chaos | 1c6906f13a8f27d246689f648f9928afda7848f7176aa9845ab926647dfba486

Resubmissions

08-01-2025 00:41

250108-a187asykbl 10

08-01-2025 00:38

250108-ay3azawlhw 10

Analysis

max time kernel
143s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-01-2025 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11212111.exe
Size

55KB
MD5

bccffd58776272eab71ecd9dde5a1735
SHA1

d263ff45831ed75ac2eab51dfa543beadde51149
SHA256

1c6906f13a8f27d246689f648f9928afda7848f7176aa9845ab926647dfba486
SHA512

5c8bb405986fe1470df3d093629eba296db4ce7c802c32660fd7e7076935b2708ff0a656bc52f298de491b2caa633364c0470835fbb426fdbd1d95f4ecc61860
SSDEEP

1536:GNy0COWkCq9IcHX/NYMGvZFA3FD0TS/+:z03Cq9IcHFYDFAWuW

Score

10^/10

chaos defense_evasion discovery evasion execution impact persistence ransomware spyware stealer

Malware Config

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 3 IoCs

resource	yara_rule
behavioral1/memory/2972-1-0x0000000000360000-0x0000000000374000-memory.dmp	family_chaos
behavioral1/files/0x0008000000012102-6.dat	family_chaos
behavioral1/memory/1784-8-0x0000000000A70000-0x0000000000A84000-memory.dmp	family_chaos

Chaos family
chaos
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
672	bcdedit.exe
2400	bcdedit.exe

Renames multiple (215) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
764	wbadmin.exe

Disables Task Manager via registry modification
evasion

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
1784	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\UpdateTask = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	svchost.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YPLB435F\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CUMHXU73\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T072YXIW\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\98Y29LGS\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Ringtones\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\OM66BHWE\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\R627XHFP\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4DY23DRT\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\U8F4PBMO\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	svchost.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4ymkgx6yi.jpg"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2844	vssadmin.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\rdplocked_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\.rdplocked	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\rdplocked_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\rdplocked_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\rdplocked_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\rdplocked_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\.rdplocked\ = "rdplocked_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\rdplocked_auto_file\shell\Read	rundll32.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1364	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2972	11212111.exe
1784	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2972	11212111.exe
2972	11212111.exe
2972	11212111.exe
1784	svchost.exe
1784	svchost.exe
1784	svchost.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	2972	11212111.exe
Token: SeDebugPrivilege	1784	svchost.exe
Token: SeBackupPrivilege	2976	vssvc.exe
Token: SeRestorePrivilege	2976	vssvc.exe
Token: SeAuditPrivilege	2976	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2600	WMIC.exe
Token: SeSecurityPrivilege	2600	WMIC.exe
Token: SeTakeOwnershipPrivilege	2600	WMIC.exe
Token: SeLoadDriverPrivilege	2600	WMIC.exe
Token: SeSystemProfilePrivilege	2600	WMIC.exe
Token: SeSystemtimePrivilege	2600	WMIC.exe
Token: SeProfSingleProcessPrivilege	2600	WMIC.exe
Token: SeIncBasePriorityPrivilege	2600	WMIC.exe
Token: SeCreatePagefilePrivilege	2600	WMIC.exe
Token: SeBackupPrivilege	2600	WMIC.exe
Token: SeRestorePrivilege	2600	WMIC.exe
Token: SeShutdownPrivilege	2600	WMIC.exe
Token: SeDebugPrivilege	2600	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2600	WMIC.exe
Token: SeRemoteShutdownPrivilege	2600	WMIC.exe
Token: SeUndockPrivilege	2600	WMIC.exe
Token: SeManageVolumePrivilege	2600	WMIC.exe
Token: 33	2600	WMIC.exe
Token: 34	2600	WMIC.exe
Token: 35	2600	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2600	WMIC.exe
Token: SeSecurityPrivilege	2600	WMIC.exe
Token: SeTakeOwnershipPrivilege	2600	WMIC.exe
Token: SeLoadDriverPrivilege	2600	WMIC.exe
Token: SeSystemProfilePrivilege	2600	WMIC.exe
Token: SeSystemtimePrivilege	2600	WMIC.exe
Token: SeProfSingleProcessPrivilege	2600	WMIC.exe
Token: SeIncBasePriorityPrivilege	2600	WMIC.exe
Token: SeCreatePagefilePrivilege	2600	WMIC.exe
Token: SeBackupPrivilege	2600	WMIC.exe
Token: SeRestorePrivilege	2600	WMIC.exe
Token: SeShutdownPrivilege	2600	WMIC.exe
Token: SeDebugPrivilege	2600	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2600	WMIC.exe
Token: SeRemoteShutdownPrivilege	2600	WMIC.exe
Token: SeUndockPrivilege	2600	WMIC.exe
Token: SeManageVolumePrivilege	2600	WMIC.exe
Token: 33	2600	WMIC.exe
Token: 34	2600	WMIC.exe
Token: 35	2600	WMIC.exe
Token: SeBackupPrivilege	1676	wbengine.exe
Token: SeRestorePrivilege	1676	wbengine.exe
Token: SeSecurityPrivilege	1676	wbengine.exe
Token: SeDebugPrivilege	2008	firefox.exe
Token: SeDebugPrivilege	2008	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2008	firefox.exe
2008	firefox.exe
2008	firefox.exe
2008	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2008	firefox.exe
2008	firefox.exe
2008	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3056	AcroRd32.exe
3056	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1784	2972	11212111.exe	30
PID 2972 wrote to memory of 1784	2972	11212111.exe	30
PID 2972 wrote to memory of 1784	2972	11212111.exe	30
PID 1784 wrote to memory of 2172	1784	svchost.exe	31
PID 1784 wrote to memory of 2172	1784	svchost.exe	31
PID 1784 wrote to memory of 2172	1784	svchost.exe	31
PID 2172 wrote to memory of 2844	2172	cmd.exe	33
PID 2172 wrote to memory of 2844	2172	cmd.exe	33
PID 2172 wrote to memory of 2844	2172	cmd.exe	33
PID 2172 wrote to memory of 2600	2172	cmd.exe	36
PID 2172 wrote to memory of 2600	2172	cmd.exe	36
PID 2172 wrote to memory of 2600	2172	cmd.exe	36
PID 1784 wrote to memory of 3048	1784	svchost.exe	38
PID 1784 wrote to memory of 3048	1784	svchost.exe	38
PID 1784 wrote to memory of 3048	1784	svchost.exe	38
PID 3048 wrote to memory of 2400	3048	cmd.exe	40
PID 3048 wrote to memory of 2400	3048	cmd.exe	40
PID 3048 wrote to memory of 2400	3048	cmd.exe	40
PID 3048 wrote to memory of 672	3048	cmd.exe	41
PID 3048 wrote to memory of 672	3048	cmd.exe	41
PID 3048 wrote to memory of 672	3048	cmd.exe	41
PID 1784 wrote to memory of 800	1784	svchost.exe	42
PID 1784 wrote to memory of 800	1784	svchost.exe	42
PID 1784 wrote to memory of 800	1784	svchost.exe	42
PID 800 wrote to memory of 764	800	cmd.exe	44
PID 800 wrote to memory of 764	800	cmd.exe	44
PID 800 wrote to memory of 764	800	cmd.exe	44
PID 1784 wrote to memory of 1364	1784	svchost.exe	48
PID 1784 wrote to memory of 1364	1784	svchost.exe	48
PID 1784 wrote to memory of 1364	1784	svchost.exe	48
PID 2528 wrote to memory of 3056	2528	rundll32.exe	52
PID 2528 wrote to memory of 3056	2528	rundll32.exe	52
PID 2528 wrote to memory of 3056	2528	rundll32.exe	52
PID 2528 wrote to memory of 3056	2528	rundll32.exe	52
PID 1844 wrote to memory of 2008	1844	firefox.exe	55
PID 1844 wrote to memory of 2008	1844	firefox.exe	55
PID 1844 wrote to memory of 2008	1844	firefox.exe	55
PID 1844 wrote to memory of 2008	1844	firefox.exe	55
PID 1844 wrote to memory of 2008	1844	firefox.exe	55
PID 1844 wrote to memory of 2008	1844	firefox.exe	55
PID 1844 wrote to memory of 2008	1844	firefox.exe	55
PID 1844 wrote to memory of 2008	1844	firefox.exe	55
PID 1844 wrote to memory of 2008	1844	firefox.exe	55
PID 1844 wrote to memory of 2008	1844	firefox.exe	55
PID 1844 wrote to memory of 2008	1844	firefox.exe	55
PID 1844 wrote to memory of 2008	1844	firefox.exe	55
PID 2008 wrote to memory of 264	2008	firefox.exe	56
PID 2008 wrote to memory of 264	2008	firefox.exe	56
PID 2008 wrote to memory of 264	2008	firefox.exe	56
PID 2008 wrote to memory of 264	2008	firefox.exe	56
PID 2008 wrote to memory of 264	2008	firefox.exe	56
PID 2008 wrote to memory of 264	2008	firefox.exe	56
PID 2008 wrote to memory of 264	2008	firefox.exe	56
PID 2008 wrote to memory of 264	2008	firefox.exe	56
PID 2008 wrote to memory of 264	2008	firefox.exe	56
PID 2008 wrote to memory of 264	2008	firefox.exe	56
PID 2008 wrote to memory of 264	2008	firefox.exe	56
PID 2008 wrote to memory of 264	2008	firefox.exe	56
PID 2008 wrote to memory of 264	2008	firefox.exe	56
PID 2008 wrote to memory of 264	2008	firefox.exe	56
PID 2008 wrote to memory of 264	2008	firefox.exe	56
PID 2008 wrote to memory of 264	2008	firefox.exe	56
PID 2008 wrote to memory of 264	2008	firefox.exe	56
PID 2008 wrote to memory of 264	2008	firefox.exe	56

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\11212111.exe
"C:\Users\Admin\AppData\Local\Temp\11212111.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Sets desktop wallpaper using registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:2844
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2600
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2400
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:672
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:800
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:764
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:1364

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1676

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1984

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1280

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\ReadImport.zip.rdplocked
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\ReadImport.zip.rdplocked"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3056

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2008.0.790059035\1626022039" -parentBuildID 20221007134813 -prefsHandle 1296 -prefMapHandle 1188 -prefsLen 18084 -prefMapSize 231738 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3875da83-73b5-4f69-b71f-ba29a44f617a} 2008 "\\.\pipe\gecko-crash-server-pipe.2008" 1128 fef3e58 socket
    3⤵
    PID:264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2008.1.1068860866\1777926868" -parentBuildID 20221007134813 -prefsHandle 1684 -prefMapHandle 1680 -prefsLen 18637 -prefMapSize 231738 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98cc248e-a6a4-4a12-9db4-a7a7dfbd2939} 2008 "\\.\pipe\gecko-crash-server-pipe.2008" 1712 13b67358 gpu
    3⤵
    PID:640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2008.2.566140118\568975042" -childID 1 -isForBrowser -prefsHandle 2304 -prefMapHandle 1092 -prefsLen 19466 -prefMapSize 231738 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d9487a9-7c70-4ffb-82f4-73c416abeacb} 2008 "\\.\pipe\gecko-crash-server-pipe.2008" 2312 17af0258 tab
    3⤵
    PID:1252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2008.3.1778114931\1256924036" -childID 2 -isForBrowser -prefsHandle 2660 -prefMapHandle 2656 -prefsLen 19573 -prefMapSize 231738 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {716f1f8f-ecac-4c93-a563-ffb98d37dacb} 2008 "\\.\pipe\gecko-crash-server-pipe.2008" 2672 d69658 tab
    3⤵
    PID:2692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2008.4.1493166049\1452744573" -parentBuildID 20221007134813 -prefsHandle 3104 -prefMapHandle 3056 -prefsLen 26119 -prefMapSize 231738 -appDir "C:\Program Files\Mozilla Firefox\browser" - {263bf1f1-27bf-49ad-b99d-af6353358100} 2008 "\\.\pipe\gecko-crash-server-pipe.2008" 3116 2032b758 rdd
    3⤵
    PID:2868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2008.5.1781201628\2001340867" -childID 3 -isForBrowser -prefsHandle 3756 -prefMapHandle 3764 -prefsLen 27721 -prefMapSize 231738 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b9eb52d-601e-4f67-bc33-0ab10f56e79b} 2008 "\\.\pipe\gecko-crash-server-pipe.2008" 3780 220e5158 tab
    3⤵
    PID:1048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2008.6.1341225025\1204511930" -childID 4 -isForBrowser -prefsHandle 3988 -prefMapHandle 3996 -prefsLen 27941 -prefMapSize 231738 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c81e5042-9ce4-454c-8849-bdf6a795d465} 2008 "\\.\pipe\gecko-crash-server-pipe.2008" 3972 17472558 tab
    3⤵
    PID:2484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2008.7.1342532239\1256588426" -childID 5 -isForBrowser -prefsHandle 4020 -prefMapHandle 4024 -prefsLen 27941 -prefMapSize 231738 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {083aec41-7832-4f1c-b0b8-89fc002669df} 2008 "\\.\pipe\gecko-crash-server-pipe.2008" 4008 17475258 tab
    3⤵
    PID:2352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2008.8.246773068\866217603" -childID 6 -isForBrowser -prefsHandle 4448 -prefMapHandle 4444 -prefsLen 28059 -prefMapSize 231738 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc5e887a-7b8f-48b5-9e92-f97c43e2d5df} 2008 "\\.\pipe\gecko-crash-server-pipe.2008" 4460 2568bf58 tab
    3⤵
    PID:212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2008.9.2000421098\496176990" -childID 7 -isForBrowser -prefsHandle 3400 -prefMapHandle 3668 -prefsLen 28547 -prefMapSize 231738 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed60ec36-fc7b-4e83-8d9b-0e0a9bd6b109} 2008 "\\.\pipe\gecko-crash-server-pipe.2008" 3800 25535958 tab
    3⤵
    PID:2364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2008.10.724467522\1912352448" -childID 8 -isForBrowser -prefsHandle 2612 -prefMapHandle 4628 -prefsLen 28547 -prefMapSize 231738 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fdd5132e-26d8-4a2f-9ab7-5f4af295d3a4} 2008 "\\.\pipe\gecko-crash-server-pipe.2008" 4608 1b637458 tab
    3⤵
    PID:3084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2008.11.1355876869\1873536961" -childID 9 -isForBrowser -prefsHandle 3316 -prefMapHandle 3308 -prefsLen 28547 -prefMapSize 231738 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad30f527-5c59-41a6-98f3-8e5f976c1f26} 2008 "\\.\pipe\gecko-crash-server-pipe.2008" 4700 d30258 tab
    3⤵
    PID:3192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json

Filesize
102B

MD5
7d1d7e1db5d8d862de24415d9ec9aca4

SHA1
f4cdc5511c299005e775dc602e611b9c67a97c78

SHA256
ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda

SHA512
1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\read_it.txt

Filesize
808B

MD5
296cbb8dc865eb8069942f90acd4c570

SHA1
8212d84e630a03ed1533526b8a2f146a3b0f6644

SHA256
5facad0ccca6e4bed131defc487ff17f53ba6f1194e71373dee8188413bc0830

SHA512
980c7bff2333c500d2bafd0d46b6416aa2611252bae3f5eb54b60eb204ed77c2be6907e437e72b7e204df116da22a5c2103de1e9865391946b3cfdd519b644c6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7ktr7c9j.default-release\activity-stream.discovery_stream.json.tmp

Filesize
29KB

MD5
1564ae8c39833f82ed848b50dba31059

SHA1
d8b90448efe444750bd7c83ae226e270df661551

SHA256
1e691d0086ec94316b18e6398135826738f0c6f39011de8ebc189b1f83186347

SHA512
cdd62d7caf0fbb954ff97d95be84ebe3050c6038a836a5013e5a94a167286dc29407e2dcaffecfe23799aa8bc0f5641bf11d7ebd147f3cfc6a2d28e9c2e7b4ef

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7ktr7c9j.default-release\cache2\doomed\5897

Filesize
9KB

MD5
261ca3877067b01b21935230e26aeb9b

SHA1
c137cc9f9a43dc08ed90906dd0127ebac54274cf

SHA256
19df58b47135c868630a48e5d531b3c1fc6ec9f27c82ff3efaa801a56122ca54

SHA512
2ea696df5a370a87ce2d3f2e1476641cd4fdb6cba35bbb5a6150dd165db2abbbb8b7d12433cd16d065c182e9983f1fec0ad5a090c9b6ca1bb4b52de84dfbb6c3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7ktr7c9j.default-release\cache2\entries\6653BC7BE242C21AA1988A4A42D1DEDA18231C31

Filesize
13KB

MD5
3e047a6a70a29738d78cfa9b0bdfa7db

SHA1
596ac7d2c62c3246601e80e66174bc782b7cf165

SHA256
f8f7e018c84c25ec85169d97c7ed561a56b148010b3145029634fa8734289723

SHA512
743f1d8c57dc9f80512fe8198f1d0e866646e27934f3b5e1667551096ca7178c7845fa03fdf3d33697f04ca505c2b6256784607c0201c4d734c86522ffbd1ba5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7ktr7c9j.default-release\datareporting\glean\db\data.safe.bin

Filesize
1KB

MD5
115a41ff4d55cfe8d22d1ad4d3158f7d

SHA1
f7cb638e2cdf55a63934ac587cffc9aec8e31bb3

SHA256
180fcace5fe00503511269684d13cb6f6c4cb07999c7f37d9b89e4ee3deddcce

SHA512
6523fbe1c165a91d249ff3ed374ce1d3dcd982b44a02f7be85caa3fe89a37a6e1fd4a1235ca051e657a787f14898d84080d5d1c0706609289dd10613be6f12d8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7ktr7c9j.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
19d9f1bcca9837747ed738b0b4a94bdd

SHA1
3c373c2310ef3597d95395dd4046e005046defe8

SHA256
6d59e516d675d2012846f9452554eb3ad446f314220215e1d60f4f45acd2785e

SHA512
b0ba5bbfde461a153c6cdd33f817e1cc518f67de97a3aa69c5d96d7922a96279c25034fa32c12e1782954974c6c1a960b8883dfe5d42c2f13093cbc511e1dd22

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7ktr7c9j.default-release\datareporting\glean\pending_pings\f6f61f77-decc-4b3a-928d-4c687195a5cf

Filesize
586B

MD5
921fac199696f10b77c80b6772d36514

SHA1
10a71e6350bf9afe31dceade5bb379f26ed7c3f8

SHA256
8ec414a33cd18f3344ffb08ae0ecce1db7a814647ed145466bfcc242740e5593

SHA512
5c4246c4b72ae711ba722aceb39cc6f8c3e945bdbc34bf3e13d080370c9111e1558c3f5ca0e4897661ae81f89c2bfa38a3c1dbc0a5b20fb50814aef7b4b3bb6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7ktr7c9j.default-release\extensions.json.tmp

Filesize
36KB

MD5
f5e1eab3cf6ff152d2ad2335a4a11764

SHA1
af19f99dbb4a16ead67f860b1c3ad9c3325f13da

SHA256
2855a075269edd21f137c2bacbffadf5d6a62f69c7ae5493f72c3a91a3dcdd18

SHA512
d20e9853d4e3026c55ac4991d16c50f6c2496ba0f8196cd7c3e02ed37dc2c5b3278df28c543b5f970d0e9a29ee99f443b1f74c431d1c42d18f9d0c406dfaf3bc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7ktr7c9j.default-release\key4.db

Filesize
288KB

MD5
18637492471e7d77354e371ef79ae8be

SHA1
cbe1e9a044979ae04912abde9d1803d1872658c7

SHA256
f6873d7bd2b52a5554dc88748d418f18e3a12217b6fa5ab98d80b55ad3c9c971

SHA512
7920dc70a6e7d0551ab24fe35a246683b9b4abead09c79b51a58538fe9160db200efd32aad6e290a7dc8e67d119a31e53b49d72ac3c33c0c5341099410a11015

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7ktr7c9j.default-release\prefs-1.js

Filesize
6KB

MD5
7eb552fa5fb77c03c805b8caa425e360

SHA1
d49611a6768ee112e543c4852dc206a30f7175cb

SHA256
0e8e074cdc62d871f34ce569f691066949f3713f1453a2b38db8893fd7289bd4

SHA512
920b8528165df1626d4ef72e3cb6a51b9a0f740e32bc77a1f7e16c5b8e335044aad2b8e625ae9b90f59444f4196230e60323ef698ca322487c10c8b10da4bf93

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7ktr7c9j.default-release\prefs-1.js

Filesize
6KB

MD5
468918f5f3aa397921db3e1dd922eb30

SHA1
fe0213c0d466db338959f80c8efde9fd7451ab03

SHA256
03e368ea8d96303fbe3996d924249abda4a656e2405a5bdb2271d86df59915d0

SHA512
9844a44c17fe0cc771f03c1ec59d4517217486319415826d937522b97bf263737003cf763d698b8153ba9a4c75c2916f090e18eec92d8c0597049d554cd5797e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7ktr7c9j.default-release\prefs-1.js

Filesize
6KB

MD5
f8e30cd01d853909e2fbc48253681a03

SHA1
af1d45f8fd47033d287485f1da52ae11b7d0ee84

SHA256
e0c65c5108369b148f0a61cbca57ccca9a65280f4b7c5d9b10dd53ba4a1a1c80

SHA512
254bd1d34707fa49e0901eab11555e56396804153483d20734cf96601bb964f41a45680b95cdb1f87fb19b7c0f78e5e924a98315efaf382ef809d60bd7717f77

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7ktr7c9j.default-release\prefs.js

Filesize
517B

MD5
af0f8e342cef6e8c1dcfae45148135f4

SHA1
b383c66f9f30f60a945c428774b34cebf0b4998d

SHA256
3231b968b87673d5c9b95c8589db14656768fe317dda7f967763529510d0278a

SHA512
698ead3e29db50a5ab6200252818f3605db20312db40f85d9fa606a97c3398424c35a71ab2f976a8eb80bc1120506e2a05a396b4e9fb4d460621a8f2b343fd95

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7ktr7c9j.default-release\prefs.js

Filesize
2KB

MD5
b06b17064f298c175ad82eaf30352c87

SHA1
b581214c40c38a0532c6190e65a18aee0d226c73

SHA256
6810b958394fbbb0077eabaed92486521fe4c071533769769c1904fc0dc8e459

SHA512
b6cd55ce71d37a271234b91d0bffa6cf0b730528c09062ddc4ce0b1af37c3cc46ea713434dc798b8e688cdb1dd1d76a805c0b1602f33407d4abad831a26a3d2d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7ktr7c9j.default-release\search.json.mozlz4

Filesize
280B

MD5
41d220d4783f67d2b57beec20c135229

SHA1
6e97765e77920b6010fac2cb4abf1e3cea106541

SHA256
5d1881e74d76b95bad59439bb5c7676258a4ae6b6d853074e93b5247cf1715dc

SHA512
dc30ddc4c8cfe598de5e24bc88cebbe4256fbb21a0b1db6c2ec15311053e7d8be6a93a0bcfcfd8a02543f8b9cf9b15a5840154b272a2df71d59d7dfd80984ac0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7ktr7c9j.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
3fe1e53ea715b9244eb4dbf904bda38b

SHA1
34a9d7aef428a41042fbd8680b0e8d3d19b01a31

SHA256
958928f371331f11cd8c3247d841adffd8f076508a53c560737a140873f6eb34

SHA512
527c5501ba6267644f8101758334e2a89f214ccf5664475ead21ed876525427cb0e913913fdcb8b496f078b9dbc4329e789cada2663f902e44fbed5134bfe430

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7ktr7c9j.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
aa8e7c96c181050a2e2a21616a5b397f

SHA1
21f65b12befe6412f44bd076684334e9fea6121e

SHA256
cea794b1481de01af772254b03aa4db2b1e5bec00bc7a736367bf2feda95b288

SHA512
2b5286df9734f88f5f34a832f1b5c4908d46a64f330b38d72961dd1888e615c5ec8cddd777d8209f5afd7449306c3bd828c4521378a6a067c6b941d47a44846f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7ktr7c9j.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
66a66c4f143d060198c445c7a10ebce7

SHA1
78a548e0b2a9d0ab01451f45e5d3d806a471caa0

SHA256
837f3dc6303b76861def080c762e8b67b9d020dec567144dfba0cd4c698ac407

SHA512
9b82c407e278da2505c6848f0c5ec768453e30d8db5187b2d4baec820046f6d05d3aa8402926789cc54f7f57982aee287ad75576a8a9fb820d94af73801f0cfe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7ktr7c9j.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
99ae9a914b07bf4c25a550db0db5984a

SHA1
40a34d1b56cf4bfb4470ffd1192f5f9dacf5e76d

SHA256
ba0548de6f930728b3301641d133e0c92db5fd678e9580202de9edc1470c1b42

SHA512
ff664dc3d6ec89e59727fdba620232e78f92233cd729fa3fbc98b2ed610e726ea586216946d726b45ec8e1217c050ce91bf3c9895946f0df99424b0703fcfaf6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7ktr7c9j.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
48KB

MD5
59155e65d6e556a110de323f6faf3f7e

SHA1
f42ed9b81944cba947250796b89dc21fa8a06ea7

SHA256
395aa384a5d77a0d1f5854613d17c777a6a4348283950d96749dabc925a1db52

SHA512
3ca14e3445c6b69cc771d36a100e52ab2393d5254b78e9ad09babd5387501804cfbd9bc45370b7dd56afd8eeceac3c6eec973dc0a79760d104f158bbc078c30e

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
55KB

MD5
bccffd58776272eab71ecd9dde5a1735

SHA1
d263ff45831ed75ac2eab51dfa543beadde51149

SHA256
1c6906f13a8f27d246689f648f9928afda7848f7176aa9845ab926647dfba486

SHA512
5c8bb405986fe1470df3d093629eba296db4ce7c802c32660fd7e7076935b2708ff0a656bc52f298de491b2caa633364c0470835fbb426fdbd1d95f4ecc61860

Download Submit
C:\Users\Admin\Desktop\FormatGroup.docx

Filesize
1B

MD5
d1457b72c3fb323a2671125aef3eab5d

SHA1
5bab61eb53176449e25c2c82f172b82cb13ffb9d

SHA256
8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1

SHA512
ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0

Download Submit
C:\Users\Admin\Desktop\ReadImport.zip.rdplocked

Filesize
169KB

MD5
91df67708e547a41944cf3c11f78884f

SHA1
8b670a6302f6f371206f0f31ef6f2763191a46eb

SHA256
e9fc18252dbb5038bb1307f94c80ba665a446d6e0f605f4ebc1739e91488e92a

SHA512
0324e347319da6e67a33da15b91fb947004b41d3f8524754ac32e922f3cb461124ea795ad199652ada8194dfea5ebab4ade81a3a71f99aa465e18aa1f90d0dc1

Download Submit
memory/1784-11-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/1784-1061-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/1784-10-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/1784-8-0x0000000000A70000-0x0000000000A84000-memory.dmp

Filesize
80KB

Download
memory/2972-2-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/2972-0-0x000007FEF5D13000-0x000007FEF5D14000-memory.dmp

Filesize
4KB

Download
memory/2972-1-0x0000000000360000-0x0000000000374000-memory.dmp

Filesize
80KB

Download
memory/2972-9-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download