226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.zip

General
Target

226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe

Filesize

200KB

Completed

22-11-2020 00:19

Score
10 /10
MD5

c2671bf5b5dedbfd3cfe3f0f944fbe01

SHA1

da3e830011e6f9d41dd6c93fdb48c47c1c6e35e1

SHA256

226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2

Malware Config
Signatures 13

Filter: none

Defense Evasion
Impact
Persistence
  • MountLocker Ransomware

    Description

    Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.

  • Deletes shadow copies

    Description

    Ransomware often targets backup files to inhibit system recovery.

    Tags

    TTPs

    File DeletionInhibit System Recovery
  • Modifies extensions of user files
    226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe

    Description

    Ransomware generally changes the extension on encrypted files.

    Tags

    Reported IOCs

    descriptioniocprocess
    File opened for modification\??\c:\Users\Admin\Pictures\BackupMeasure.tiff226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File renamedC:\Users\Admin\Pictures\BackupMeasure.tiff => \??\c:\Users\Admin\Pictures\BackupMeasure.tiff.ReadManual.EF9E23B4226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File renamedC:\Users\Admin\Pictures\EnableWait.crw => \??\c:\Users\Admin\Pictures\EnableWait.crw.ReadManual.EF9E23B4226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File renamedC:\Users\Admin\Pictures\RequestTest.raw => \??\c:\Users\Admin\Pictures\RequestTest.raw.ReadManual.EF9E23B4226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File renamedC:\Users\Admin\Pictures\SubmitCopy.crw => \??\c:\Users\Admin\Pictures\SubmitCopy.crw.ReadManual.EF9E23B4226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File renamedC:\Users\Admin\Pictures\SwitchProtect.png => \??\c:\Users\Admin\Pictures\SwitchProtect.png.ReadManual.EF9E23B4226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
  • Drops desktop.ini file(s)
    226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modification\??\c:\Users\Admin\Documents\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Admin\Downloads\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Admin\Music\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Admin\Searches\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Public\Music\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Admin\Videos\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Public\Libraries\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Admin\Pictures\Saved Pictures\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Admin\OneDrive\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Public\Desktop\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Public\Downloads\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Admin\Favorites\Links\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Public\Documents\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Public\Videos\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Public\AccountPictures\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Public\Pictures\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Admin\Links\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Admin\Pictures\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Admin\Pictures\Camera Roll\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Admin\Saved Games\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Admin\Contacts\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Admin\Desktop\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Admin\Favorites\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Users\Public\desktop.ini226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
  • Modifies service
    vssvc.exe

    TTPs

    Modify RegistryModify Existing Service

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writervssvc.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writervssvc.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writervssvc.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writervssvc.exe
  • Drops file in Program Files directory
    226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe

    Reported IOCs

    descriptioniocprocess
    File created\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_radio_selected_18.svg226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pt-br_get.svg226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ppd.xrm-ms226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\tr-tr\ui-strings.js226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\manifest.xml226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-cli.xml226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ru-ru\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPOlive.png226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\es-es\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\nb-no\ui-strings.js226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files (x86)\Windows Media Player\Media Renderer\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.jpg226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup-impl.xml226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN082.XML226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Viewer.aapp226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\forms_distributed.gif226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\az_get.svg226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL111.XML226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hr-hr\ui-strings.js226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pt-br\ui-strings.js226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\AppStore_icon.svg226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-BoldIt.otf226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Office16\PROOF\msth8FR.LEX226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-tw\ui-strings.js226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files\Microsoft Office\root\Document Themes 16\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-pl.xrm-ms226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_editpdf_18.svg226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_es.properties226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-oob.xrm-ms226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_backarrow_default.svg226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ru-ru\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\org-netbeans-core_visualvm.jar226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL116.XML226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\en-gb\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.png226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\openssl64.dlla.manifest226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN111.XML226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\improved-office-to-pdf-2x.png226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\jre\lib\jfxswt.jar226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ppd.xrm-ms226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Office16\MEDIA\EXPLODE.WAV226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\ui-strings.js226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sv-se\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\sv-se\ui-strings.js226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\ui-strings.js226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\lib\tools.jar226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\ui-strings.js226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_zh_CN.jar226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.POWERPNT.16.1033.hxn226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files\VideoLAN\VLC\plugins\video_filter\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-text.jar226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ui-strings.js226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jetty.server_8.1.14.v20131031.jar226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\etc\visualvm.conf226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-filesystems.xml226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-favorites.xml226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Common Files\System\ado\msado28.tlb226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\dd_arrow_small.png226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\ui-strings.js226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\it-it\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\FillnSign_visual.svg226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf_3.4.0.v20140827-1444.jar226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jre1.8.0_66\lib\cmm\GRAY.pf226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-phn.xrm-ms226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-oob.xrm-ms226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files\Microsoft Office\root\Office16\Configuration\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\it-it\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Office16\ExcelInterProviderRanker.bin226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Office16\MSOCRRES.ORP226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\vlc.mo226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons_retina.png226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\7-Zip\Lang\zh-tw.txt226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.xml226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_ja_4.4.0.v20140623020002.jar226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-pl.xrm-ms226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\ui-strings.js226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-fr\ui-strings.js226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jre1.8.0_66\lib\ext\nashorn.jar226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files\VideoLAN\VLC\plugins\visualization\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filterselected-down_32.svg226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File created\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hu-hu\RecoveryManual.html226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-oob.xrm-ms226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    File opened for modification\??\c:\Program Files\SyncRegister.css226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
  • Interacts with shadow copies
    vssadmin.exe

    Description

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    Tags

    TTPs

    File DeletionInhibit System Recovery

    Reported IOCs

    pidprocess
    1956vssadmin.exe
  • Modifies registry class
    226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\.EF9E23B4\shell\Open\command226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    Key created\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\.EF9E23B4226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    Key created\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\.EF9E23B4\shell226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    Key created\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\.EF9E23B4\shell\Open226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\.EF9E23B4\shell\Open\command\ = "explorer.exe RecoveryManual.html"226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
  • Suspicious behavior: EnumeratesProcesses
    powershell.exe

    Reported IOCs

    pidprocess
    2216powershell.exe
    2216powershell.exe
    2216powershell.exe
    2216powershell.exe
    2216powershell.exe
    2216powershell.exe
  • Suspicious use of AdjustPrivilegeToken
    226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exepowershell.exevssvc.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege2216powershell.exe
    Token: SeBackupPrivilege2992vssvc.exe
    Token: SeRestorePrivilege2992vssvc.exe
    Token: SeAuditPrivilege2992vssvc.exe
    Token: SeTakeOwnershipPrivilege816226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    Token: SeRestorePrivilege816226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
  • Suspicious use of SetWindowsHookEx
    226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe

    Reported IOCs

    pidprocess
    816226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
  • Suspicious use of WriteProcessMemory
    226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exepowershell.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 816 wrote to memory of 2216816226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exepowershell.exe
    PID 816 wrote to memory of 2216816226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exepowershell.exe
    PID 816 wrote to memory of 2216816226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exepowershell.exe
    PID 2216 wrote to memory of 19562216powershell.exevssadmin.exe
    PID 2216 wrote to memory of 19562216powershell.exevssadmin.exe
    PID 2216 wrote to memory of 19562216powershell.exevssadmin.exe
    PID 816 wrote to memory of 3584816226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.execmd.exe
    PID 816 wrote to memory of 3584816226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.execmd.exe
    PID 816 wrote to memory of 3584816226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.execmd.exe
    PID 3584 wrote to memory of 37163584cmd.exeattrib.exe
    PID 3584 wrote to memory of 37163584cmd.exeattrib.exe
    PID 3584 wrote to memory of 37163584cmd.exeattrib.exe
  • Views/modifies file attributes
    attrib.exe

    Tags

    TTPs

    Hidden Files and Directories

    Reported IOCs

    pidprocess
    3716attrib.exe
Processes 6
  • C:\Users\Admin\AppData\Local\Temp\226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    "C:\Users\Admin\AppData\Local\Temp\226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe"
    Drops desktop.ini file(s)
    Drops file in Program Files directory
    Modifies extensions of user files
    Modifies registry class
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:816
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -windowstyle hidden -c $mypid='816';[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\~259283531.tmp')|iex
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2216
      • C:\Windows\SysWOW64\vssadmin.exe
        "C:\Windows\system32\vssadmin.exe" delete shadows /all /Quiet
        Interacts with shadow copies
        PID:1956
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0F7599B0.bat" "C:\Users\Admin\AppData\Local\Temp\226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe""
      Suspicious use of WriteProcessMemory
      PID:3584
      • C:\Windows\SysWOW64\attrib.exe
        attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe"
        Views/modifies file attributes
        PID:3716
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    Modifies service
    Suspicious use of AdjustPrivilegeToken
    PID:2992
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Discovery
          Execution
            Exfiltration
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • C:\Users\Admin\AppData\Local\Temp\0F7599B0.bat

                      MD5

                      348cae913e496198548854f5ff2f6d1e

                      SHA1

                      a07655b9020205bd47084afd62a8bb22b48c0cdc

                      SHA256

                      c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

                      SHA512

                      799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

                    • C:\Users\Admin\AppData\Local\Temp\~259283531.tmp

                      MD5

                      4e1a1e3e715c291c71950d2fdc79e2be

                      SHA1

                      dc2b3d20a9ec88e0d8d75c5097154687acc42983

                      SHA256

                      acf88b9224ae067d92882d1c8ec1461a663e83f02848488ce125dc0538d87a39

                      SHA512

                      d1be9f6459c248a93c95cc40a68e60ca2fe8068ff4ed5d442437a72bcc09ebf8568e3338d39abebbf3fe8e9e4e3a21a58e1ed6bdbcdd0a3b2ca46b6a81597d80

                    • memory/816-2-0x0000000002BF0000-0x0000000002BFF000-memory.dmp

                    • memory/1956-17-0x0000000000000000-mapping.dmp

                    • memory/2216-13-0x0000000008870000-0x0000000008871000-memory.dmp

                    • memory/2216-7-0x00000000075F0000-0x00000000075F1000-memory.dmp

                    • memory/2216-8-0x0000000007690000-0x0000000007691000-memory.dmp

                    • memory/2216-9-0x0000000007E90000-0x0000000007E91000-memory.dmp

                    • memory/2216-10-0x00000000080E0000-0x00000000080E1000-memory.dmp

                    • memory/2216-11-0x0000000007350000-0x0000000007351000-memory.dmp

                    • memory/2216-12-0x0000000007F00000-0x0000000007F01000-memory.dmp

                    • memory/2216-6-0x00000000077F0000-0x00000000077F1000-memory.dmp

                    • memory/2216-5-0x0000000007020000-0x0000000007021000-memory.dmp

                    • memory/2216-15-0x0000000009D20000-0x0000000009D21000-memory.dmp

                    • memory/2216-16-0x00000000094D0000-0x00000000094D1000-memory.dmp

                    • memory/2216-4-0x0000000073EA0000-0x000000007458E000-memory.dmp

                    • memory/2216-18-0x00000000098A0000-0x00000000098A1000-memory.dmp

                    • memory/2216-19-0x00000000095D0000-0x00000000095D1000-memory.dmp

                    • memory/2216-20-0x000000000A8A0000-0x000000000A8A1000-memory.dmp

                    • memory/2216-3-0x0000000000000000-mapping.dmp

                    • memory/3584-21-0x0000000000000000-mapping.dmp

                    • memory/3716-23-0x0000000000000000-mapping.dmp