9eed927343659e2962028553

SHA512
762d69dc9d8a2fe74164f947827c0ebffcc00d9762351a3a18d5f1c1012f036737be18b13a909a45dbb92df0fccdbe6ee8fae2174bb45bb980596fb92555f444

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
3fab3bc836c2a3dd7fec63b9098a3633

SHA1
cb5cbe6cf2f89cee27e28e31befaa76d4a505c1e

SHA256
501b39bd94cd7ca6fe4a13ee14ed049afdb19e5cee1cbf54683ad77c7222b46b

SHA512
71830bb42114db2d90e98676c26cab413ed23eb600c390fc89b5b11b9cb0b16dc461a9eeb6d839f182ffb72342f1fba3a89dfee632a52268b38a550d13d07762

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\storage\default\https+++github.com\.metadata-v2

Filesize
58B

MD5
82a79eea9a380278a698ce117e97c507

SHA1
6d444aeab768def65d69554119597cf1c499a50f

SHA256
7abb6556a205dbc26bdb54278aeeacdae2f154a3fc2ea0539f3fd39db8d82243

SHA512
874114eb6ce0ed6333f3a1e1e3b10de83a477c432fbbf53940420058dd849bb7467df4f33ceed962992f059da1bcbdf02f1a9165351eda4dbb7c3a6be40bfd42

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\storage\default\https+++github.com\ls\usage

Filesize
12B

MD5
543ff8ef93665adb64cc8223d4cc464d

SHA1
6a646c80279a67851c22366881300a0735440194

SHA256
5963bd568b931132dcadf5ef2d45b2692d926f4bbd6f0361961cbf4befee2c2a

SHA512
b023574ce77dbcc7012004e2ac1f5b7740a3f13dde73ee5b352a436cffe8c6c7ec1682c701bd790d1bae688b461b293e47d221ad3ebf0b4fb84fd23fd5f6efdd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
192KB

MD5
f0ef0abdae95203dd8137af8232249ad

SHA1
276533e391fc08e69538c2ee74f0fe3a7b1b0928

SHA256
5217aae810382ff67a4a239d51352f431d9db4b1b7f100a1b1af64598f608f84

SHA512
06b943f0641aa598b282c034e1baffa6d42a0764a34516f91fa924b557866050aea68e3271cb8b6b9b135e0ac0a6e64d9449d1900928c571506059f29f5d963b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\targeting.snapshot.json

Filesize
4KB

MD5
bff55875de6916f403899245ffd2907c

SHA1
5946ad0944fb27b65b5de7daa4373acc0da0467c

SHA256
81318c51ec7938cd83a2e54cfd04022e425b8e51ada11505615a5a5dc99ef402

SHA512
4b94060232950260da4b54a8da2e7927afa030ada320d4ebfd5167092d49f17cd581f513f23bd58826ccb4b21c6ddeccdac6370f9678566167ec2771ffef6e9f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\xulstore.json

Filesize
141B

MD5
8c8e29dfc7492b92903124e1da454a88

SHA1
09e1ea8b5a53255747809121543598e55e38f9ba

SHA256
08e5486c5550ae2844b9569fbe77ca63617c48b2918e8427ba729deba24a2cbb

SHA512
bb1b2cab79ab3a1e467094748fa6879ec325c21da733255428d2b661c02255dcd3036a3706afeb4f576c168127b4a537802f5748950a3db8fb0c04f4827f903f

Download Submit
C:\Users\Admin\Desktop\AddGroup.mp4.deria

Filesize
596KB

MD5
16a133826dcd122efd7e62dd152501d0

SHA1
c2686b56c61efbe6b0f22b721ff69605aa1b5d0f

SHA256
1d27d16dbca7fbad4c24a627e7561e86ce33a54d241bfef711dcb07535ffce58

SHA512
050ff41ce0411495e624d13ad72a4645dc54599249557d1b3cd19456fff6dc06d8d351ee5b4922f179acda8c658b631fd5b0081fd8eb3d44f3826a1a0857636f

Download Submit
C:\Users\Admin\Desktop\AssertExpand.css.deria

Filesize
332KB

MD5
7bdde830b5cc6ee78c906a861b275fb1

SHA1
d2f9305da19a4400181d2e0f9b1ee14b7b10746a

SHA256
f29be1c11154be23109a90bbd83f0198858e0b042580e5fcb055bc30db5bdbfe

SHA512
1a64f3e0cc18b9269261dc2c3f95da855978e8b1557a042f792fd5e80ab9b1ef5ad5f50885238a91e9eafe730bb4eb667857bb9c5aecfe39ff10b54ae91a253c

Download Submit
C:\Users\Admin\Desktop\ClearCheckpoint.cr2.deria

Filesize
264KB

MD5
b305467dbe34bcf3243ab0608480cfa1

SHA1
280b30ad3facbf85c254b13332ee2d329f2daeee

SHA256
267c3b46b220023a2fbf49179d2f427586ebdb00fe18248fd7f26b42290ea035

SHA512
93140bff10b103db550134a2a6f8cf46889d8171b7ed6d8fe593c72ba431bacfc2ef4470da20dcb0e2c0493d6a9c695aa3dcb521248b5e22444b85a327f8410a

Download Submit
C:\Users\Admin\Desktop\ClearRestore.mpeg3.deria

Filesize
230KB

MD5
831ec248a45f6b34529a25b555aebf44

SHA1
ac46f24120b7df2c8ed8bd099b6eec7be52428df

SHA256
d715e0a824b3c4820f9c26ea39921ba484d4d22d9efe3f55c1615e6470f12041

SHA512
617fe5175b638fa69f6c2b086d3345f39bda022ccadfcf2c045c92fc4f03689cb358705cea6ad3609878dbdd74d361b84ff792f0a0e19ed50b00ef30a57209b2

Download Submit
C:\Users\Admin\Desktop\CloseMeasure.ADT.deria

Filesize
275KB

MD5
ec4071b03bd28798c58f5fac3247615e

SHA1
8566cc8cd5dae075751da04f1abd1e78962ed2dd

SHA256
464109c6e46a2017e6c5319b9e479c816fd739250dc7fb721ea32c9cbb0909b7

SHA512
eab33fb0cc34fb63f7f46cff14f55343636009d19abdcc7dc0a8e11fea4ec3c3f9fa1931f7d1c4c8e0888b6400e276f5cb62387e13d8b99019dd8794c479235a

Download Submit
C:\Users\Admin\Desktop\CompleteFormat.mid.deria

Filesize
242KB

MD5
c7f77cd3f838c00670c4f6d2a95beaa6

SHA1
ae1c52112d52aeed5f677d7e87989a8108240d83

SHA256
73e7f7ae96de855c1835363e5abf124387aea11784f3f4252cc3ef6bc8a4823d

SHA512
f75d998897eba8adbc0cebc4fcdb2fa6037941d4dc0323e67843867ca37a7da3e9e0c25811bc0c2da20d513ed026aeb4a0428475ae1df221aae9eaefbeb8a8d3

Download Submit
C:\Users\Admin\Desktop\ConvertFromExport.vssm.deria

Filesize
399KB

MD5
583f700166257f5472161d611cbba35c

SHA1
4e8818e136bb136cba4c733e919b36743e0d4787

SHA256
0c90f44e376cd991c48d3dabc94fbc0d5c43f991ef936aa7ac0c251526a5bb2f

SHA512
cd0dc4cc2d9fca7877939fcb61930d0de4382fb584f2d769da5e956e06fa237dba127242864616c1aa7ded582d767d0892a4a98914f394e27a01f3531767797a

Download Submit
C:\Users\Admin\Desktop\DisableProtect.cab.deria

Filesize
433KB

MD5
f044fcae3ea20fb71e0c76905e8c4e77

SHA1
a3daec27f45603568ccc569f8c357b6b93789e04

SHA256
eec7511181dca06c416f0460158920a1faa4e60b11496717a3d77efc56c8e7bb

SHA512
508373452bb940834377d7240cfe648ec7535612d6015c4c414fa4b560ac05ece637212def1a3869f7c514968ecd19ecb4f7538ce632ec70bf0446459b1a324d

Download Submit
C:\Users\Admin\Desktop\DisconnectWait.bmp.deria

Filesize
388KB

MD5
82bc4c894d6a1e52d1c4541c09ca8628

SHA1
4671e3778b768f7605a9356db0f78e551c9f3984

SHA256
efcdea08375d34574268db5762341bebe054af88db3096437dc07a4c18beae53

SHA512
4cbb35360172588020f79c3d9d7ee548aa5fbc6ff1c467d3e7c606d2dd526bb14c4386167eb99b133ce6533febd43135ffaab8d4ca8ed5466eae39550aa9b623

Download Submit
C:\Users\Admin\Desktop\ExitGrant.svgz.deria

Filesize
185KB

MD5
4dd5a0f3b04ff870a2e757a1e0c7d53a

SHA1
62aeabd419f6dbc906f284d9ca5360eaf115dacd

SHA256
f077bdd749f7a5b5764cb3a93ced33562e26af38fc4e156a7c6dbf345261fe63

SHA512
b8bfeae0f6c51072d94e41b24dd1b560332bcaa13f43ec2040a2190b797e9174224c777849bae404fa1f8e20e521d095facbdfe57801766e52584cd931293734

Download Submit
C:\Users\Admin\Desktop\FindRepair.vsdm.deria

Filesize
152KB

MD5
9ee97be25a991d27d27c697712fd3b82

SHA1
a4723a7aab6e086b50c28ffa24fec839e4df2296

SHA256
c653673700d19f92433c6d040b73fdb1721b9710485f1ab3c12e3b7a325c8d19

SHA512
f59e08e64b782eeee0fc73960ce95bf67f561a5494f73db0aad4158fa0dcbbd1823ccfa7aa3149bde88cb12f681b79537025d5da3844bfcd1adf4465bcd0d4f9

Download Submit
C:\Users\Admin\Desktop\HideClose.cr2.deria

Filesize
320KB

MD5
bf0c240d6f06663b1a6d42f5ac4fdc01

SHA1
c0887a77707d1c0cf548e86099a76e8ec350a8b5

SHA256
eb744d1dbb68f09dc53f7f3b6aa04e261db352e89ac75a417277556b4713dd3f

SHA512
ff7050b8601e1e40cc9b1c05d9f8a09497e338533706cb8eb4a1a3f8e8d1777f79392c8c7b6dc26a98fdacc6c1896914c5fcd15602a381daa2c8a31e7ee61713

Download Submit
C:\Users\Admin\Desktop\InitializeAssert.pps.deria

Filesize
354KB

MD5
f65326e38edf0edd819c895799b8484e

SHA1
b0f9e0d4edab1e33308b8995dd0ec250f58bcbee

SHA256
d49f12c3294611d733e194603b480f63ad067940b1ab568f836f4e9dbaf9d6bb

SHA512
7feef3666304d623bd3704b530ddf12293569a9a9f9f0345bd746af6e5385a8021f58d7c24cc616b01edad904cacceb0244a55358fa6c148fe2dc3abc5a82bd9

Download Submit
C:\Users\Admin\Desktop\InitializeResolve.mhtml.deria

Filesize
163KB

MD5
2ca248b7ba7a0155cf81ae9dd08b2472

SHA1
b5a4245abd7fdca9a46bb0a01193c76949e7303d

SHA256
93ce682d94b3e0a214ff629fb3ef494e41ef7e77397fbab4cf4ff3c8633d08ed

SHA512
70b6d78aefce55d8b9075da90aa62ed7adca78813a071ed3e0b89638bbd3175138a8cb959587b649a5b89bb57075b51360a869b093e0a04245946ee2e8596190

Download Submit
C:\Users\Admin\Desktop\JoinAssert.xlsx.deria

Filesize
11KB

MD5
caae146badcdae30ae2cab0a8bbb21d0

SHA1
b40f6a6cdd45d83e86a6c45c5583225716be84f6

SHA256
8041c8f61c94953d56c50fd64f2229630d9365015e220c58e32caff00bfb3cd2

SHA512
972876b792836f28de006d3d3f3d709017ff789a167dfbe3d1e535cd00ccbef19ae0157e45cb238685296567a886accb374095a4bb7d760f36a10ac248565999

Download Submit
C:\Users\Admin\Desktop\JoinRestart.nfo.deria

Filesize
421KB

MD5
354354c99ee0ac37994fbd3237a5af93

SHA1
603a1c4d33c1c7f58f84c294d1da285b4d05ae4a

SHA256
024981f9cf1318b9bacaf244cfa3c269384d00a3688320591eda21afe856b3e4

SHA512
9ff3732b58a355f27dd72b9e83c85edb2ee24dee4d2cdaffe308763ced71c6dda66c2948ff529cd73d284d46ada51438395b2cf8a2f1748421e9e2440fb91d5b

Download Submit
C:\Users\Admin\Desktop\JoinSwitch.xlsx.deria

Filesize
14KB

MD5
42ade5b2b12e04849bde59a366affb81

SHA1
cd355c74f151d253f1a0c1521457be18588dcaa9

SHA256
9ee77414d32f95c2688fa63c570457cc2cc0ed3e248f10610d579f62f9a578f0

SHA512
8330043100af4492e7499cc90e02e5f3de0b40c226483dcce25af51d48b39ac0e49cfefea0f15ceb1e1cd817db22c38ec9c6dc2684356c09f2ccbc9bf9861a90

Download Submit
C:\Users\Admin\Desktop\ProtectOpen.jpeg.deria

Filesize
309KB

MD5
de614b5e62c1c01eb9077014c5902557

SHA1
7a7c1dcc3dbcefc17894d3ab007d437bf97c0453

SHA256
fc247d47909bd54250114b8e429c3aa5ed3294769301408e51ce6228eb2beeb8

SHA512
538ecb324664f6503e9bcac38fcd50de7d199a0a30385f894ea2f33c20726ab297c9030c57b3fbfa5cb4e613e4f9a8859dfba2209ed0d7ca33ae3580e0b9ed36

Download Submit
C:\Users\Admin\Desktop\ReceiveExpand.avi.deria

Filesize
253KB

MD5
feb68c10e58e1f2fda4329603b7f6b38

SHA1
4f1307c8b5a4102ea1d8ee77e0d7b89b6562d168

SHA256
f6e0272b859f0f0490497f292d07bb3214fdf9d6f31b517289602843e8d9be51

SHA512
8f0ff498240cf5d4bd9667d9ea142429f542cdc3c624eec195c0dccd6e6077145b25e3bf0a7892999b2ca57ef3e47ad0f25d3e728400e20854dc9e9ceb97751f

Download Submit
C:\Users\Admin\Desktop\RemoveSet.mp2v.deria

Filesize
365KB

MD5
0d1c81ac86f8b41525af10a7482e6dc6

SHA1
d8069f5b0bbd903c3f1b4610200a8681a21fb18a

SHA256
1c2571eab33d4f42db6c2b548c281714532ae1c5de052a7ba4872145b53068bf

SHA512
d9c6ff20310f6db627011b0384d2b249600c806f25cc68e4ea5f399b92e4643bcede35af78aa4e4e43fff16907deb1444791c56154f2f8cf52a2ee10c594b09d

Download Submit
C:\Users\Admin\Desktop\ResetCopy.mpeg.deria

Filesize
343KB

MD5
2a24cc8190811f16931365cbd9bf1b8c

SHA1
7c9c149b66c440d265a59ec6c82e12c467166dd1

SHA256
0840d7990d568c02ebc4f234299543d7476d1be2049051e37c767e4676ba05dd

SHA512
5249436e085c6a867a5579ba6680bac3c5458a124ad0a1b4dc32831690b322149448b24680259b881275fd35d04da17a141e4747eb40870a297ae4609792e73e

Download Submit
C:\Users\Admin\Desktop\RestoreExpand.fon.deria

Filesize
410KB

MD5
7e5e16952e008de3bfbfd27f97ed0199

SHA1
23c903daad53d804005dc7de8f4c6975006409f3

SHA256
eab03b903d681ec39036791ff68f252648371aabd9d078c580b95231af216563

SHA512
d6940745a4b80601e932f521149f27043d1a8bfc064fe0385185d4e2f88a5680c2c675b85a24c8813f19c997db968701de410d7596c1d1b839f4f1687cc7227f

Download Submit
C:\Users\Admin\Desktop\RevokeHide.vsx.deria

Filesize
174KB

MD5
db8886197ea87490779d9569a28620ec

SHA1
75b032dbec05a45fa632caa171c24cfb35dd9678

SHA256
4058f1c8f04c960b46da476a497c529eef76b55a8c0281f4459af0eb9d8159f4

SHA512
da7f45b7c511e28edfc868742af80ea23ce74774f8ea3a902449d17177d4d66d262f0a2180efba1ac8b839dffe1a7fd6a3ce2509eb5e1a70bcb772635ebbf705

Download Submit
C:\Users\Admin\Desktop\SendImport.docx.deria

Filesize
16KB

MD5
ac7b2ecdf03c77ac49591f01e8266007

SHA1
f83d4e5d0124c5cc4a5acb787f64b18a8ff1caab

SHA256
b3dad288fc847b7e4962afb63867f0891a2b14cec06ef9e952cb80df0e2a1461

SHA512
71e823481619e16e6cd70890f0e5b85ac0fddee9aa081eff7397804fe00996c50b7b7bbc9637092ae66f98b725ec9c28c98928dce5474b209200c7bbeb6ce550

Download Submit
C:\Users\Admin\Desktop\desktop.ini.deria

Filesize
828B

MD5
d75037d2621ed2d8ac22c94b610eb840

SHA1
48f4af97963d6212d64a4e24d6547e488efd1f11

SHA256
cc93dc50106f7c4ce2dd2741afbed113331060a32efb78c73a450cbd7c53784d

SHA512
03da1835ecb4d7c4fad683b4ce84fe3d7a7b598e6910896c6d1594fa651524bc70de7093da4b0389593dd6c64e415b9f4e2d4539bb8a612f1a43b8a5e4aca8f0

Download Submit
C:\Users\Admin\Downloads\DeriaLock.9qttsQLd.exe.part

Filesize
20KB

MD5
49e5f0da77fc9ce4855ee594bbc45c06

SHA1
cdf30f2e117ddb1b237e9d9d4b50fb204437d378

SHA256
6d9ca844a3c075fd9a9535bcbe83f211c92f988b514af268d62566e870d1ae5e

SHA512
5a6a7c1d73327b9d4f4a038b4c7b00374d82b88e8ec959f780cad903c978a4ce43c4146aa890b19749761b78fddd256e3e62b096621ab166f52a782f96a433cb

Download Submit
C:\Users\Admin\Downloads\DeriaLock.exe

Filesize
484KB

MD5
0a7b70efba0aa93d4bc0857b87ac2fcb

SHA1
01a6c963b2f5f36ff21a1043587dcf921ae5f5cd

SHA256
4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309

SHA512
2033f9637b8d023242c93f54c140dd561592a3380a15a9fdc8ebfa33385ff4fc569d66c846a01b4ac005f0521b3c219e87f4b1ed2a83557f9d95fa066ad25e14

Download Submit
C:\Users\Admin\Downloads\Dharma.exe

Filesize
11.5MB

MD5
928e37519022745490d1af1ce6f336f7

SHA1
b7840242393013f2c4c136ac7407e332be075702

SHA256
6fb303dd8ba36381948127d44bd8541e4a1ab8af07b46526ace08458f2498850

SHA512
8040195ab2b2e15c9d5ffa13a47a61c709738d1cf5e2108e848fedf3408e5bad5f2fc5f523f170f6a80cb33a4f5612d3d60dd343d028e55cfc08cd2f6ed2947c

Download Submit
C:\Users\Admin\Downloads\Dharma.q7tFDNBz.exe.part

Filesize
260KB

MD5
280b6eb3d1cf5767753430dc61d4c0bc

SHA1
b4b7b106ba43ad171258a4768df5d5c41c5d9a70

SHA256
2f71465e3d1ec9d33c0aad755a628278f66875158c8a68c5e8eaeadb7ba26941

SHA512
cb7cc9bed4de1920fdcddd74329cc7d576ca19bc03811862c647544f3859841dfcfb901e1e6e8f7aea21f465593aedcffec3e0c9f3d1fbe4efc8dc5d1e91c743

Download Submit
C:\Users\Admin\Downloads\Fantom.FYtVE0cl.exe.part

Filesize
261KB

MD5
7d80230df68ccba871815d68f016c282

SHA1
e10874c6108a26ceedfc84f50881824462b5b6b6

SHA256
f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

SHA512
64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

Download Submit
C:\Users\Admin\Downloads\GandCrab.7yVnRREV.exe.part

Filesize
291KB

MD5
e6b43b1028b6000009253344632e69c4

SHA1
e536b70e3ffe309f7ae59918da471d7bf4cadd1c

SHA256
bfb9db791b8250ffa8ebc48295c5dbbca757a5ed3bbb01de12a871b5cd9afd5a

SHA512
07da214314673407a7d3978ee6e1d20bf1e02f135bf557e86b50489ecc146014f2534515c1b613dba96e65489d8c82caaa8ed2e647684d61e5e86bd3e8251adf

Download Submit
C:\Users\Admin\Downloads\InfinityCrypt.NtGhmCx5.exe.part

Filesize
211KB

MD5
b805db8f6a84475ef76b795b0d1ed6ae

SHA1
7711cb4873e58b7adcf2a2b047b090e78d10c75b

SHA256
f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf

SHA512
62a2c329b43d186c4c602c5f63efc8d2657aa956f21184334263e4f6d0204d7c31f86bda6e85e65e3b99b891c1630d805b70997731c174f6081ecc367ccf9416

Download Submit
C:\Users\Admin\Downloads\Krotten.exe

Filesize
53KB

MD5
87ccd6f4ec0e6b706d65550f90b0e3c7

SHA1
213e6624bff6064c016b9cdc15d5365823c01f5f

SHA256
e79f164ccc75a5d5c032b4c5a96d6ad7604faffb28afe77bc29b9173fa3543e4

SHA512
a72403d462e2e2e181dbdabfcc02889f001387943571391befed491aaecba830b0869bdd4d82bca137bd4061bbbfb692871b1b4622c4a7d9f16792c60999c990

Download Submit
C:\Users\Admin\Downloads\Locky.Azfje4uW.AZ.exe.part

Filesize
60KB

MD5
80494a53d13be8c5097c02aaec58b846

SHA1
b24fdbbb65bf4e24d495c16922e113c2b6959ca0

SHA256
01c2b936994277d7079ad8250c3ad8ea40807a0b872590adab6a9fd9061dc2d9

SHA512
df1d44a40b8d0691af7d97062eec2be1fa0360f336512d526c5288c0a00e40eabf92c2595d163be095fcbe0d9f6d47b03801e4c5dcd161678e667794b4ed9191

Download Submit
C:\Users\Admin\Downloads\NoMoreRansom.6-_2Izcc.exe.part

Filesize
271KB

MD5
e6a5783af9b7a38da5bf7faefaa5a4e6

SHA1
6f8731b9a39b35210d2d63b7faba848a6668f010

SHA256
7e49bf0d6ae3e93c5caf5b24a6f85d158ef3fa01c4ee83841835c92225d215d9

SHA512
d22080d1e345c6b24ac016c884be78f4785052010d789f25088eb87302d9e47fa4a91a3452680d730a81e1f4672419b7d5e8765958f1dd3d5c05b665efd96cce

Download Submit
C:\Users\Admin\Downloads\ac\EVER\Everything.ini

Filesize
19KB

MD5
5531bbb8be242dfc9950f2c2c8aa0058

SHA1
b08aadba390b98055c947dce8821e9e00b7d01ee

SHA256
4f03ab645fe48bf3783eb58568e89b3b3401956dd17cb8049444058dab0634d7

SHA512
3ce7e1d7b330cc9d75c3ce6d4531afe6bfa210a0bcbb45d4a7c29aabff79bebf3263fe0b5377956e2f88036b466383f001a7a6713da04a411b1aceb42bc38291

Download Submit
C:\Users\Admin\Downloads\ac\EVER\SearchHost.exe

Filesize
1.6MB

MD5
8add121fa398ebf83e8b5db8f17b45e0

SHA1
c8107e5c5e20349a39d32f424668139a36e6cfd0

SHA256
35c4a6c1474eb870eec901cef823cc4931919a4e963c432ce9efbb30c2d8a413

SHA512
8f81c4552ff561eea9802e5319adcd6c7e5bdd1dc4c91e56fda6bdc9b7e8167b222500a0aee5cf27b0345d1c19ac9fa95ae4fd58d4c359a5232bcf86f03d2273

Download Submit
C:\Users\Admin\Downloads\ac\Shadow.bat

Filesize
28B

MD5
df8394082a4e5b362bdcb17390f6676d

SHA1
5750248ff490ceec03d17ee9811ac70176f46614

SHA256
da3f155cfb98ce0add29a31162d23da7596da44ba2391389517fe1a2790da878

SHA512
8ce519dc5c2dd0bbb9f7f48bedf01362c56467800ac0029c8011ee5d9d19e3b3f2eff322e7306acf693e2edb9cf75caaf7b85eb8b2b6c3101ff7e1644950303d

Download Submit
C:\Users\Admin\Downloads\ac\mssql.exe

Filesize
10.2MB

MD5
f6a3d38aa0ae08c3294d6ed26266693f

SHA1
9ced15d08ffddb01db3912d8af14fb6cc91773f2

SHA256
c522e0b5332cac67cde8fc84080db3b8f2e0fe85f178d788e38b35bbe4d464ad

SHA512
814b1130a078dcb6ec59dbfe657724e36aa3db64ed9b2f93d8559b6a50e512365c8596240174141d6977b5ddcf7f281add7886c456dc7463c97f432507e73515

Download Submit
C:\Users\Admin\Downloads\ac\mssql2.exe

Filesize
6.7MB

MD5
f7d94750703f0c1ddd1edd36f6d0371d

SHA1
cc9b95e5952e1c870f7be55d3c77020e56c34b57

SHA256
659e441cadd42399fc286b92bbc456ff2e9ecb24984c0586acf83d73c772b45d

SHA512
af0ced00dc6eeaf6fb3336d9b3abcc199fb42561b8ce24ff2e6199966ad539bc2387ba83a4838301594e50e36844796e96c30a9aa9ad5f03cf06860f3f44e0fa

Download Submit
C:\Users\Admin\Downloads\ac\systembackup.bat

Filesize
1KB

MD5
b4b2f1a6c7a905781be7d877487fc665

SHA1
7ee27672d89940e96bcb7616560a4bef8d8af76c

SHA256
6246b0045ca11da483e38317421317dc22462a8d81e500dee909a5269c086b5f

SHA512
f883cea56a9ac5dcb838802753770494ce7b1de9d7da6a49b878d534810f9c87170f04e0b8b516ae19b9492f40635a72b3e8a4533d39312383c520abe00c5ae6

Download Submit
C:\Users\Admin\Downloads\ac\xglflzbxqiofai.sys

Filesize
674KB

MD5
b2233d1efb0b7a897ea477a66cd08227

SHA1
835a198a11c9d106fc6aabe26b9b3e59f6ec68fd

SHA256
5fd17e3b8827b5bb515343bc4066be0814f6466fb4294501becac284a378c0da

SHA512
6ca61854db877d767ce587ac3d7526cda8254d937a159fd985e0475d062d07ae83e7ff4f9f42c7e1e1cad5e1f408f6849866aa4e9e48b29d80510e5c695cee37

Download Submit
C:\g6QpgrhJDdQZeF0\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
422a35f60a6f810156b55c2e41789d17

SHA1
c20098578e902e46ef8e20c1de9b938123f938ab

SHA256
cde834aa792c7d4d7bdd8726cfa05b569832d9a583cff63fb934e543fb0a8368

SHA512
2e0e615eebc1db1aeeb64628fa4b5e944b7972aaf011b9f0f45bc33ada0f151feac85cc5028952352dde73284f4bde36a5dfadbbb1ebcab6f885f1e6b9efcd3b

Download Submit
F:\$RECYCLE.BIN\BEGIAXZBR-MANUAL.txt

Filesize
8KB

MD5
f73345357f7276f0050356ef2969179f

SHA1
de6fee852864648c5b2c63893de7a05a3540d129

SHA256
8427eb85f0a9fb9e885c47f17004697b0e97de11d6662d73e7ed92aab334c778

SHA512
154bdef2e4b1b406c0ec96e79942342ca712604b58fba93ccbb415cd20750176d9896e5e62c57bb94fc316774bd6f57aab43c73dd1519f4f7610ce212cd81bb3

Download Submit
\Users\Admin\Downloads\ac\nc123.exe

Filesize
125KB

MD5
597de376b1f80c06d501415dd973dcec

SHA1
629c9649ced38fd815124221b80c9d9c59a85e74

SHA256
f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446

SHA512
072565912208e97cc691e1a102e32fd6c243b5a3f8047a159e97aabbe302bddc36f3c52cecde3b506151bc89e0f3b5acf6552a82d83dac6e0180c873d36d3f6b

Download Submit
memory/1220-5253-0x0000000001210000-0x000000000121C000-memory.dmp

Filesize
48KB

Download
memory/1304-740-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-780-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-727-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-728-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-732-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-734-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-736-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-738-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-742-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-744-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-746-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-748-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-750-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-752-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-754-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-756-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-758-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-760-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-762-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-764-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-766-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-768-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-770-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-772-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-774-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-776-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-778-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-5249-0x0000000004760000-0x000000000476E000-memory.dmp

Filesize
56KB

Download
memory/1304-783-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-784-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-786-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-788-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-730-0x0000000001F80000-0x0000000001FAB000-memory.dmp

Filesize
172KB

Download
memory/1304-726-0x0000000001F80000-0x0000000001FB2000-memory.dmp

Filesize
200KB

Download
memory/1304-725-0x0000000001E90000-0x0000000001EC2000-memory.dmp

Filesize
200KB

Download
memory/1348-345-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/1348-514-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/1348-343-0x000000007489E000-0x000000007489F000-memory.dmp

Filesize
4KB

Download
memory/1348-515-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/1348-344-0x0000000001070000-0x00000000010F2000-memory.dmp

Filesize
520KB

Download
memory/1348-346-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/1348-513-0x000000007489E000-0x000000007489F000-memory.dmp

Filesize
4KB

Download
memory/1536-626-0x00000000039C0000-0x00000000040C2000-memory.dmp

Filesize
7.0MB

Download
memory/1536-628-0x00000000039C0000-0x00000000040C2000-memory.dmp

Filesize
7.0MB

Download
memory/1536-624-0x00000000039C0000-0x00000000040C2000-memory.dmp

Filesize
7.0MB

Download
memory/1536-627-0x00000000039C0000-0x00000000040C2000-memory.dmp

Filesize
7.0MB

Download
memory/1844-661-0x0000000140000000-0x0000000140ACB000-memory.dmp

Filesize
10.8MB

Download
memory/1844-690-0x0000000140000000-0x0000000140ACB000-memory.dmp

Filesize
10.8MB

Download
memory/2912-660-0x0000000000400000-0x0000000000B02000-memory.dmp

Filesize
7.0MB

Download
memory/2912-629-0x0000000000400000-0x0000000000B02000-memory.dmp

Filesize
7.0MB

Download
memory/3452-1805-0x0000000001200000-0x000000000123C000-memory.dmp

Filesize
240KB

Download
memory/3512-893-0x00000000071F0000-0x00000000077D8000-memory.dmp

Filesize
5.9MB

Download
memory/3512-1771-0x00000000071F0000-0x00000000077D8000-memory.dmp

Filesize
5.9MB

Download