badrabbit | c29bc7ab31b2c17e5b4ba1734abcfdff97fd1e5ecf078f6d42eb0a083f3cfc6e

Resubmissions

13-01-2025 11:23

250113-ng6tqasnek 1

13-01-2025 02:09

250113-clc7estjhl 8

13-01-2025 01:54

250113-cbwwsazmgt 10

Analysis

max time kernel
572s
max time network
648s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
13-01-2025 01:54

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

5secshuffle.py
Size

6KB
MD5

f0625f71f66f011f8251f180407017d3
SHA1

85834cd6484705f147c32e55e67c2b9cde824323
SHA256

c29bc7ab31b2c17e5b4ba1734abcfdff97fd1e5ecf078f6d42eb0a083f3cfc6e
SHA512

ba8c23559bb9cc8be914d9a69d242f55a06a692313c2f88cba4154f1cd8af03be9fac82172e7703cebff18e632bb6c77f2e3efc32fbb8e5f48aad73f1b02dbe7
SSDEEP

192:JAmEW9Qfl53LDwrfDI3mxUEWw86SDeKd4C8ik6iJN73FJ4Avklatn:JAmEsQfl53LDwMmxUEWw86SDeKd4C8iq

Score

10^/10

badrabbit cryptolocker gandcrab mimikatz backdoor credential_access defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware spyware stealer upx

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-3506525125-3566313221-3651816328-1000\FHBYN-MANUAL.txt

Family

gandcrab

Ransom Note

---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .FHBYN The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/874bd514a789dae0 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAJz1oKKyc7WiBoWtmJRkyFis7HFZTFgU8fzTY7Il2nCM3SmHR4HErFlVp59NrRwm+OyIcDsxd8zT6tHOvSiEo3CzrYVjJ3/av8UNyGGgfpZuVBOFq6YBzN7phOvWeO67sAcglVmIyPACycs/rD/Bv+c9UhT9i7SWqZowtfQvOO8QCAYqFJkTr8kMLf5JY0c7OwuUvqy7g97hr37ExdfizeTYndJQveXc02Tmk0EdTfq5IF2LHpudZuNaIbdKiAjpYdgpPesN9+Ki1jUqKuEwZJqn26JrFEGpXBe1nFwr4eZWRGmR5DxSRF6thmMfYeSWwxNDNs2bC1fycjxb/CTubnbp6+uuNvpO0EvQeM12w4gjW61ZYAnFxY0Gk7MH0bPb3ZWUPIyBDJI/9RNSm94JgxZtRAXcn9kstzqAeYwLP6Xl4+5ugX9olfJXsahSD0WxmDSHHPT2NJtAXWlxHOXqSbT9KXy/5nkM8z8og+656Em6vhcWeQy5LbzzN/7yVQAj+kiyl5ow7WyztCtQ0zaZUn+Fn9NTsQiHQ067IgVeOwbmyIaTauB1Hg+04XSt/6CTDGl7h9mXoUaz4/fH4AQS3okPPdn/JFJzBm7nJYLIyGC/uv6AJN/Pw7jR+5oQQlWlJDe7WeA7VA+L5dZouIan7AX/KZQq8Gu/lVbFnnib9boStyVYxozraaebZWfRwleZZ1WyX7z36nR7NvYfmgBqlWnYO720l/o9Q1N3NgeBCfHcxpoVWDq0gzHsDQmONVJiBI3N42AyKPyQJg/8YuFDEtG8qk/8DB95sG8eZRX5I4eSRfJGHTunG5gAqwzZhdVX13pgDcNvPz2XScqnZfYdnMgpWY+zB+oYeaTdNnnDQSnhx3gP1l4h75yPa8hkw5dvL14pSy6PF5c4CspL93OsbXeJOGmEkM8e/e3XGp6t2x3Q8npulotiTe0/B3Iy57EfBOa8OMJkqzEvNjKkuDl0yjfh8wSXdOsEy/87JuaiZnJaguRZ1Ul6llJSm/i053+Cm+1A0xn50fqzeLSZkqzEkUx74xnj+a86+H8PTLF2gbmVprfHiwTx+QkzMt2G+3OZKdybyPdYEalxh6aM+Z4hdy0zTk8rYC+cBDnvFLJQSl5lIjsVs7DcpT6/qrIb6n0eZmv8NkBiI/wnMcYsVPBrD9yOfkoLTJWaZAxR1ovYRqQeGV84XfUyr3f58xNTl7hgmhHnoiqFUTCiT4VI3aTcRVPYf+9UgGUCILLDhLFcgCsadBYjuOeHTXCW4eGRvb8zL7+jNOwpHeSZnA4Cz3HkNLSL7zizvDhYrdCuEpux3pzPBceTj5Oh0TczjnVteaWQPQorkplCyymFYdl1fat4vL5yRq8vxJ4L+y27Hfw390TqCS+CgruTcwLY05dkl3dhRK9xl5aCvJhJxsHp13FlF/KPpAiePRpaqZlkG/Agrd4ZUxC+YP8b3s1bwPC1MQAiqgu77yY0AligUUS8w+Ba8jhyEDkBXwYWBVMiVXwoYcm6E0veYqlWGUhXtPXskRsium7IvldG6wavFhX3aXUW4/9y3p48aAbjWae77xWZq82wcvytr2WBMyxwlhsxZYAg5ZZJNja9mJgXmJgA+17oMYbruLhRQzuKaZtsEDPH1e34lCCyrTVcnXbq5ga+qu8TYvXvnAsFthdna30Khk+hBYsnaeLTxrjM7K2QElPWrHIdNNPwUkRWf1VZBboIRwxga7ylamEo8xTIxSMGjBDUfTsduPuv9grdMvhDVYqc7lZbWHCPJjaqUGe3POIhcOSjATOmfI18ggKZLUolJ03P/NvkhbohPED9fQjBUxg6prGjmpFOfCKfduWCNcGEoY59AOHzNT+XV7bXzZRgX/17PxxarsQ9lf9UcglcRf1I4iZIR4q8+569/Xd6plT37boiHw25NcNZXKiP6PIXjb5joeuJd1zCnwu6hKNF2hj+we1A0yyrMDkzBnk+481tFA+/pVQvFSdTFkkymkeuaU4vV5cFJn6t8NgDREoPdXPgSwPeM5Wh8HO64fmlHMomFkr3nk0BPH1/VkWU3jEONPoTrDqfI+FGFcY9t6IjfJV+nHiuMGwTzrknOV0zORpFXpKeOjRXiFzKIEfVZIj3uEHP3ggSnbSX86vPPLeUT3noAh5jtfQkzTLmQmo1m7SkFs8sixsnrOaMf6WceTam02SAFgxshnggcG9BwdowljXthl6p3wbnpsXcCVvHLpMPZjGsICRTCCI= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDy9NbJLZDAAveVruDJRWnIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNx2WKAyu4W+5zlHFnKwMISBi1CwemWoy1rWnPOZxV8SSVjOsTAmmL/7s4CzGBkpOKj7RToVZfeU0wFSACDBtKyJP9BcBnpq7cZhR723XrGVmYCRgUeIP97y+PM3LODjXKPjrwxW5OZ7T0jJ1vbhL2d07fePSySz26B+oWfFo533PDqxlSg7ubDoQVp+6k2VyOmsqBtvY7wKrt0yoC8O1fylWzmQ7ql4Gew6gTqwNUzab5MfvdxRLWCjoLjSwF/i8jPDKIqgjY3pWN3+hglhvFqi4oFZEvhEsSM+AN7hzdQWIEz1U0GTyeyMcZ0O1go/+eQSe20E23SaCuLrfdcRPB6VJMorLqwb8AmOcGyVvrCSEaKsTrSHnIyaYEIrb5s07lHfcy/ShKIdDA3FyYH6qAJw1UbUxI7G7XVYm+fKMPMuEsCdCZihzgpfE7oT7wA2q18= ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/874bd514a789dae0

Extracted

Path

C:\g1rFryAhrVg2xrt\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>IbhGsQyooCJrMW7nFRLe3DNbNofLyKNAoYncJkRZSFaNNwIJAJOLT1UKu0gGohgFvCFeV9iRPJ/J3AUbU1K3j6g2YQGiL/8A9CSHPjiunVGxPm+ra/YJ9E/zz4o2yuoNdENmrd3qiPAGKj7fbYPGAp5gO4yWak+EboXDSoD2EC/cXWxswa5VmE5JuBQJgjoxdI+yLxokOVMJ8gYF6y+IQ0kUKarH3m63mulMQCUXjsnZZ6VaYNC9Z3kLCoeMS+R+Ev2+CVjgdHYp2A7XKNIWECHQFYzYZ/v1GFuxVPPpiqnMWPpfUWhyPLIZfvrvooQZVnVQrjfeKDXhvtQpdxSUMg==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Badrabbit family
badrabbit
CryptoLocker
Ransomware family with multiple variants.
ransomware cryptolocker
Cryptolocker family
cryptolocker
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab
Gandcrab family
gandcrab
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\Ransomware\\Birele.exe"	Birele.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (449) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x0024000000046636-2794.dat	mimikatz

Contacts a large (1157) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Krotten.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Krotten.exe

Disables Task Manager via registry modification
evasion

Modifies Windows Firewall 2 TTPs 3 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1740	netsh.exe
6988	netsh.exe
24984	NetSh.exe

Sets service image path in registry 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mssqlaq\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\Ransomware\\ac\\mssqlaq.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vyolxvrdidqtfuc\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\Ransomware\\ac\\vyolxvrdidqtfuc.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\htvpsdephvbcsxju\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\Ransomware\\ac\\htvpsdephvbcsxju.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ckwrhygxjzagtufv\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\Ransomware\\ac\\ckwrhygxjzagtufv.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mssql\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\Ransomware\\ac\\mssql.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ovjulxijwaxkwekl\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\Ransomware\\ac\\ovjulxijwaxkwekl.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\qzgsrdortheoszw\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\Ransomware\\ac\\qzgsrdortheoszw.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\cmofmejdsyoxfbei\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\Ransomware\\ac\\cmofmejdsyoxfbei.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\tornnkqdflmhles\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\Ransomware\\ac\\tornnkqdflmhles.sys"	mssql.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\Control Panel\International\Geo\Nation	Dharma.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8a47d585.exe	explorer.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LOGON.exe	DeriaLock.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8a47d585.exe.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\FHBYN-MANUAL.txt	GandCrab.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\a789dd0ca789dae765.lock	GandCrab.exe

Executes dropped EXE 23 IoCs

pid	Process
4492	$uckyLocker.exe
5280	7ev3n.exe
6896	Annabelle.exe
5124	BadRabbit.exe
7056	Cerber5.exe
5164	CoronaVirus.exe
5208	Birele.exe
948	CryptoLocker.exe
6976	CryptoWall.exe
7004	DeriaLock.exe
7016	Dharma.exe
1584	Fantom.exe
6480	GandCrab.exe
3088	Krotten.exe
3464	InfinityCrypt.exe
6884	{34184A33-0407-212E-3320-09040709E2C2}.exe
1128	{34184A33-0407-212E-3320-09040709E2C2}.exe
5608	nc123.exe
4828	mssql.exe
6592	5D57.tmp
5972	mssql2.exe
2724	system.exe
764	SearchHost.exe

Impair Defenses: Safe Mode Boot 1 TTPs 21 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\CKWRHYGXJZAGTUFV.SYS	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\cmofmejdsyoxfbei.sys	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\tornnkqdflmhles.sys	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\TORNNKQDFLMHLES.SYS	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	Birele.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\htvpsdephvbcsxju.sys	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\HTVPSDEPHVBCSXJU.SYS	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ckwrhygxjzagtufv.sys	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\QZGSRDORTHEOSZW.SYS	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\vyolxvrdidqtfuc.sys	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\OVJULXIJWAXKWEKL.SYS	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend	Birele.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	Birele.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	Birele.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\VYOLXVRDIDQTFUC.SYS	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ovjulxijwaxkwekl.sys	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\qzgsrdortheoszw.sys	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\CMOFMEJDSYOXFBEI.SYS	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	Birele.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	Birele.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	Birele.exe

Loads dropped DLL 1 IoCs

pid	Process
744	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\Ransomware\\Birele.exe"	Birele.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8a47d58 = "C:\\8a47d585\\8a47d585.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8a47d585 = "C:\\Users\\Admin\\AppData\\Roaming\\8a47d585.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\WINDOWS\\Web\\rundll32.exe"	Krotten.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPCC = "C:\\WINDOWS\\Cursors\\avp.exe"	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\{34184A33-0407-212E-3320-09040709E2C2}.exe"	{34184A33-0407-212E-3320-09040709E2C2}.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\a:	Cerber5.exe
File opened (read-only)	\??\j:	Cerber5.exe
File opened (read-only)	\??\P:	GandCrab.exe
File opened (read-only)	\??\Q:	GandCrab.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\R:	GandCrab.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\M:	GandCrab.exe
File opened (read-only)	\??\b:	Cerber5.exe
File opened (read-only)	\??\t:	Cerber5.exe
File opened (read-only)	\??\y:	Cerber5.exe
File opened (read-only)	\??\L:	GandCrab.exe
File opened (read-only)	\??\V:	GandCrab.exe
File opened (read-only)	\??\W:	GandCrab.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\Z:	GandCrab.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\l:	Cerber5.exe
File opened (read-only)	\??\m:	Cerber5.exe
File opened (read-only)	\??\v:	Cerber5.exe
File opened (read-only)	\??\T:	GandCrab.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\q:	Cerber5.exe
File opened (read-only)	\??\x:	Cerber5.exe
File opened (read-only)	\??\g:	Cerber5.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\s:	Cerber5.exe
File opened (read-only)	\??\E:	GandCrab.exe
File opened (read-only)	\??\K:	GandCrab.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Y:	GandCrab.exe
File opened (read-only)	\??\D:	SearchHost.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\H:	GandCrab.exe
File opened (read-only)	\??\X:	GandCrab.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\e:	Cerber5.exe
File opened (read-only)	\??\S:	GandCrab.exe
File opened (read-only)	\??\U:	GandCrab.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\O:	GandCrab.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\G:	GandCrab.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\r:	Cerber5.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
536	ip-addr.es
529	ip-addr.es

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "DANGER"	Krotten.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Äëÿ òîãî ÷òîáû âîññòàíîâèòü íîðìàëüíóþ ðàáîòó ñâîåãî êîìïüþòåðà íå ïîòåðÿâ ÂÑÞ èíôîðìàöèþ! È ñ ýêîíîìèâ äåíüãè, ïðèøëè ìíå íà e-mail [email protected] êîä ïîïîëíåíèÿ ñ÷åòà êèåâñòàð íà 25 ãðèâåíü. Â îòâåò â òå÷åíèå äâåíàäöàòè ÷àñîâ íà ñâîé e-mail òû ïîëó÷èøü ôàèë äëÿ óäàëåíèÿ ýòîé ïðîãðàììû."	Krotten.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\Control Panel\Desktop\Wallpaper = "0"	$uckyLocker.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5208-30607-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/memory/5208-2040-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/memory/5208-2016-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/files/0x0026000000046568-2014.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Info.plist.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\README_en_GB.txt.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\PipelineSegments.store.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files\GetEnter.pptx	GandCrab.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\A3DUtils.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File created	C:\Program Files\FHBYN-MANUAL.txt	GandCrab.exe
File opened for modification	C:\Program Files\CloseHide.svg	GandCrab.exe
File opened for modification	C:\Program Files\FindStop.txt	GandCrab.exe
File opened for modification	C:\Program Files\OpenReset.DVR-MS	GandCrab.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files\WaitEnter.scf	GandCrab.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\List.txt.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\en_GB.dic.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htm.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\Products.txt.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files\DenyUnregister.tiff	GandCrab.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\affDescription.txt.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files\CompressRevoke.css	GandCrab.exe
File opened for modification	C:\Program Files\SearchResume.crw	GandCrab.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files\SyncOut.docx	GandCrab.exe
File opened for modification	C:\Program Files\UnlockRename.wmv	GandCrab.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\plugin.X.manifest.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\en_US.dic.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\List.txt.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\README_en_CA.txt.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\AdobeHunspellPlugin.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files\RenameUndo.TS	GandCrab.exe
File opened for modification	C:\Program Files\StartMerge.mp4	GandCrab.exe
File created	C:\Program Files (x86)\FHBYN-MANUAL.txt	GandCrab.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\changelog.txt.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\README_en_US.txt.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AiodLite.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ACE.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files\CompleteUnprotect.ram	GandCrab.exe
File opened for modification	C:\Program Files\PushExit.i64	GandCrab.exe
File opened for modification	C:\Program Files\RegisterDisable.easmx	GandCrab.exe
File opened for modification	C:\Program Files\RestartTest.ttc	GandCrab.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\ActionsPane3.xsd.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Acrofx32.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files\UnpublishRequest.vdw	GandCrab.exe
File opened for modification	C:\Program Files\UseSet.ods	GandCrab.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\tifffilt.dll.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\AddIns.store.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604	InfinityCrypt.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\5D57.tmp	rundll32.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\WINDOWS\Web	Krotten.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2376	4828	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Krotten.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GandCrab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nc123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoWall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DeriaLock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SCHTASKS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssql2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ev3n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$uckyLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cerber5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfinityCrypt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dharma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SearchHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Birele.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fantom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InfinityCrypt.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GandCrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	GandCrab.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GandCrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InfinityCrypt.exe

Interacts with shadow copies 3 TTPs 4 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
31528	vssadmin.exe
24520	vssadmin.exe
24428	vssadmin.exe
24360	vssadmin.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5740	taskkill.exe

Modifies Control Panel 6 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\Control Panel\Desktop	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\Control Panel\Desktop\WallpaperOriginX = "210"	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\Control Panel\Desktop\WallpaperOriginY = "187"	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\Control Panel\Desktop\MenuShowDelay = "9999"	Krotten.exe
Key created	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\Control Panel\International	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\Control Panel\International\sTimeFormat = "ÕÓÉ"	Krotten.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Window title = ":::::::::::::::::: ÌÎÉ ÕÓÉ ÏÐÎÒÓÕ À ÏÈÇÄÀ ÃÍÈÅÒ ::::::::::::::::::"	Krotten.exe
Key created	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\Software\Microsoft\Internet Explorer\Main	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window title = ":::::::::::::::::: ÌÎÉ ÕÓÉ ÏÐÎÒÓÕ À ÏÈÇÄÀ ÃÍÈÅÒ ::::::::::::::::::"	Krotten.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	Krotten.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://poetry.rotten.com/lightning/"	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://poetry.rotten.com/lightning/"	Krotten.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000_Classes\Local Settings	firefox.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\REGFILE\SHELL\OPEN\COMMAND	Krotten.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier	firefox.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2284	SCHTASKS.exe
1312	schtasks.exe
4988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
744	rundll32.exe
744	rundll32.exe
6480	GandCrab.exe
6480	GandCrab.exe
6480	GandCrab.exe
6480	GandCrab.exe
744	rundll32.exe
744	rundll32.exe
6592	5D57.tmp
6592	5D57.tmp
6592	5D57.tmp
6592	5D57.tmp
6592	5D57.tmp
6592	5D57.tmp
6592	5D57.tmp

Suspicious behavior: LoadsDriver 32 IoCs

pid	Process
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe
4828	mssql.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
6976	CryptoWall.exe
5720	explorer.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2548	unregmp2.exe
Token: SeCreatePagefilePrivilege	2548	unregmp2.exe
Token: SeShutdownPrivilege	4828	wmplayer.exe
Token: SeCreatePagefilePrivilege	4828	wmplayer.exe
Token: SeDebugPrivilege	5048	firefox.exe
Token: SeDebugPrivilege	5048	firefox.exe
Token: 33	4292	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4292	AUDIODG.EXE
Token: SeDebugPrivilege	5048	firefox.exe
Token: SeDebugPrivilege	5048	firefox.exe
Token: SeDebugPrivilege	5048	firefox.exe
Token: SeDebugPrivilege	5048	firefox.exe
Token: SeRestorePrivilege	732	7zG.exe
Token: 35	732	7zG.exe
Token: SeSecurityPrivilege	732	7zG.exe
Token: SeSecurityPrivilege	732	7zG.exe
Token: SeDebugPrivilege	5048	firefox.exe
Token: SeDebugPrivilege	5048	firefox.exe
Token: SeDebugPrivilege	5048	firefox.exe
Token: SeSystemtimePrivilege	3088	Krotten.exe
Token: SeDebugPrivilege	1584	Fantom.exe
Token: SeShutdownPrivilege	744	rundll32.exe
Token: SeDebugPrivilege	744	rundll32.exe
Token: SeTcbPrivilege	744	rundll32.exe
Token: SeDebugPrivilege	7004	DeriaLock.exe
Token: SeDebugPrivilege	5740	taskkill.exe
Token: SeDebugPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeDebugPrivilege	5972	mssql2.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeLoadDriverPrivilege	4828	mssql.exe
Token: SeDebugPrivilege	6592	5D57.tmp

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
4828	wmplayer.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
732	7zG.exe
764	SearchHost.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
764	SearchHost.exe

Suspicious use of SetWindowsHookEx 47 IoCs

pid	Process
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
6736	cmd.exe
4828	mssql.exe
4828	mssql.exe
5972	mssql2.exe
5972	mssql2.exe
764	SearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 4828	4496	OpenWith.exe	87
PID 4496 wrote to memory of 4828	4496	OpenWith.exe	87
PID 4496 wrote to memory of 4828	4496	OpenWith.exe	87
PID 4828 wrote to memory of 3852	4828	wmplayer.exe	89
PID 4828 wrote to memory of 3852	4828	wmplayer.exe	89
PID 4828 wrote to memory of 3852	4828	wmplayer.exe	89
PID 3852 wrote to memory of 2548	3852	unregmp2.exe	90
PID 3852 wrote to memory of 2548	3852	unregmp2.exe	90
PID 4464 wrote to memory of 5048	4464	firefox.exe	101
PID 4464 wrote to memory of 5048	4464	firefox.exe	101
PID 4464 wrote to memory of 5048	4464	firefox.exe	101
PID 4464 wrote to memory of 5048	4464	firefox.exe	101
PID 4464 wrote to memory of 5048	4464	firefox.exe	101
PID 4464 wrote to memory of 5048	4464	firefox.exe	101
PID 4464 wrote to memory of 5048	4464	firefox.exe	101
PID 4464 wrote to memory of 5048	4464	firefox.exe	101
PID 4464 wrote to memory of 5048	4464	firefox.exe	101
PID 4464 wrote to memory of 5048	4464	firefox.exe	101
PID 4464 wrote to memory of 5048	4464	firefox.exe	101
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102
PID 5048 wrote to memory of 792	5048	firefox.exe	102

System policy modification 1 TTPs 37 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "1044"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogOff = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetHood = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuSubFolders = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoManageMyComputerVerb = "1"	Krotten.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoUserNameInStartMenu = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoThemesTab = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMMyPictures = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMyMusic = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMMyDocs = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktop = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFavoritesMenu = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSaveSettings = "1"	Krotten.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Uninstall	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuPinnedList = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMFUprogramsList = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPrinterTabs = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPrinters = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D} = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{450D8FBA-AD25-11D0-98A8-0800361B1103} = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Uninstall\NoAddRemovePrograms = "1"	Krotten.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewOnDrive = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsMenu = "1"	Krotten.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\5secshuffle.py
1⤵
- Modifies registry class
PID:3512

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\AppData\Local\Temp\5secshuffle.py"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\SysWOW64\unregmp2.exe
    "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
      4⤵
      Enumerates connected drives
      Suspicious use of AdjustPrivilegeToken
      PID:2548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 2388
    3⤵
    - Program crash
    PID:2376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 4828 -ip 4828
1⤵
PID:4768

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1988 -parentBuildID 20240401114208 -prefsHandle 1920 -prefMapHandle 1916 -prefsLen 23839 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a53fa2b0-770b-4a25-9203-31724bc74dac} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" gpu
    3⤵
    PID:792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2360 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3be52caf-acf7-4949-b4dd-2e0b245efb87} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" socket
    3⤵
    PID:5096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2992 -childID 1 -isForBrowser -prefsHandle 3012 -prefMapHandle 3008 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01fa2700-6de5-433a-9a32-901ec9f87956} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab
    3⤵
    PID:3600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4072 -childID 2 -isForBrowser -prefsHandle 4232 -prefMapHandle 4228 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d7102b5-9cd4-4595-b62a-78ae05acdb95} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab
    3⤵
    PID:2172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4720 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4712 -prefMapHandle 4576 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {08d20945-726f-4a9a-a0dd-0ac65b74da72} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" utility
    3⤵
    - Checks processor information in registry
    PID:4564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5292 -childID 3 -isForBrowser -prefsHandle 5388 -prefMapHandle 5384 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa9e34ee-c1c2-463c-8cf2-9c368808323b} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab
    3⤵
    PID:5868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5600 -childID 4 -isForBrowser -prefsHandle 5612 -prefMapHandle 5608 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bd8c5a8-fc3d-435e-ad28-52e6adccf46c} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab
    3⤵
    PID:5920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5656 -childID 5 -isForBrowser -prefsHandle 5728 -prefMapHandle 5732 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e8958f1-11b3-4aa9-bb25-b21c93e560f0} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab
    3⤵
    PID:6028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2640 -childID 6 -isForBrowser -prefsHandle 2752 -prefMapHandle 2748 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {48093e1a-fc1a-4368-94a9-e8272a919120} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab
    3⤵
    PID:1812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6124 -parentBuildID 20240401114208 -prefsHandle 6344 -prefMapHandle 6348 -prefsLen 32460 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6b53b80-053d-4fd8-b9f6-10871be8cbcd} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" rdd
    3⤵
    PID:2560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6332 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 6356 -prefMapHandle 6224 -prefsLen 32460 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad6c7091-747d-4708-986c-a42872d5f97c} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" utility
    3⤵
    - Checks processor information in registry
    PID:2184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7040 -childID 7 -isForBrowser -prefsHandle 7132 -prefMapHandle 1552 -prefsLen 28288 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b70379e3-fdd4-41ed-a41e-cf8dac82d523} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab
    3⤵
    PID:4072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5620 -childID 8 -isForBrowser -prefsHandle 7640 -prefMapHandle 7628 -prefsLen 28288 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43a0d7ce-fc25-4f72-88d4-42b617bbd2b2} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab
    3⤵
    PID:1296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2688 -childID 9 -isForBrowser -prefsHandle 6212 -prefMapHandle 6208 -prefsLen 28288 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a160e85-a3e3-431b-a425-7e4a3c14c86a} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab
    3⤵
    PID:5984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7912 -childID 10 -isForBrowser -prefsHandle 7904 -prefMapHandle 7748 -prefsLen 28288 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2778d8a-df9d-4d9b-bcab-d0788878e23e} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab
    3⤵
    PID:6092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6208 -childID 11 -isForBrowser -prefsHandle 4196 -prefMapHandle 6112 -prefsLen 28288 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {20208247-678f-4a49-9f66-4e755ec4cb49} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab
    3⤵
    PID:4380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7460 -childID 12 -isForBrowser -prefsHandle 8112 -prefMapHandle 7532 -prefsLen 28288 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50edf675-af85-4b7f-983b-c962eda23ef5} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab
    3⤵
    PID:2096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4504 -childID 13 -isForBrowser -prefsHandle 7944 -prefMapHandle 7940 -prefsLen 28384 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1be694c9-2406-4e54-9f04-174823d98711} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab
    3⤵
    PID:7088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2764 -childID 14 -isForBrowser -prefsHandle 1876 -prefMapHandle 8312 -prefsLen 28384 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c2bc38c-9611-4f3b-9ac1-e6a933643aeb} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab
    3⤵
    PID:7108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7520 -childID 15 -isForBrowser -prefsHandle 6160 -prefMapHandle 7648 -prefsLen 28384 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {21120c83-8966-45a8-bf5f-29a11ba3991d} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab
    3⤵
    PID:1148

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f8 0x2ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4292

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4356

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\" -spe -an -ai#7zMap9267:108:7zEvent14882
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:732

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat
1⤵
PID:1740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "
1⤵
PID:5356

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat"
1⤵
PID:5556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "
1⤵
PID:5320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "
1⤵
PID:4540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "
1⤵
PID:3440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "
1⤵
PID:5328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "
1⤵
PID:4904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "
1⤵
PID:6512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "
1⤵
PID:5140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "
1⤵
PID:6596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "
1⤵
PID:2548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "
1⤵
PID:4224

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat
1⤵
PID:6660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:6736
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\$uckyLocker.exe
  "$uckyLocker.exe"
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  PID:4492
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\7ev3n.exe
  "7ev3n.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5280
- - C:\Users\Admin\AppData\Local\system.exe
    "C:\Users\Admin\AppData\Local\system.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2724
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\del.bat
      4⤵
      System Location Discovery: System Language Discovery
      PID:5320
  - - C:\Windows\SysWOW64\SCHTASKS.exe
      C:\Windows\System32\SCHTASKS.exe /create /SC ONLOGON /TN uac /TR "C:\Users\Admin\AppData\Local\bcd.bat" /RL HIGHEST /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2284
  - - C:\windows\SysWOW64\cmd.exe
      C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:6768
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
        5⤵
        
        PID:4120
  - - C:\windows\SysWOW64\cmd.exe
      C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:4608
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
        5⤵
        
        PID:6052
  - - C:\windows\SysWOW64\cmd.exe
      C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
      4⤵
      PID:5852
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
        5⤵
        
        PID:7332
  - - C:\windows\SysWOW64\cmd.exe
      C:\windows\system32\cmd.exe /c REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:64
      4⤵
      PID:5856
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:64
        5⤵
        
        PID:1604
  - - C:\windows\SysWOW64\cmd.exe
      C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:64
      4⤵
      PID:3720
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:64
        5⤵
        
        PID:6808
  - - C:\windows\SysWOW64\cmd.exe
      C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:64
      4⤵
      PID:4308
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:64
        5⤵
        
        PID:1968
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:64
      4⤵
      PID:30496
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:64
        5⤵
        
        PID:7844
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\Annabelle.exe
  "Annabelle.exe"
  2⤵
  - Executes dropped EXE
  PID:6896
- - C:\Windows\SYSTEM32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:24360
- - C:\Windows\SYSTEM32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:24428
- - C:\Windows\SYSTEM32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:24520
- - C:\Windows\SYSTEM32\NetSh.exe
    NetSh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:24984
- - C:\Windows\System32\shutdown.exe
    "C:\Windows\System32\shutdown.exe" -r -t 00 -f
    3⤵
    PID:38216
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\BadRabbit.exe
  "BadRabbit.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:5124
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:744
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:904
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /F /TN rhaegal
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6300
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3424727799 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6756
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3424727799 && exit"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1312
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 02:22:00
      4⤵
      System Location Discovery: System Language Discovery
      PID:1052
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 02:22:00
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4988
  - - C:\Windows\5D57.tmp
      "C:\Windows\5D57.tmp" \\.\pipe\{06C212C4-050C-4690-BDD6-788AE5A23DF2}
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6592
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\Birele.exe
  "Birele.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Impair Defenses: Safe Mode Boot
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5208
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5740
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\Cerber5.exe
  "Cerber5.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  PID:7056
- - C:\Windows\SysWOW64\netsh.exe
    C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1740
- - C:\Windows\SysWOW64\netsh.exe
    C:\Windows\system32\netsh.exe advfirewall reset
    3⤵
    - Modifies Windows Firewall
    PID:6988
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\CoronaVirus.exe
  "CoronaVirus.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5164
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:7428
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:23160
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:31528
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:36888
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:36872
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\CryptoLocker.exe
  "CryptoLocker.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:948
- - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
    "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\CryptoLocker.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:6884
  - - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
      "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000240
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1128
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\CryptoWall.exe
  "CryptoWall.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  PID:6976
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\syswow64\explorer.exe"
    3⤵
    - Drops startup file
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    PID:5720
  - - C:\Windows\SysWOW64\svchost.exe
      -k netsvcs
      4⤵
      System Location Discovery: System Language Discovery
      PID:6280
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\DeriaLock.exe
  "DeriaLock.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:7004
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\Dharma.exe
  "Dharma.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7016
- - C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\nc123.exe
    "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\nc123.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5608
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:3216
- - C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\mssql.exe
    "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\mssql.exe"
    3⤵
    - Sets service image path in registry
    - Executes dropped EXE
    - Impair Defenses: Safe Mode Boot
    - Suspicious behavior: LoadsDriver
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4828
- - C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\mssql2.exe
    "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\mssql2.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\Shadow.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\systembackup.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5808
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value | Find "="
      4⤵
      PID:32
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value
        5⤵
        
        PID:27408
    - - C:\Windows\SysWOW64\find.exe
        
        Find "="
        5⤵
        
        PID:27416
  - - C:\Windows\SysWOW64\net.exe
      net user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
      4⤵
      PID:28072
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
        5⤵
        
        PID:37212
- - C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\EVER\SearchHost.exe
    "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\EVER\SearchHost.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:764
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\Fantom.exe
  "Fantom.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1584
- - C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
    3⤵
    PID:17564
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\GandCrab.exe
  "GandCrab.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:6480
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
    3⤵
    PID:1700
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\InfinityCrypt.exe
  "InfinityCrypt.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:3464
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\Krotten.exe
  "Krotten.exe"
  2⤵
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies WinLogon
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:3088

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:31384

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa395a055 /state1:0x41c64e6d
1⤵
PID:38492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Safe Mode Boot

T1562.009

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3506525125-3566313221-3651816328-1000\FHBYN-MANUAL.txt

Filesize
8KB

MD5
cc77cde147e8adadfcc154fb59bb7d12

SHA1
2caea1e5807d82b1d1cb3e9167c30b39c4508719

SHA256
2009d7882446cfac884a824c9f11eb4aa9d83f5b4760514d04ac0dc275f3e8b5

SHA512
c326fc4057e3dc818dc29c463fec77d2e81b425cb2d8ee890d89020ca17dc61699c180f35df71f653a2c484dcef43d3f841fcc2294b2fc4679b575312361ca86

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604

Filesize
16B

MD5
8bbab4fb5810def525012aad91967701

SHA1
58c835533cf9ec70d35a4f8ad3a0edee5edae529

SHA256
a3e439ac1cb7d44c5451eed5bc1ae4b9fa2d0a19c9ea0f6f0afaf40d1d5216c1

SHA512
cda8ef65470c5ea01cacc7ace42855a08bba92d9b4896440777e3d0e34f485467062f1bfdc616e27a915d77f935152242aeac534374f04417ff88b1b3cbf5489

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\MakeAccessible.api.id-A789DAE0.[[email protected]].ncov.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604

Filesize
5.8MB

MD5
b418d4b29c9f0adcfc6b5f2930518baa

SHA1
c86332dde3100a1370c97d7aa70216796cf5efa4

SHA256
c60c71548c318c563c54121d476a0dc32ab66a68255224e8fd05d2deb32719fd

SHA512
79a0cbfd8105e55f15667d0f2137e9d1f9e161eedfef54246f294ad3de42d4aa3848eb45aed555af24d22788e462ac8beeb0c23984895911e7ba60bf34bcf221

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604

Filesize
32KB

MD5
b3d32ba3593272e95dad5f578d820200

SHA1
5195efa57fe7ce14473ba198743a087f240215d8

SHA256
959122d9eca186d3c943ea56e5fae5539fb99ace7312b8fc3a94356559ad7994

SHA512
79289f6e316d205e2070f37aac3c9e5abb5976a3c92a20acce303e74dad62f4f6070275013f144b2593879e7a3701aea38075767a052b5a4c036ed1693d3377f

Download Submit
C:\Program Files (x86)\Microsoft\DECRYPT_YOUR_FILES.HTML.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604

Filesize
1KB

MD5
baaf1ac2d375b918b257a8643e97e98b

SHA1
152e57efab0cbd89c80aa7e5b9ba60d58b1dbf2a

SHA256
dc74b72cb1dbd1d29d05338336eccb1e74763176473bf0023e709b9057b49c9b

SHA512
4216e0c0587a5be97dc8a9178c2dc8968deabf4137f162f4f3be174f2359d0e6a2f390a31b8bf56d3bca2e4e00c3e72975c909e0958d9d3bbfa40b237b24ae6d

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-A789DAE0.[[email protected]].ncov

Filesize
2.9MB

MD5
5adba8e8285a8543d5dfd736ad27bf3e

SHA1
2983422ecdc600301ca93c9ee890d27df34cc849

SHA256
bc8a8399b8a9bd54e8f47c7708a181af0da61291d9d7bcc2189753e6c276e383

SHA512
e7f246562bae28ff20330eff03fc9ecc5feb6fb6532453725bd4d37775546471cb450fc9df7a98ed97424279ff2c5e15520152883c0cb3ca17603d1b2c96ae9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log

Filesize
16B

MD5
950db98787e2039e4c9a8f2b6850f0cf

SHA1
13f0fc7ae90e0f05934ab5e34ae9a852bca2af15

SHA256
ab341c169aaa205b1c2f5ea55e4fa0f9cb8388cadddf26174a04db76a7d02155

SHA512
363e69e8f7b321bef445fe831cf124602997f03b17c0cbb91d72b79339b417529e4bbd68e8875322cfe588856f7e8ef7c6d6f4a55585701e13f231c4b1f9c646

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
adbd8353954edbe5e0620c5bdcad4363

SHA1
aeb5c03e8c1b8bc5d55683ea113e6ce1be7ac6e6

SHA256
64eff10c4e866930d32d4d82cc88ec0e6f851ac49164122cae1b27eb3c9d9d55

SHA512
87bf4a2dc4dd5c833d96f3f5cb0b607796414ffee36d5c167a75644bcbb02ab5159aa4aa093ed43abe290481abc01944885c68b1755d9b2c4c583fcccd041fd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
414677070db2b3e8706ab293072220da

SHA1
8bcabe5dd7dd40b0cc7343def3bc764b0fe47962

SHA256
add43f32306a244f6523fd888020b8472434f81489e695f1d9e6de4c196814f8

SHA512
29768a902ee9bb82dbb73a27e6d38f8322359890e0cc9f188acde0b92cc792e918fd6480bec3f7e22a4f25e4c1e13aecf061c095de0b821a8dd4055ebdcea907

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Filesize
498B

MD5
90be2701c8112bebc6bd58a7de19846e

SHA1
a95be407036982392e2e684fb9ff6602ecad6f1e

SHA256
644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

SHA512
d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
5433eab10c6b5c6d55b7cbd302426a39

SHA1
c5b1604b3350dab290d081eecd5389a895c58de5

SHA256
23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131

SHA512
207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85na2j14.default-release\cache2\entries\065FD4D4C15DB827BFFCDB379EE8F3C3ECFDBD3E

Filesize
28KB

MD5
a1b4cb8eaa478d5fe9cea757591fdb63

SHA1
9b2eee62f73580fcc661d89fd8de7e845a754d63

SHA256
cb3090b3b04313b53cf2584ec4e068a87b2db4c4ea0944875af0c7760517ccc2

SHA512
bd2ef2ee04b1a34180ed40e49ef968a515c8cadef7becf11cbf26381628e9b782214d989ac7d6f1b0c5e7ff5866bb7fcd26f607d3fd10865b62d3d01915b7758

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85na2j14.default-release\cache2\entries\DFAF798699EE7D2494A7287D4CF123272A2A18BD

Filesize
1.1MB

MD5
9d9217e538241d908ee80cb4ae689af4

SHA1
cd35a0beda39c90d9b41ff33db8a910334784023

SHA256
20baa40d5ffb9d74a6fc3c40268491b8f803efa8d13ce4ddd767d7ad1193fc4c

SHA512
e9ad0612d496550f3af7ba7dedd4c991312631d79d6e5acad820dd4d4d51488222137d085aed8b82115577c99b9bda3a68b0b2b2604a765c553da859e6ad2662

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85na2j14.default-release\cache2\entries\E47F6185E9AB287A92322D97719E3C4ED03B8D89

Filesize
97KB

MD5
4f096bd73d7e0a9689648a65e74c86f7

SHA1
4c641c3288afe4dd0ab803f6449e09c78910c0b3

SHA256
1d79ec8fc7661ded8ed091154c6190d6e673d503e98c0b94537ecfc19f3f133a

SHA512
948e9d5ac1636b715c183f28ae6cc40ff9b95cbea48f16399c164e2e6308da326d4dafcd76ca934578b0063821cabad25b631768269f8bf9fa43c4567643f207

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85na2j14.default-release\cache2\entries\E7F7A560FAB7054050F81D89B8B3096A4AEE843E

Filesize
112KB

MD5
b6c7d9c81a3a56d8940e06a56300b8e2

SHA1
298b5522d593ee2c5997ec2fef51cdbe58e25dab

SHA256
75a2beb3cf291df4b617c0fb46fe155e00985dd392ed7a38a860219138cfd201

SHA512
d92af2050e6de9046a223c48d09827aeca348be512ec81c4b197d35e43e086fc918fdddeaecc64ee26a3f30223795b7d08c46304f7e6505836e09d8dc9a8c0e3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85na2j14.default-release\cache2\entries\F0EAF5000FD9C2A30FD2826A9F349C1386795C38

Filesize
70KB

MD5
890f497b0bb9f15b19ebb95b2ce1d07f

SHA1
2679dcab682881d6fb4f814e6fd27a614f081d4a

SHA256
018cc6efc168ba921e5d65586a48da698ae05d2d727c70abc01dae8eacee17c2

SHA512
8986bb836773fa3162e383fe400b054795307da3ce56ff211aad777767e1f877422349c4465843d7bc757c0101f317418e9224ffa9e5994e73a12d890906e55a

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

Filesize
21KB

MD5
fec89e9d2784b4c015fed6f5ae558e08

SHA1
581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

SHA256
489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

SHA512
e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
d56332c0853a2152309dc7bfbaa325c3

SHA1
4a60e06163bcfe9276c6bac18f98f8f3e5e5db63

SHA256
c958210fbbdbe1b78710272d40a7f5bdc083b21f0cf7d8e3d8f4e249a7ff4a01

SHA512
f902099756a891d6d1e809e8fb45ee52a7494e8d673b92ca114b4d3637222e67a03630810acae875e150b47f4610bb31c85d0958c1eb8f71b4e777627f3e8b84

Download Submit
C:\Users\Admin\AppData\Local\system.exe

Filesize
315KB

MD5
c3f75d68844f386bc931fb4b7a88d993

SHA1
0a895d3c231230b2c6fb59595c6e9e00a41770d7

SHA256
79af02c27ea097dd519cc06bcaff2961f00bfeae35e0ea6d1592756b75fb9939

SHA512
df0f028d810888ab72a25d3dc067e83518a9807634eb945e8e5d5906be7c84373ca07254161a54b547306bf5d50dce2b0f7d9ea5f97e2806dd26e249b9e997da

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
21KB

MD5
7806b8bede3165c074f2297d6a37dae4

SHA1
0b5acb560cc587c1654208f926fc95ab56a0e570

SHA256
0104b9cc18b620b9150ab6df4daf3e1ca89bfaf9b9d5592b2feff42f7576239d

SHA512
4f1a72ff19d73ef13e9c5d11c571e9e3d118a0965f88c16a37c5f932a9d15a322fb4cc3211d4ed92af1fb7e30b5a5f7e51d48b84a43f68302f8fba90749806c0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
21KB

MD5
e101aa15da202d2fdba5d7881e52a906

SHA1
629d31a1ec5fee862351bf6f8cc40a6c789b588a

SHA256
4358a462608df5ef22a296360e7b1a052d3048f3cabde874221315aebfe2dc5d

SHA512
d267eb15a7d84d33fe44f973a47361e6de597dc9850a2ab152d38b8e957760183c4776e4ba7f26113c3a3f13cb44b73f258a23d545935238a3dd69082bdc0f4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
11KB

MD5
954a1f47cbb59ab8dd7d06c50d3f96c2

SHA1
fd6e30b7848ea62d04f063a8c1019b19ed468f9f

SHA256
89927064c45227601f008e840fa263a3b51fa1b6fe34cad13e69087f92fe61f9

SHA512
1da7bfe8f8d620afa84ef059c7c10556b0fb7a15da3f30e12a955914fb49aed1584185034dfdb5e89745f3f995baa51c8e8f9b77418a06e3eaa1828d8c2da311

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8a47d585.exe

Filesize
132KB

MD5
919034c8efb9678f96b47a20fa6199f2

SHA1
747070c74d0400cffeb28fbea17b64297f14cfbd

SHA256
e036d68b8f8b7afc6c8b6252876e1e290f11a26d4ad18ac6f310662845b2c734

SHA512
745a81c50bbfd62234edb9788c83a22e0588c5d25c00881901923a02d7096c71ef5f0cd5b73f92ad974e5174de064b0c5ea8044509039aab14b2aed83735a7c4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\AlternateServices.bin

Filesize
18KB

MD5
e38300f76079c2fdbaa8aa036e1ed37e

SHA1
03e40cba13349fc9f6a6a6629c0dfe83bd0b15df

SHA256
c33b22ad290acf66b02183ea8b25a138d92a6e9c86e516ed7af6bb8d7430379f

SHA512
63274b9810b1a0d5212b13c722cd69395aa9e014f6ae1e8a59f3c6ac56e10fd8fc6a30884a600ae87b81712ae1ac96b97b33af3d59a0b05cdc25ed384295fc14

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\AlternateServices.bin

Filesize
8KB

MD5
7aef2a45619fec5e9b32f2cb13a53597

SHA1
312fde33309adaa59d6742eae2f9759b27f8f0be

SHA256
0b05ec3dbf5c873df3bfc5ce953bdac5ae1e4b88ab933096e2f86889fa1b4171

SHA512
d8bf668c1b6346c213999cd8b7f25389ab288ab0ff5edfa267a405562e70909866f1388cc623745e03ae98136aea0301c0e3d064d7999be2b4ce68f2eb6648d1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\AlternateServices.bin

Filesize
6KB

MD5
e6ab25dff6f5423a31ad3ee5ce745704

SHA1
7dfc91b23ab815ebe69f2db3748f8cc8add08936

SHA256
74e6b9a411f6ebade91fe2d2be20ff6ea2d574619811743f1a75d9817ef85e27

SHA512
4cc4d3497fec4a8d0386eeed96fba5d28cf131f91b3335ab11b8fafc738ad62940a3443a33fc996ba28976573148bd0f5e8aa85f491fa76b560ba72c9a73141a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\SiteSecurityServiceState.bin

Filesize
5KB

MD5
871440f1c1a550099eaa3aebb1af53a0

SHA1
804f471a0c5cd3993200f6cf40a005d1e3abac78

SHA256
9a8a253126a3da7a35dac5a0a4ea4f9b7b16e3f2a93d510a97ea6f0d7b6de75a

SHA512
b6e755a00eb2eeba462a7d830e97b61c08d3122fa03a025d7bd296523f42f351e5de7df5def739bde5efc7e015f35e143a2213472e3ab7e07cb9f408978fb124

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\broadcast-listeners.json

Filesize
749B

MD5
598aea660ccb9c260572f307c9b9215b

SHA1
0e482317a4a73e60a074294ec68fd43f115901d7

SHA256
7e13e47f346cb2a6aa0821bc7c00e732db3595735e8288b507984a5244f879f5

SHA512
aa904fb639dbada2f5add6f4d00c3c196fa24e3ce2614023bfd8633090c6c29e04752b2a2c433800cddd333a41bbe109d5ffe419d5848d5fba7d39259c8d551a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\crashes\store.json.mozlz4

Filesize
606B

MD5
2b41263dc6ec47aa75e3fe691f2a20af

SHA1
48b89b967edf6c1d237bb8ca159d393c23e1b0ff

SHA256
1e707adcd5e6b48225da03c718877969a9e42afbcb6016e8e8e0c5cc6cdd9080

SHA512
448f788bb66386e5e0bd65f1108f53730fa2feb05350e4b09b132684257f2ca786413089626720a4be27e3b39cf96eeb89c70e127cce9b6a7dcdc7171b5d5456

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\datareporting\glean\db\data.safe.bin

Filesize
91KB

MD5
49a88347fd7e5d538ab86a21c0919b7e

SHA1
ff0305eccee5669afe95a05f64999c60d1c280ad

SHA256
eda8d1b997dd432bf6d7741a0b5c636abbfd332215c6bcb44079d60666b8d48b

SHA512
48e4e7bcee37666e7c159a81b99cb45b0d0ebee4e8f735257e7bc68d443bfd4fcb42230060aa97029ebc2e060f278989521268e4376d16e72fa1e1e873f6c14c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\datareporting\glean\db\data.safe.tmp

Filesize
85KB

MD5
95381557b58017836600cd348a9eee5e

SHA1
b13600ef951991f904e50a66d1eeaaeecb84ee4d

SHA256
dc4192913822229b0848b1ad54f9d9d11d6679db530f929e2c5ac3d957614d39

SHA512
39a9a89a7e5582e79e9645f3f00da6613e4d88d9d12b838b3f2d9f5c4cbe1ab33b8478056616cc0358781ac4d94d12dc5789fe2216dd489561dbd23a51505073

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
8d44424ab3e5e09267d7cf669add166c

SHA1
693537a613bf7ce8d7a2da766e05ca3ffdc004c8

SHA256
934fefe71a2d5fa4558a40866479803e4a5e3a1d11853207799f02b45e2e856e

SHA512
ec6c61c568dcbfe3379bcb3b8ed502d7fffa68dad997347b41f4adf61aba8b7bce3e3397bf78f0a1ea97466378bd4dad3f30ccd9a7acc6f46486344ddbc1a95b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\datareporting\glean\db\data.safe.tmp

Filesize
55KB

MD5
ee48804d7fe2d87d9e81e71b98adccbc

SHA1
7215b93e4b5b4bb9fdcb428d9af87c1592af244f

SHA256
104b346273bebf6ba3347f3f6867531baf463d52020a8bcf90d1e54dd1961f7a

SHA512
f21eb96b3cb5bf67de317ef93434cb0de7431bed01eb7563134c0db559244264e9700afe2e3551018c91a01e86ac25c24dd762da9e1ed3dda222b10b24dbe66a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\datareporting\glean\db\data.safe.tmp

Filesize
23KB

MD5
073e63f52711617e970766005cd900fb

SHA1
e7e441f4cf971e0da627aa99ee2ac8e67174f3b4

SHA256
52dc8a1817dfb3529d3a15a6246a1a4863654c00b28edd42e188084542f8fe7e

SHA512
99d8013ba1368589fd152de4e6f0a202b09608f02bd4e0aba0bed275c8436ea702c173d42a6657ece79f59d31bbe6e0ee7120036e4957fee0c00ccc26669ced1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\datareporting\glean\db\data.safe.tmp

Filesize
21KB

MD5
4c21d6719a9396c417747d32e3eda1c1

SHA1
837522ca8fe041d9dbde1d8d021d80dad0519aeb

SHA256
49344d28b216cadf50f63fa36728b33b2a5e547bd40db27aecee45939add5f3c

SHA512
6e56d135562234b5f78e96eb6dcd6485b38627f342441de48dba9b7b1051bd39113db1a984b4b30c22ff0024402d07b56c92fd65ab95887b64dd480a4c81fb96

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\datareporting\glean\db\data.safe.tmp

Filesize
25KB

MD5
b413f9c18a9249b0e12dcd7677e1c812

SHA1
071dd5a2658521ad458d3d75aa8670045978a377

SHA256
74dd764e1b3291446f4aecace5ac8769331231fa5c9e27e825ceaf515b0d112a

SHA512
f837707ca8e1f6f8e8688dcf9a5d94d3905f6a3566326d0229afa2e3c90e18a5033ff49387eda8bd7e9d33c62cb65136aca78f5430580097bcd786d21ea595b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\datareporting\glean\events\events

Filesize
2KB

MD5
9f100f17a8454ffd890e14ffcd3f9fed

SHA1
49d8259f4ac56e7708e028c1433cfb986ba4f326

SHA256
fce45aa10d58cea3e86f6b54d349f14aee485d5c2789a08c36c4dd8d6f23f4a3

SHA512
19ff71fae197c8634a777140c85beea1f2236cb308cec6eb81065db3e9575fae687005cfb7ac0cc76631d17773a6088a97a124b86378167864f31fda85911b73

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\datareporting\glean\events\pageload

Filesize
2KB

MD5
c0bbbf7f606e2eeb722e52ca1967176c

SHA1
5774bbd348d1aff62a806016cf20de72cfd4c52f

SHA256
559bc2343ffe27cb8dfee9af9bfd434967a2b5d8414cb02edda9275b8500390a

SHA512
088d25f3f7d8b23072bef31e4e0cfb7b6d5fbab8b18883433883bc4fd87d37517eea22083de485caf0878b488b0e33f61aee4ad13b4e7f1a822ac649e0ba8c49

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\datareporting\glean\pending_pings\4e1404e4-1626-4b29-aa3f-789655f6a457

Filesize
982B

MD5
4a5533afc3d71d7d7657e98d30c483cd

SHA1
9b854eaacebb054e94be403861df7b0dcbe1ce4b

SHA256
9c02fd82dd13a806e26d4a8e207727615c90060e5c9251cc3a044eaf7ab9f109

SHA512
ff151c360b70390e0f6def536d6fd3db664c2fae1329ab1aa091c9f7bac83c121d656582d76a096b3747a7ae41e598ef6e4213a3420266d07073ab2af6c97aae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\datareporting\glean\pending_pings\763a1158-fd3b-45e8-9bbd-102710044513

Filesize
659B

MD5
60f0414ffb89ceedf706897bdc775a93

SHA1
feca8b36cc3047eef1208fbdcc7f218d8af89b20

SHA256
0aed81c04ac2164fa9a1c25806e00563cf15026da29b1d426e48c2aebbd39ee3

SHA512
8f7c05bc32d88e3aac65325cb606eb75cc23a3109dfcd4c773499cfe9f047708387035880269f046a0d53057850087612ef7602daa2a21a709c1897d791c7b3c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\enumerate_devices.txt

Filesize
660B

MD5
a48c702bc8313bd6e2701d8072d622b6

SHA1
c2590d85490b5f932fceb16567b13b3580464c23

SHA256
d5f6f21609b46a14c55e849b750645e3df6090a30ee50514600533ff497220eb

SHA512
fb71fe93cbbc9f3c75e870b1cd9337e3109c5a5df2971aa6bbcefa16a9f02ad0a8fe2364afbe54c8e1eeaf7b325b1b39aad66462d946cedd13e3c272dcb193f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\extensions.json

Filesize
38KB

MD5
dcf57b4e1879ba9de1ceca4e214aaf58

SHA1
d81c29e6cd0d249d54ce9f7da75b0551618a871c

SHA256
e3bd1406fa83df1595926585d257a4482a6779a901ec7a232d4b4b5b55be76bf

SHA512
8a18519870729cae29ba321fbf6b709271af1e3f5e09e12ae9939a9689b37bee2ba11df6689f7bd873eaa1e0942b7e031391cc09f70c8fed774d85ae1d16326f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\prefs-1.js

Filesize
11KB

MD5
8e1d1168cd3fc0f76b5b0d9c3ff47c57

SHA1
658e7bf2cd737ca603cf5789f366be73cc8ed5d1

SHA256
9a2f544b76c6944c45a18d91b3b4772ec3b70aa218f8e8c1cca283abf5d29399

SHA512
7f62bb749edbaf430c97ca1cf1f4c0de98dc2014d068ad72fb12da6a7421cbec855e0f34b34122dafd92c1cf86f568eb0226e79e0a076ffb53af974e01845939

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\prefs-1.js

Filesize
9KB

MD5
b6b176bdbd2f994c91140485f596b050

SHA1
d6eff0dece53b82400acbec3ce2a8ea498c99088

SHA256
755d652ec3074bf590d10e847758a3e466a6b708fc85e702084feae96c9440eb

SHA512
611cba82340f828995947160787854d1eaa370cff7d3edb547ed2ab6aa914bea21042ba8e7532f92df76ff392e9fde1620eeee98fbf13fbf99bfeceffa2daad0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\prefs-1.js

Filesize
9KB

MD5
fd45f81a67a91774969a6053051ea82d

SHA1
b3bde3513a4b24bccce7443f4bfef051b05f2357

SHA256
3e6bf92cfd90b53b0fd70539049b67d2cc5783bb3d4233ad950a11f7ce89e3e1

SHA512
42e37df4a641112410cbb3c2f2650c6f1121e657a0887a38cccfd5dc5ca618127f8e79a8295c8d6c565e9bc69f43ee3f76d7b85acff236cefab0a832b9cbb9db

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\prefs.js

Filesize
11KB

MD5
1123e1f71efd3ff92f2f8e4e8375fd9a

SHA1
5cc5c7ffd793c4a4cc9a705396f2ade350fb196f

SHA256
6f876cbfc2f4674db467a6261d2185f23c482521deaa79003ee1bc9d75944ed8

SHA512
1d2b6e9b71ba02633393c8bea8a2489d6ddd18ea8738f064025b8352fb33d181bade5d58e84b77a6725bbbdb605948079a89248e5c9dd977ffbd067535aeeabc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\prefs.js

Filesize
10KB

MD5
0096de54670c8ad456a70319a0380fc2

SHA1
aec018b8449417d4e8fe7e6c6f3d9493d87a84a5

SHA256
628e7610f5a193f6fa7bf98922294e64056e68eb28aba7d8878edbd7e894eb06

SHA512
60b0bc130737589e64ab4b0614d6ae575df2998a9a0ae2b1193c451b26a1b82d8b98917ac95b94a0cc4bc30f1c0cae97c24a1bd42e3c705f5fc5fdb0084b0afd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\prefs.js

Filesize
11KB

MD5
7a717f556acda59c284781e4eba03fa6

SHA1
7c450549c042bfd7cfb956d6f1b785ea9f0ea7d8

SHA256
ae61b6e93d07bf7e9b725e09b9c46de0e810d154dabcd3e418f3570f52fdf10b

SHA512
47545aa7698a70bf5fb2c988de848f35e320ded7db22a2a330e187dcd01c5e350d48a990f390f561f43fc8789af2c49c027b882e9eeb484b7839b698ada8f2d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
e6c20f53d6714067f2b49d0e9ba8030e

SHA1
f516dc1084cdd8302b3e7f7167b905e603b6f04f

SHA256
50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092

SHA512
462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
4f44e87b4359b0dd357549f28d2094db

SHA1
30e36e262798dd5de85bf1ceeb66b68b69d17aad

SHA256
07ac979f4cf01ba0991f7e7a6e0132128bac536b6097004d0ca6dc8d213f94e0

SHA512
c89bcfaf3df84ca902f90f73f2d467900670684dbd839910064f7387ee016911ee8a25fd553a3c640439ceb8f4c94843804551c6f4860bc8f82c01380eef4292

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
5a9e42ddef02c48de7dd6fa9e49e9162

SHA1
a895e7203cfd0f273c01cc54709c6471911d818b

SHA256
e25428edd5926a6698082e47e5aa9eb9c1420fb8080f3464e08b4d7ec635dd46

SHA512
78e1ad5d94a147cacb74786d195649af0bee5de97495dea0dd7de75b1d8a969d14cf7b82ff195a388c31a4da54e1f8030f0d2b57944a8a489c9361b939e0dd34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
d8969d8d4ef6a957831fd1f48460aed6

SHA1
8b599dc68d9853b8b238c626c8e01404d04f5153

SHA256
b87734fab65cfcb6590ed888c6473a3475f5fb1194c1165e360ca489d0d09899

SHA512
acf6c01d1444863b7fcb6119c802bb9927d847919daa3be57ff044aba51f46102fd2a86ad809c55d38db3a92d2df09562395c7b5c175c276a2a4d89607db6cb3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
34eb42dc8fc68b73020628ceae5eca49

SHA1
0063a828711c84f7ccbd1c7170a034ab43227646

SHA256
c4dea7e3ff1910ae8853247cd7094d8bc5638dbd2ad2c56a40f053e85827c6ce

SHA512
66e146a7c4b55e94fc893faa269b827452b863257bb89f2580619a9d5af775150d990bda69e36f2855d54e4b9135b08bc1351c0d4c66ba5c9295d6085297a5a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
30819c9652f447eafd134b00529ecce1

SHA1
2de60b7d051d5daa194e13b62d12a4e3a90ba662

SHA256
17e3730d99bee7b72859f1be75dc77c81fa9f30683bc2cab5ea1e0d55a3c8ff9

SHA512
b2c01922036d9eae4b809adbbd43e0e947424d8c62458d777f088b08c723505733bd1c1be9a87dd6e4f24527806b32a7ad436492c72721db811e779f21239cb8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
a12ae4dc33afd6d1ecf50d64c435c776

SHA1
3c489f0c1c538580401e32c3bbcb312642c9238e

SHA256
3ce9ca81e92a33555d141d4222aec3296628daf6ba04f1324180ecf1f43f7999

SHA512
5321dcfda2d5e6b911a73e9fb532c92bbb5672d7c396d4cbbdc89d34ab96226988541c861d8f0ac3ddcfdd8b71ac09aebd1aa2b3c0472fc493ad0ac363aab41e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\sessionstore-backups\recovery.baklz4

Filesize
14KB

MD5
d9871db95f040986f16b5f2ec622e106

SHA1
ec9af7ebfeb45e8c2c871034c352460853fb2c51

SHA256
387c67a45901652f4d272e84f3d14cd3d748bd4b3d630e93a9fd0815bda8d27d

SHA512
bf0a724a0f39099ee1e364dd22297c2dc65c2f501089fe0b67db08a4457a68b792b56b62a1a1bb9576eb53cc6bf02201eb4af60b585383a06f7ce5ed7eac2786

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
5001d0e395e7506f28cd4525609393e4

SHA1
166c4a3f379e6216807dfd67c2c3631b3dfaf4a3

SHA256
1ccb51e70756b3aceb3cd7830e79c3fa70a94914b2d0d2e12638ac64cb2d0fa9

SHA512
cf25421f5d52c4e86d455ec810cc54ba956b41b006061e00dda123442671cd535f87b70a62834d542bb777c551d3f4b385cabc18734a1322dcc90ea91b4584b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85na2j14.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
608KB

MD5
8bfdb38485974494b748ea52e9ed1c23

SHA1
b20a7fa16a48f87bec133aadef8cf07e1d2589e4

SHA256
fc88e326e6ac513f6fa8a3a5531b2003bb68bf3ece39ec1b31e5458bed226cd0

SHA512
4b9c199c39013916489ca2316d060ad2879680e857e5266eae4aeac53937b5b334eac1c16e1672e1bc0d1e4e45782572af0f3a66844d0745f2830984f6a27dc4

Download Submit
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe

Filesize
338KB

MD5
04fb36199787f2e3e2135611a38321eb

SHA1
65559245709fe98052eb284577f1fd61c01ad20d

SHA256
d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9

SHA512
533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\$uckyLocker.exe

Filesize
414KB

MD5
c850f942ccf6e45230169cc4bd9eb5c8

SHA1
51c647e2b150e781bd1910cac4061a2cee1daf89

SHA256
86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f

SHA512
2b3890241b8c8690aab0aed347daa778aba20f29f76e8b79b02953b6252324317520b91ea60d3ef73e42ad403f7a6e0e3f2a057799f21ed447dae7096b2f47d9

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\7ev3n.exe

Filesize
315KB

MD5
9f8bc96c96d43ecb69f883388d228754

SHA1
61ed25a706afa2f6684bb4d64f69c5fb29d20953

SHA256
7d373ccb96d1dbb1856ef31afa87c2112a0c1795a796ab01cb154700288afec5

SHA512
550a891c1059f58aa983138caf65a7ea9c326cb1b94c15f3e7594128f6e9f1295b9c2dbc0925637dba7c94e938083fffc6a63dc7c2e5b1e247679931cce505c6

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\Annabelle.exe

Filesize
15.9MB

MD5
0f743287c9911b4b1c726c7c7edcaf7d

SHA1
9760579e73095455fcbaddfe1e7e98a2bb28bfe0

SHA256
716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac

SHA512
2a6dd6288303700ef9cb06ae1efeb1e121c89c97708e5ecd15ed9b2a35d0ecff03d8da58b30daeadad89bd38dc4649521ada149fb457408e5a2bdf1512f88677

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\BadRabbit.exe

Filesize
431KB

MD5
fbbdc39af1139aebba4da004475e8839

SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0

SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\Birele.exe

Filesize
116KB

MD5
41789c704a0eecfdd0048b4b4193e752

SHA1
fb1e8385691fa3293b7cbfb9b2656cf09f20e722

SHA256
b2dcfdf9e7b09f2aa5004668370e77982963ace820e7285b2e264a294441da23

SHA512
76391ac85fdc3be75441fcd6e19bed08b807d3946c7281c647f16a3be5388f7be307e6323fac8502430a4a6d800d52a88709592a49011ecc89de4f19102435ea

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\Cerber5.exe

Filesize
313KB

MD5
fe1bc60a95b2c2d77cd5d232296a7fa4

SHA1
c07dfdea8da2da5bad036e7c2f5d37582e1cf684

SHA256
b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d

SHA512
266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\CoronaVirus.exe

Filesize
1.0MB

MD5
055d1462f66a350d9886542d4d79bc2b

SHA1
f1086d2f667d807dbb1aa362a7a809ea119f2565

SHA256
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

SHA512
2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\DeriaLock.exe

Filesize
484KB

MD5
0a7b70efba0aa93d4bc0857b87ac2fcb

SHA1
01a6c963b2f5f36ff21a1043587dcf921ae5f5cd

SHA256
4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309

SHA512
2033f9637b8d023242c93f54c140dd561592a3380a15a9fdc8ebfa33385ff4fc569d66c846a01b4ac005f0521b3c219e87f4b1ed2a83557f9d95fa066ad25e14

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\Dharma.exe

Filesize
11.5MB

MD5
928e37519022745490d1af1ce6f336f7

SHA1
b7840242393013f2c4c136ac7407e332be075702

SHA256
6fb303dd8ba36381948127d44bd8541e4a1ab8af07b46526ace08458f2498850

SHA512
8040195ab2b2e15c9d5ffa13a47a61c709738d1cf5e2108e848fedf3408e5bad5f2fc5f523f170f6a80cb33a4f5612d3d60dd343d028e55cfc08cd2f6ed2947c

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\Fantom.exe

Filesize
261KB

MD5
7d80230df68ccba871815d68f016c282

SHA1
e10874c6108a26ceedfc84f50881824462b5b6b6

SHA256
f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

SHA512
64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\GandCrab.exe

Filesize
291KB

MD5
e6b43b1028b6000009253344632e69c4

SHA1
e536b70e3ffe309f7ae59918da471d7bf4cadd1c

SHA256
bfb9db791b8250ffa8ebc48295c5dbbca757a5ed3bbb01de12a871b5cd9afd5a

SHA512
07da214314673407a7d3978ee6e1d20bf1e02f135bf557e86b50489ecc146014f2534515c1b613dba96e65489d8c82caaa8ed2e647684d61e5e86bd3e8251adf

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\InfinityCrypt.exe

Filesize
211KB

MD5
b805db8f6a84475ef76b795b0d1ed6ae

SHA1
7711cb4873e58b7adcf2a2b047b090e78d10c75b

SHA256
f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf

SHA512
62a2c329b43d186c4c602c5f63efc8d2657aa956f21184334263e4f6d0204d7c31f86bda6e85e65e3b99b891c1630d805b70997731c174f6081ecc367ccf9416

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\Krotten.exe

Filesize
53KB

MD5
87ccd6f4ec0e6b706d65550f90b0e3c7

SHA1
213e6624bff6064c016b9cdc15d5365823c01f5f

SHA256
e79f164ccc75a5d5c032b4c5a96d6ad7604faffb28afe77bc29b9173fa3543e4

SHA512
a72403d462e2e2e181dbdabfcc02889f001387943571391befed491aaecba830b0869bdd4d82bca137bd4061bbbfb692871b1b4622c4a7d9f16792c60999c990

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\Locky.AZ.exe

Filesize
181KB

MD5
0826df3aaa157edff9c0325f298850c2

SHA1
ed35b02fa029f1e724ed65c2de5de6e5c04f7042

SHA256
2e4319ff62c03a539b2b2f71768a0cfc0adcaedbcca69dbf235081fe2816248b

SHA512
af6c5734fd02b9ad3f202e95f9ff4368cf0dfdaffe0d9a88b781b196a0a3c44eef3d8f7c329ec6e3cbcd3e6ab7c49df7d715489539e631506ca1ae476007a6a6

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\EVER\1saas\LogDelete.exe

Filesize
1.3MB

MD5
6ca170ece252721ed6cc3cfa3302d6f0

SHA1
cf475d6e172b54633479b3587e90dd82824ff051

SHA256
f3a23e5e9a7caefcc81cfe4ed8df93ff84d5d32c6c63cdbb09f41d84f56a4126

SHA512
65b6ceee14b6b5bd7baee12c808d02aeb3af5f5e832d33dcdb32df44c1bfbc1896678dcc517cf90377020ba64af2ccad1790d58f67531196bbd5222f07694c1d

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\EVER\SearchHost.exe

Filesize
1.6MB

MD5
8add121fa398ebf83e8b5db8f17b45e0

SHA1
c8107e5c5e20349a39d32f424668139a36e6cfd0

SHA256
35c4a6c1474eb870eec901cef823cc4931919a4e963c432ce9efbb30c2d8a413

SHA512
8f81c4552ff561eea9802e5319adcd6c7e5bdd1dc4c91e56fda6bdc9b7e8167b222500a0aee5cf27b0345d1c19ac9fa95ae4fd58d4c359a5232bcf86f03d2273

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\Shadow.bat

Filesize
28B

MD5
df8394082a4e5b362bdcb17390f6676d

SHA1
5750248ff490ceec03d17ee9811ac70176f46614

SHA256
da3f155cfb98ce0add29a31162d23da7596da44ba2391389517fe1a2790da878

SHA512
8ce519dc5c2dd0bbb9f7f48bedf01362c56467800ac0029c8011ee5d9d19e3b3f2eff322e7306acf693e2edb9cf75caaf7b85eb8b2b6c3101ff7e1644950303d

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\mssql.exe

Filesize
10.2MB

MD5
f6a3d38aa0ae08c3294d6ed26266693f

SHA1
9ced15d08ffddb01db3912d8af14fb6cc91773f2

SHA256
c522e0b5332cac67cde8fc84080db3b8f2e0fe85f178d788e38b35bbe4d464ad

SHA512
814b1130a078dcb6ec59dbfe657724e36aa3db64ed9b2f93d8559b6a50e512365c8596240174141d6977b5ddcf7f281add7886c456dc7463c97f432507e73515

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\mssql2.exe

Filesize
6.7MB

MD5
f7d94750703f0c1ddd1edd36f6d0371d

SHA1
cc9b95e5952e1c870f7be55d3c77020e56c34b57

SHA256
659e441cadd42399fc286b92bbc456ff2e9ecb24984c0586acf83d73c772b45d

SHA512
af0ced00dc6eeaf6fb3336d9b3abcc199fb42561b8ce24ff2e6199966ad539bc2387ba83a4838301594e50e36844796e96c30a9aa9ad5f03cf06860f3f44e0fa

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\nc123.exe

Filesize
125KB

MD5
597de376b1f80c06d501415dd973dcec

SHA1
629c9649ced38fd815124221b80c9d9c59a85e74

SHA256
f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446

SHA512
072565912208e97cc691e1a102e32fd6c243b5a3f8047a159e97aabbe302bddc36f3c52cecde3b506151bc89e0f3b5acf6552a82d83dac6e0180c873d36d3f6b

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\systembackup.bat

Filesize
1KB

MD5
b4b2f1a6c7a905781be7d877487fc665

SHA1
7ee27672d89940e96bcb7616560a4bef8d8af76c

SHA256
6246b0045ca11da483e38317421317dc22462a8d81e500dee909a5269c086b5f

SHA512
f883cea56a9ac5dcb838802753770494ce7b1de9d7da6a49b878d534810f9c87170f04e0b8b516ae19b9492f40635a72b3e8a4533d39312383c520abe00c5ae6

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\vyolxvrdidqtfuc.sys

Filesize
674KB

MD5
b2233d1efb0b7a897ea477a66cd08227

SHA1
835a198a11c9d106fc6aabe26b9b3e59f6ec68fd

SHA256
5fd17e3b8827b5bb515343bc4066be0814f6466fb4294501becac284a378c0da

SHA512
6ca61854db877d767ce587ac3d7526cda8254d937a159fd985e0475d062d07ae83e7ff4f9f42c7e1e1cad5e1f408f6849866aa4e9e48b29d80510e5c695cee37

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat

Filesize
45B

MD5
a57d4c7edd41f78cba52e82b33dccda0

SHA1
c34368b2bbf731d6060eb5b8feeee46fa1bf7d72

SHA256
873e1e8d67425c721d5137111326c37664550b1a27d2b279986b830b853e62d9

SHA512
3dd8a14d9d788f4201843356da3e9e9bc76b617fc2a5f70b357a17a6261011699c3cce6a6e516489a0d07552af7fc29cc7703ce410e367ae66af9a568685326a

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat

Filesize
47B

MD5
8d35d0d7e1ca3075d84850f9617cd7db

SHA1
1fd7e994754451736b44e0deb7e1c9574fde6697

SHA256
e79bfc6343f99089a97273021e1dabdad93900b87e83794ee1821dd5f19838bf

SHA512
e8f5935eaf90bcdb466888a3d7438d9b8cb6ebf03ea7c5aa64c9e4b9c3d91a8f66bd46906a259a007badfccc7dbebc4e80707f3d632b825b110ae952fbee4edf

Download Submit
C:\Users\Public\Desktop\FILES ENCRYPTED.txt

Filesize
176B

MD5
b721f51c9b549be9a68db263334cf56a

SHA1
1c46a293781e8117b418ad3161aceefc629e007a

SHA256
48b86f23b51ad0903fc9ed55931d75a758ebb9e3ccb837a3056743bf32ca2ef1

SHA512
32a4e3658272c447aa81e466ffcdfc9700e9ce0e386b4d34da2af44c0033ae07fef0d4e738bfdfb1504f7d8f02e46ec87fe7270319b01e4c2f6af58d35449a15

Download Submit
C:\Windows\5D57.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
c4f26ed277b51ef45fa180be597d96e8

SHA1
e9efc622924fb965d4a14bdb6223834d9a9007e7

SHA256
14d82a676b63ab046ae94fa5e41f9f69a65dc7946826cb3d74cea6c030c2f958

SHA512
afc2a8466f106e81d423065b07aed2529cbf690ab4c3e019334f1bedfb42dc0e0957be83d860a84b7285bd49285503bfe95a1cf571a678dbc9bdb07789da928e

Download Submit
C:\g1rFryAhrVg2xrt\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
85713667ee1a1e47718c241240142b12

SHA1
26dfabdbba36136a5d2ad105962eeb5bb53593e3

SHA256
d9ab464e9b05cad78ab1fc2bad275db8890a2550b8bc5412f65a624f6fff5df2

SHA512
36041ae7195657a8d42d428da26a96a9e93843352eba0768d3967ea1984e94a858e44a93389c6bfc519825ae07fea3940efade8f8e2c7bee976fbac2122a46be

Download Submit
memory/1584-2085-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2093-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2087-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2051-0x00000000023C0000-0x00000000023F2000-memory.dmp

Filesize
200KB

Download
memory/1584-2083-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2081-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2079-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2077-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2075-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2073-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2072-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2069-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2067-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2066-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2063-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2061-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2059-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2057-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2055-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2054-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2091-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2089-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2096-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2097-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2053-0x0000000004940000-0x0000000004972000-memory.dmp

Filesize
200KB

Download
memory/1584-2113-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2112-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2099-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2101-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2107-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-32435-0x00000000053F0000-0x00000000053FE000-memory.dmp

Filesize
56KB

Download
memory/1584-2109-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2105-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/1584-2103-0x0000000004940000-0x000000000496B000-memory.dmp

Filesize
172KB

Download
memory/3464-2052-0x0000000000700000-0x000000000073C000-memory.dmp

Filesize
240KB

Download
memory/4492-2032-0x0000000004C90000-0x0000000004C9A000-memory.dmp

Filesize
40KB

Download
memory/4492-1999-0x00000000052C0000-0x0000000005866000-memory.dmp

Filesize
5.6MB

Download
memory/4492-1998-0x0000000000380000-0x00000000003EE000-memory.dmp

Filesize
440KB

Download
memory/4492-2012-0x0000000004D10000-0x0000000004DA2000-memory.dmp

Filesize
584KB

Download
memory/5164-2015-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5164-39556-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5208-30607-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5208-2016-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5208-2040-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5720-2030-0x00000000005C0000-0x00000000005E5000-memory.dmp

Filesize
148KB

Download
memory/5972-27248-0x0000000000400000-0x0000000000B02000-memory.dmp

Filesize
7.0MB

Download
memory/6896-2033-0x0000015C30430000-0x0000015C31424000-memory.dmp

Filesize
16.0MB

Download
memory/6896-22304-0x0000015C4BB50000-0x0000015C4D0DE000-memory.dmp

Filesize
21.6MB

Download
memory/7004-2178-0x0000000004F80000-0x0000000004FD6000-memory.dmp

Filesize
344KB

Download
memory/7004-2044-0x0000000000430000-0x00000000004B2000-memory.dmp

Filesize
520KB

Download
memory/7004-2046-0x0000000004D40000-0x0000000004DDC000-memory.dmp

Filesize
624KB

Download
memory/17564-32579-0x0000000000370000-0x000000000037C000-memory.dmp

Filesize
48KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads