Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
23-12-2020 19:31
Static task
static1
Behavioral task
behavioral1
Sample
42ea94ee3adca8b82fba15ecdde25f26.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
42ea94ee3adca8b82fba15ecdde25f26.exe
Resource
win10v20201028
General
-
Target
42ea94ee3adca8b82fba15ecdde25f26.exe
-
Size
214KB
-
MD5
42ea94ee3adca8b82fba15ecdde25f26
-
SHA1
ca17412cd44d186db91c4b2fa7df03363533ffd2
-
SHA256
332bca23e362f6c95326ecc943cb39e93d6fdcf454d72a5e60c9e14f5802ce5a
-
SHA512
cbec5875fdbcd1182ce9cb87728f36f9a36da032589394b20418229780a2182f6641519fd7545bd812257492a0fd9a68ebfd487d6ec5ebb9e3f666558bb81874
Malware Config
Extracted
C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
buran
uspex1@cock.li
uspex2@cock.li
Signatures
-
Buran
Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
Processes:
TrustedInstaller.exeTrustedInstaller.exepid process 576 TrustedInstaller.exe 812 TrustedInstaller.exe -
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
TrustedInstaller.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\RestoreRevoke.tiff TrustedInstaller.exe File opened for modification C:\Users\Admin\Pictures\StepJoin.tiff TrustedInstaller.exe File opened for modification C:\Users\Admin\Pictures\RemoveDisconnect.tiff TrustedInstaller.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1460 notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
42ea94ee3adca8b82fba15ecdde25f26.exepid process 1072 42ea94ee3adca8b82fba15ecdde25f26.exe 1072 42ea94ee3adca8b82fba15ecdde25f26.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
42ea94ee3adca8b82fba15ecdde25f26.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\TrustedInstaller.exe\" -start" 42ea94ee3adca8b82fba15ecdde25f26.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run 42ea94ee3adca8b82fba15ecdde25f26.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
TrustedInstaller.exedescription ioc process File opened (read-only) \??\F: TrustedInstaller.exe File opened (read-only) \??\V: TrustedInstaller.exe File opened (read-only) \??\U: TrustedInstaller.exe File opened (read-only) \??\R: TrustedInstaller.exe File opened (read-only) \??\Q: TrustedInstaller.exe File opened (read-only) \??\P: TrustedInstaller.exe File opened (read-only) \??\L: TrustedInstaller.exe File opened (read-only) \??\H: TrustedInstaller.exe File opened (read-only) \??\G: TrustedInstaller.exe File opened (read-only) \??\Z: TrustedInstaller.exe File opened (read-only) \??\W: TrustedInstaller.exe File opened (read-only) \??\N: TrustedInstaller.exe File opened (read-only) \??\M: TrustedInstaller.exe File opened (read-only) \??\K: TrustedInstaller.exe File opened (read-only) \??\I: TrustedInstaller.exe File opened (read-only) \??\A: TrustedInstaller.exe File opened (read-only) \??\Y: TrustedInstaller.exe File opened (read-only) \??\T: TrustedInstaller.exe File opened (read-only) \??\S: TrustedInstaller.exe File opened (read-only) \??\J: TrustedInstaller.exe File opened (read-only) \??\E: TrustedInstaller.exe File opened (read-only) \??\X: TrustedInstaller.exe File opened (read-only) \??\O: TrustedInstaller.exe File opened (read-only) \??\B: TrustedInstaller.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 geoiptool.com -
Drops file in Program Files directory 15046 IoCs
Processes:
TrustedInstaller.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00076_.WMF TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLOOK_COL.HXC TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\ChessIconImagesMask.bmp.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OFFLINE.ICO.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14528_.GIF.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL.DEV.HXS TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF.97C-605-5F5 TrustedInstaller.exe File created C:\Program Files\7-Zip\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT TrustedInstaller.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Shanghai.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\zipfs.jar TrustedInstaller.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\main.css.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\TexturedBlue.css.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BANNER.DPV TrustedInstaller.exe File created C:\Program Files\VideoLAN\VLC\plugins\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01046J.JPG.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0335112.WMF.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\TaskbarIconImagesMask256Colors.bmp TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR49F.GIF.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl.css TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGATNGET.DPV TrustedInstaller.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Chita TrustedInstaller.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00319_.WMF.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143748.GIF.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107450.WMF.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145707.JPG.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00914_.WMF TrustedInstaller.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png TrustedInstaller.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm.html.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0252349.WMF TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBrowserUpgrade.html.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\DRUMROLL.WAV TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue.css.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.zh_CN_5.5.0.165303.jar TrustedInstaller.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_zh_CN.jar.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105506.WMF.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TR00006_.WMF TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\ACT3.SAM.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guayaquil TrustedInstaller.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Easter.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Country.gif.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_justify.gif.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\COIN.WAV.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\INDST_01.MID TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATHEDITOR_F_COL.HXK TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\MarkupIconImagesMask.bmp.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01660_.WMF.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107280.WMF.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02227_.WMF TrustedInstaller.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.properties TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_OFF.GIF.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\TAB_ON.GIF TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\UrbanFax.Dotx.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe.97C-605-5F5 TrustedInstaller.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EET TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01139_.WMF TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099197.GIF TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195772.WMF TrustedInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18256_.WMF TrustedInstaller.exe File opened for modification C:\Program Files\Java\jre7\lib\javaws.jar.97C-605-5F5 TrustedInstaller.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1088 vssadmin.exe 1188 vssadmin.exe -
Processes:
42ea94ee3adca8b82fba15ecdde25f26.exeTrustedInstaller.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 42ea94ee3adca8b82fba15ecdde25f26.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 42ea94ee3adca8b82fba15ecdde25f26.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 42ea94ee3adca8b82fba15ecdde25f26.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 TrustedInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e TrustedInstaller.exe -
Suspicious use of AdjustPrivilegeToken 86 IoCs
Processes:
42ea94ee3adca8b82fba15ecdde25f26.exeWMIC.exeWMIC.exevssvc.exedescription pid process Token: SeDebugPrivilege 1072 42ea94ee3adca8b82fba15ecdde25f26.exe Token: SeDebugPrivilege 1072 42ea94ee3adca8b82fba15ecdde25f26.exe Token: SeIncreaseQuotaPrivilege 1060 WMIC.exe Token: SeSecurityPrivilege 1060 WMIC.exe Token: SeTakeOwnershipPrivilege 1060 WMIC.exe Token: SeLoadDriverPrivilege 1060 WMIC.exe Token: SeSystemProfilePrivilege 1060 WMIC.exe Token: SeSystemtimePrivilege 1060 WMIC.exe Token: SeProfSingleProcessPrivilege 1060 WMIC.exe Token: SeIncBasePriorityPrivilege 1060 WMIC.exe Token: SeCreatePagefilePrivilege 1060 WMIC.exe Token: SeBackupPrivilege 1060 WMIC.exe Token: SeRestorePrivilege 1060 WMIC.exe Token: SeShutdownPrivilege 1060 WMIC.exe Token: SeDebugPrivilege 1060 WMIC.exe Token: SeSystemEnvironmentPrivilege 1060 WMIC.exe Token: SeRemoteShutdownPrivilege 1060 WMIC.exe Token: SeUndockPrivilege 1060 WMIC.exe Token: SeManageVolumePrivilege 1060 WMIC.exe Token: 33 1060 WMIC.exe Token: 34 1060 WMIC.exe Token: 35 1060 WMIC.exe Token: SeIncreaseQuotaPrivilege 548 WMIC.exe Token: SeSecurityPrivilege 548 WMIC.exe Token: SeTakeOwnershipPrivilege 548 WMIC.exe Token: SeLoadDriverPrivilege 548 WMIC.exe Token: SeSystemProfilePrivilege 548 WMIC.exe Token: SeSystemtimePrivilege 548 WMIC.exe Token: SeProfSingleProcessPrivilege 548 WMIC.exe Token: SeIncBasePriorityPrivilege 548 WMIC.exe Token: SeCreatePagefilePrivilege 548 WMIC.exe Token: SeBackupPrivilege 548 WMIC.exe Token: SeRestorePrivilege 548 WMIC.exe Token: SeShutdownPrivilege 548 WMIC.exe Token: SeDebugPrivilege 548 WMIC.exe Token: SeSystemEnvironmentPrivilege 548 WMIC.exe Token: SeRemoteShutdownPrivilege 548 WMIC.exe Token: SeUndockPrivilege 548 WMIC.exe Token: SeManageVolumePrivilege 548 WMIC.exe Token: 33 548 WMIC.exe Token: 34 548 WMIC.exe Token: 35 548 WMIC.exe Token: SeBackupPrivilege 316 vssvc.exe Token: SeRestorePrivilege 316 vssvc.exe Token: SeAuditPrivilege 316 vssvc.exe Token: SeIncreaseQuotaPrivilege 548 WMIC.exe Token: SeSecurityPrivilege 548 WMIC.exe Token: SeTakeOwnershipPrivilege 548 WMIC.exe Token: SeLoadDriverPrivilege 548 WMIC.exe Token: SeSystemProfilePrivilege 548 WMIC.exe Token: SeSystemtimePrivilege 548 WMIC.exe Token: SeProfSingleProcessPrivilege 548 WMIC.exe Token: SeIncBasePriorityPrivilege 548 WMIC.exe Token: SeCreatePagefilePrivilege 548 WMIC.exe Token: SeBackupPrivilege 548 WMIC.exe Token: SeRestorePrivilege 548 WMIC.exe Token: SeShutdownPrivilege 548 WMIC.exe Token: SeDebugPrivilege 548 WMIC.exe Token: SeSystemEnvironmentPrivilege 548 WMIC.exe Token: SeRemoteShutdownPrivilege 548 WMIC.exe Token: SeUndockPrivilege 548 WMIC.exe Token: SeManageVolumePrivilege 548 WMIC.exe Token: 33 548 WMIC.exe Token: 34 548 WMIC.exe -
Suspicious use of WriteProcessMemory 55 IoCs
Processes:
42ea94ee3adca8b82fba15ecdde25f26.exeTrustedInstaller.execmd.execmd.execmd.exedescription pid process target process PID 1072 wrote to memory of 576 1072 42ea94ee3adca8b82fba15ecdde25f26.exe TrustedInstaller.exe PID 1072 wrote to memory of 576 1072 42ea94ee3adca8b82fba15ecdde25f26.exe TrustedInstaller.exe PID 1072 wrote to memory of 576 1072 42ea94ee3adca8b82fba15ecdde25f26.exe TrustedInstaller.exe PID 1072 wrote to memory of 576 1072 42ea94ee3adca8b82fba15ecdde25f26.exe TrustedInstaller.exe PID 1072 wrote to memory of 1460 1072 42ea94ee3adca8b82fba15ecdde25f26.exe notepad.exe PID 1072 wrote to memory of 1460 1072 42ea94ee3adca8b82fba15ecdde25f26.exe notepad.exe PID 1072 wrote to memory of 1460 1072 42ea94ee3adca8b82fba15ecdde25f26.exe notepad.exe PID 1072 wrote to memory of 1460 1072 42ea94ee3adca8b82fba15ecdde25f26.exe notepad.exe PID 1072 wrote to memory of 1460 1072 42ea94ee3adca8b82fba15ecdde25f26.exe notepad.exe PID 1072 wrote to memory of 1460 1072 42ea94ee3adca8b82fba15ecdde25f26.exe notepad.exe PID 1072 wrote to memory of 1460 1072 42ea94ee3adca8b82fba15ecdde25f26.exe notepad.exe PID 576 wrote to memory of 1816 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 1816 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 1816 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 1816 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 640 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 640 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 640 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 640 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 1572 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 1572 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 1572 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 1572 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 1700 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 1700 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 1700 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 1700 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 460 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 460 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 460 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 460 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 1628 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 1628 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 1628 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 1628 576 TrustedInstaller.exe cmd.exe PID 576 wrote to memory of 812 576 TrustedInstaller.exe TrustedInstaller.exe PID 576 wrote to memory of 812 576 TrustedInstaller.exe TrustedInstaller.exe PID 576 wrote to memory of 812 576 TrustedInstaller.exe TrustedInstaller.exe PID 576 wrote to memory of 812 576 TrustedInstaller.exe TrustedInstaller.exe PID 1816 wrote to memory of 1060 1816 cmd.exe WMIC.exe PID 1816 wrote to memory of 1060 1816 cmd.exe WMIC.exe PID 1816 wrote to memory of 1060 1816 cmd.exe WMIC.exe PID 1816 wrote to memory of 1060 1816 cmd.exe WMIC.exe PID 460 wrote to memory of 1188 460 cmd.exe vssadmin.exe PID 460 wrote to memory of 1188 460 cmd.exe vssadmin.exe PID 460 wrote to memory of 1188 460 cmd.exe vssadmin.exe PID 460 wrote to memory of 1188 460 cmd.exe vssadmin.exe PID 1628 wrote to memory of 548 1628 cmd.exe WMIC.exe PID 1628 wrote to memory of 548 1628 cmd.exe WMIC.exe PID 1628 wrote to memory of 548 1628 cmd.exe WMIC.exe PID 1628 wrote to memory of 548 1628 cmd.exe WMIC.exe PID 1628 wrote to memory of 1088 1628 cmd.exe vssadmin.exe PID 1628 wrote to memory of 1088 1628 cmd.exe vssadmin.exe PID 1628 wrote to memory of 1088 1628 cmd.exe vssadmin.exe PID 1628 wrote to memory of 1088 1628 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42ea94ee3adca8b82fba15ecdde25f26.exe"C:\Users\Admin\AppData\Local\Temp\42ea94ee3adca8b82fba15ecdde25f26.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe" -start2⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe" -agent 03⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\notepad.exenotepad.exe3⤵
-
C:\Windows\SysWOW64\notepad.exenotepad.exe2⤵
- Deletes itself
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CBMD5
4e19bf0c03ce3953fdb5be54e6a22f35
SHA1385b3bebf4d6df49a2d99ee9486921bb6bebfed8
SHA256f4f869d5f04bba7bfed5ce6a0f32037621f46ef35afcb8cf6a9bb2a9c181edfe
SHA51223bb6feb476ec5ef55fe7b1544fc9cf2bda0c14798070897f90a0a6df062dbe57109de99caac0e32c0586b41de51b11170484abfd0e297372cd392858e3426a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEEMD5
75b88d0202e859a52bf202eafebbe0c4
SHA124a1603ccba645ded249983df14897803b538fb6
SHA256835effde837d6182dd65867cb76119b6418ffa6868ab235dbbdc028ddb32ca20
SHA512a37db7e053e819850b013862ce105e74a078081dd99bfe672406c9c3cba68f8e2e8cf7edea98402785e1751ddc0b21f5842b7be2873e8664bfd416cb20bee1f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
71938f18af4460ae7dfc95eaa7f86c41
SHA13c728520871d891f4ed95ae676fb4ef7d2202f45
SHA256577745264b01a9e92767ed05946bf7825077e8303874f32893c09443c66cde65
SHA512679f66ace333ec45c4541a226e482059f3fed3dcbd6b005c77fc8458f2c241294a95d6e3a6972e84978ce291eacec23c22f5e5295b5155b874cf5fcb53c8474c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CBMD5
3fc2d2222f4b1fbaa147af7fe0a2d257
SHA18b2d1ac402716cd3117f0cbc1f77bec71c908037
SHA2561ef4aa55b1053d27658cc9af38c180b14b253ff98b9990598e15e50dcb8d1b5b
SHA512e3ceef88cdf9ea2c15c589004249f83f94b77cd11e6f969836402a70e7f50cf385a38d547ca172b00b5ae8fe1112761f3762d44ad27a4809b3991836f90d6c02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEEMD5
306f0acdaeda4b6fa4ee7e0ff14c9c66
SHA1b136a05887f4bbde922e33456e429433ace7b9e9
SHA25624b12ee7970420913cedd14ca91348b712cbed29f2262948e8373b6304ed81e7
SHA512f6345c0cc21d11e082f867b519105999c98f9ae12b68a910380bffb4b9e49230f22bb28b27aef1653b900146684fe4dbba4b00cf27da66dc5d1baf52f77bbde1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
e1bfe6682d4cf02a279a877dac241e8d
SHA11ca4b55964a91e4ce1c541a806cd47543c0627c3
SHA25609cbbaeb2f05f5b0b75a962f26cee4a32d43fab5c584edb3e15ad510c89d5c6d
SHA512aadf153575bfcc56968907ffce7b6afa420ca19a68ac35344ed60450763c9786b9217ad9ef11e333c11b0717e31daea62626070c8a573cf4316f4bb38f5db361
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
3197ac0aa1ca7c0ce3be5c3d1dfadfbd
SHA13bccda379551b7b6ae12fd96746c8e97369a2e39
SHA25694dc3cde36785ce21cc717a03b8667cd707e47423878748f15c3c8ebac4f3af7
SHA512efb9d323c0839a798b851ab51f1f369ca9b4f77984db43cc6277e66f2cc83a52f4d0c0b4e8a429fb3dd531d36046d9ff5c4701f929a62eafeda2417c157e4322
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3O0J2C38\VHQQT43W.htmMD5
8615e70875c2cc0b9db16027b9adf11d
SHA14ed62cf405311c0ff562a3c59334a15ddc4f1bf9
SHA256da96949ba6b0567343f144486505c8c8fa1d892fd88c9cbc3ef3d751a570724d
SHA512cd9dfc88dc2af9438b7d6b618d1b62029b3bdf739fc4daa5b37397afd12c4528561b3bf2fc3f3f2adf3fd1f582d5524332441fd30248fcd078e41aa91e17cb73
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7ISB2KAC\JGHAK302.htmMD5
b1cd7c031debba3a5c77b39b6791c1a7
SHA1e5d91e14e9c685b06f00e550d9e189deb2075f76
SHA25657ba053f075e0b80f747f3102ed985687c16a8754d109e7c4d33633269a36aaa
SHA512d2bbefdc1effb52a38964c4cec5990a5a226248eca36f99e446c0c5704436f666bf1cb514e73b8991411d497d3325ecc646cbd5065c364e92ab6b9c5f1ad4a72
-
C:\Users\Admin\AppData\Local\Temp\~temp001.batMD5
ef572e2c7b1bbd57654b36e8dcfdc37a
SHA1b84c4db6d0dfd415c289d0c8ae099aea4001e3b7
SHA256e6e609db3f387f42bfd16dd9e5695ddc2b73d86ae12baf4f0dfc4edda4a96a64
SHA512b8c014b242e8e8f42da37b75fe96c52cd25ebd366d0b5103bcba5ac041806d13142a62351edecdee583d494d2a120f9b330f6229b1b5fe820e1c7d98981089e9
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exeMD5
42ea94ee3adca8b82fba15ecdde25f26
SHA1ca17412cd44d186db91c4b2fa7df03363533ffd2
SHA256332bca23e362f6c95326ecc943cb39e93d6fdcf454d72a5e60c9e14f5802ce5a
SHA512cbec5875fdbcd1182ce9cb87728f36f9a36da032589394b20418229780a2182f6641519fd7545bd812257492a0fd9a68ebfd487d6ec5ebb9e3f666558bb81874
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exeMD5
42ea94ee3adca8b82fba15ecdde25f26
SHA1ca17412cd44d186db91c4b2fa7df03363533ffd2
SHA256332bca23e362f6c95326ecc943cb39e93d6fdcf454d72a5e60c9e14f5802ce5a
SHA512cbec5875fdbcd1182ce9cb87728f36f9a36da032589394b20418229780a2182f6641519fd7545bd812257492a0fd9a68ebfd487d6ec5ebb9e3f666558bb81874
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exeMD5
42ea94ee3adca8b82fba15ecdde25f26
SHA1ca17412cd44d186db91c4b2fa7df03363533ffd2
SHA256332bca23e362f6c95326ecc943cb39e93d6fdcf454d72a5e60c9e14f5802ce5a
SHA512cbec5875fdbcd1182ce9cb87728f36f9a36da032589394b20418229780a2182f6641519fd7545bd812257492a0fd9a68ebfd487d6ec5ebb9e3f666558bb81874
-
C:\Users\Admin\Desktop\CloseStart.ttc.97C-605-5F5MD5
9e2e4068d7389a0cd468e7e4c852389c
SHA1723f6e967be27453df93a0d056793fc687acfb7d
SHA25607e19573fcd0942a0acb040ae8601bb4399685a36678ca836618ab9a424b5ccb
SHA512535cb3e78cd567f39a26757faa015dfdc7767f3858cf64f16ad1a4b16c06295542ea3a4e60238e10b12774b89e985e3507e5a1567f28b72a9fb361ba4ef44bd8
-
C:\Users\Admin\Desktop\CompareFind.docx.97C-605-5F5MD5
fe4604da29e769e78f48cc1e5eeca10f
SHA1c2e878cc8e15c9567ab5dba59f99d0435d3b0a6e
SHA256a6742d31628fa3e5aba348da91bf02d7667a4142d23193617a8257d92bd51ec3
SHA512b8695cb309c7d68f777a0a32030ee672118e3d9fe39214edf38ecf58ecf73137b70f9be2125882d1e8d146ea7f54a45b2e3a3f4ea6d2df798974ee928a6057ae
-
C:\Users\Admin\Desktop\CompleteStep.ico.97C-605-5F5MD5
6b94f23b1ceb9f5fdf97096cd2fcefdc
SHA16669460c1d020290a8ad4fbca102bbddcfd5dbdb
SHA2561d776ebd125b0fc7f43df2e29788204ee9a3897e1ac029364a37f4eafc3017aa
SHA51276d8997cc47ab4a5351000664ed982c63eb78e1955cb7b67fae7ea63044d544fa8f70870979055695cee00fe5896f9fee76f751a4ffd2c9e9f9b72bca131f183
-
C:\Users\Admin\Desktop\ConvertToGrant.vsw.97C-605-5F5MD5
e2eafaff57ca6b94594915fc3bf4a991
SHA1ae3ed0257c51f9b977d84119f6892488e2be3608
SHA256a4a5032775f0e6cf2319b4249ac85ccea17e9741fcd7efab438a944d366f3650
SHA51249d21a2cf3283eb3595b4db30d066dec65bba7d0ad462082b3cf6a61554628e0e024e395d03d044099620f81ccbfa2aeec7c9cd29c130a8aa14aabe66d409a48
-
C:\Users\Admin\Desktop\ConvertUninstall.eprtx.97C-605-5F5MD5
3a828daff9b6bbcc017f3420eeaab645
SHA1c460ef1a11ee799ebf968146296d8f09efbb0bcb
SHA2560bbe16c686dc702dc27e0f40de6c87b7be66ec27d19d1bc93754452b1203f51d
SHA512e4e437c7b2b3deb9ce11a1f8d3f249dcaf1794ec57ec690a00517f9280dadf3d05a7066f84c87dd203ac1dbfebfa1c749dc0fc443055d42e852931a39e99be7f
-
C:\Users\Admin\Desktop\DisconnectPop.xltx.97C-605-5F5MD5
c35fe65aa97ee58ab3d9ac5deac74e2d
SHA158c91724bf9e6c9544710f2c2d070f3ccdcbfb2d
SHA2564e70106524322a534815f5b224d29ef4ba979d51af345a502729bf4bbeee67fc
SHA512a6815bc08fac5d6fcbdb1a027814b9a9ab5cba3c0b302c4762b6b3b514633cda7a1395fc12ea3739fdc98bb28018cd6e6da559efc7d8af130fe49ecebf3c6320
-
C:\Users\Admin\Desktop\EditSave.cab.97C-605-5F5MD5
a9479acca4cc7ceb1f5be254481cc8ad
SHA1aecaa718fdae24e8ed2a05fc7d3ee7ce9f651856
SHA256c346aaf5be5456ba442ad9be797ff203def5eba83e514cb1db47987ba11ec419
SHA51220f7f3ee7bc5636395df2e73daf258324bdcb39413acb7be29f5d4c7bdb9d5749c7b20eb070c2a8a3a77a22d0e848b91f4c32a69497320328cfdde333267017d
-
C:\Users\Admin\Desktop\EnableAdd.zip.97C-605-5F5MD5
2f996b23a85afdc04580751f2e6c55a6
SHA1a8968b1025e23e0f445e95e276be141d5b814857
SHA25604ecebc818305fd1b348a042cd5e5762996b9026f955e7c485fa8352e0b7cd0e
SHA51256e2b613781d54c86a7447db58a6196005faa841fc3b1f8a1ea5398f74dace40d1b20b4f5fd3864c533c59fc3054577e31c1698e719abc62bb06576c2a0a7ce9
-
C:\Users\Admin\Desktop\ExitResolve.au.97C-605-5F5MD5
244312be245764776b443c9430c22740
SHA17746affcb61ca9edcfc86fa05bb9c19bd08ff22b
SHA25621cc1d1f8909a9e4c21f4e8aec53efcf222a018c4a695ce22b96d159ad569315
SHA512e1777f6b9b6b891dfe812a268ac5ae5a0690d7cd16b7f52a0296e4a64c3439397ce5414e360fc66504875ba4858fca63f6dcd37f89ca6ce33ddd24fb0880cca6
-
C:\Users\Admin\Desktop\HideCheckpoint.svgz.97C-605-5F5MD5
b367369a3e690bee86f80e1abf7b36fc
SHA1c630a2bd4e730945e3455d76e88db2411ce91cc1
SHA25620fbcdb730a5d5ab371a37823c8b526fa82e08aec094b4f302eb0ba29959e4f6
SHA51241c797358f7263a8c2f028eb044cdd4506d7ac4f49946e7c3276ba42815067ab370e53ca0b7bf9ee60c13285eba2b9e9e93437ceb8162ad7c927d64a33e9f3b6
-
C:\Users\Admin\Desktop\ImportCompare.wvx.97C-605-5F5MD5
17dcb1057d9967eab41758049c15a121
SHA19506fed1b35ce38f1c1de1d0b47f6372956c47ff
SHA2560ad50f080a7e86b84ff5f33bcf67b4465a46c51951c223c5aab70e26e43a2893
SHA512802f27de5b98149f89535c487a39c12f190b4abd4968ee5e457c46cd41d459d2f0c79ce9144d092d3540031862d06b0f8618a980e4014f78971d8703b116547d
-
C:\Users\Admin\Desktop\LockFind.php.97C-605-5F5MD5
1349fac4f130dfbea31ec0a34a3f4779
SHA17ec85e4dae84bf943c2fe0cd5c73c3b22eb5f70b
SHA2566da75a594d2840ab7df2a697f47b6f97bc13d1af882481966213a6cc857a27b3
SHA5124bebf76c4e3ae363b8e4a24eee9856f59de0e2c3965fda46643d54cbbb493440cf8e4b1bc87385009f44a9e0ad79669c12b8397ad4815989c17a5fb3cbdbf8a4
-
C:\Users\Admin\Desktop\MergeStop.ex_.97C-605-5F5MD5
3314c5997f009c46af2871db985ca92b
SHA1e384a44b84b68d5e87d80700c33b334df52ab6f7
SHA256368460b0fe9131193de7c2667c00d5cd073e7840812e71b880f82f21f9d3f467
SHA51205a97409533188810742de833522fd6d9a3cce8978d8640091c7a18ed1b02a862bb2528dfbcaa6a1bb9d8defc4fab58d60d6a09206e3c66965d84d7a1e213c75
-
C:\Users\Admin\Desktop\RegisterExpand.DVR.97C-605-5F5MD5
284c402213fb17de929d94aed95524d4
SHA1c7945cd4c71b278d3c09fcb393df272a46c15bb1
SHA256ba97c6455027438e9db21dee55ba0b2237eaadf1605e9b4eea53c095e9b7af3a
SHA5122befe7779d348f808582843d0d92066a295e74aeeb52ddc859cd3c00fb783987220a80b45ceb2a46a5dce22c030e01563dc335a8074c5634b54a000b668a76cd
-
C:\Users\Admin\Desktop\RestartRedo.m3u.97C-605-5F5MD5
00633c1bad568954ba51f7091d313ebc
SHA13e5a418a2442d2b675345b10c73602fb0679a1cf
SHA2565dcda620b9ece67bf435ad5c7792b8259f66c55fc63a708c32217dbe8c488bff
SHA5129a33b181162be92bdaaab9e50b6111314f0de325680b2c0a877855866d8849efca67f137ce476a06965cc0c81ad9de415a55b79c9c078f952bc090d5f8108f04
-
C:\Users\Admin\Desktop\RestoreStep.jfif.97C-605-5F5MD5
ff7f1f7980ad6e7ce076c60da1b626db
SHA17d508a258eff7618e335e24b6a63d0dc6a97ba24
SHA256f8f54b2f0eac603ca97eb381643b5e2cf849075126cf9f14bd450bdcb24a38bc
SHA512a6d330f304460786a2754235e75507444aa8d21407a0e3da862cf523de5c3948c7e7ab4f0da0833166e6f2ab99344e8bedd3108e79bd61fde7a10ae9a106e0ba
-
C:\Users\Admin\Desktop\SendRedo.vb.97C-605-5F5MD5
4406764d0e6ef883eb532e82c4168577
SHA13773136bc858d4204e9eca605248b8d7e04d4c26
SHA2567b117aaf894160f41d522859e0eeaa6d67383726bcfac7d1141072e4b5fce108
SHA51234c5f22a361706da1d8486a5038e525eb0da976a7ac8fdf44fcfe3ae312d7e4f1b4221b644b073e9339e70d03b61e58b40be679290e7d6c82e68bdc8c3d1fb9f
-
C:\Users\Admin\Desktop\ShowSave.tif.97C-605-5F5MD5
e7ed2b846530b80a5c4070a97cbdd9d3
SHA15ef8d2d7cfabfe04123242a290cd89bf8a4808fd
SHA2560657077ef4564a3d65a0eac9c8be85a4f135c93789f6af6294684250b77f0021
SHA5126354552a23b8101e0e788942a091c024e39e7cb56a2f831a7fb1741d5837029f624bbd9f6ee81d97c564a110615d10b6e7aebc7f75355d353928c9e43a76b7db
-
C:\Users\Admin\Desktop\SuspendProtect.TS.97C-605-5F5MD5
6f22bc182fc3e838c2bceb1f71d749ab
SHA12ae6d7b48a437f464a01b6df52bfc6742a3c90ba
SHA25647beea45fc5f3c9aa4e0b4e6f6ddafe3785a35a6d3481ff28ec3116c1e1b8ab0
SHA5125dfaee0a58dd2bbdce6324a5768149a55c02769d9ecaa6b18837fd3b7b6c20e73ef252bc18940a5bd8f6ef4fd42e2753b2fca4d4d18090483b2042bd66af0ca0
-
C:\Users\Admin\Desktop\UndoDisable.easmx.97C-605-5F5MD5
b2f14907c252fa4dc0cb0bbfda21866a
SHA1ff0af2d936a4d712d0184bf17b3379bbda5eaaf3
SHA2564e73138f71773ec62a0c4451cd87078bc8ef576572df05d7726dac5976f1be5c
SHA5121e03d887c00bc1da006b6ccbb53d53cb326b03e7cc7efa2e9edafcc0b73b42ddde010e9376b1f48a1430c3b33382f5feaa72da942b36ddf4ea81aef9771a4dba
-
C:\Users\Admin\Desktop\UninstallUse.rtf.97C-605-5F5MD5
76f58a85c0813413db3d23362b85ff25
SHA13d825ca76b73edae2e5631f6aee3dc6056e82c1d
SHA25680322ba8defd33df1d5aa9963ca3e3f4efb9fc396c64636f35bbb0fcebbf1acd
SHA5128f13e98007a1ce8aa7cc3a02969a9ffc03205a6ef02593947fc9cb14c34ac26923025a233409f16c39e5957fc5047ac201082468349346e9310d1ab6d5882741
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exeMD5
42ea94ee3adca8b82fba15ecdde25f26
SHA1ca17412cd44d186db91c4b2fa7df03363533ffd2
SHA256332bca23e362f6c95326ecc943cb39e93d6fdcf454d72a5e60c9e14f5802ce5a
SHA512cbec5875fdbcd1182ce9cb87728f36f9a36da032589394b20418229780a2182f6641519fd7545bd812257492a0fd9a68ebfd487d6ec5ebb9e3f666558bb81874
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exeMD5
42ea94ee3adca8b82fba15ecdde25f26
SHA1ca17412cd44d186db91c4b2fa7df03363533ffd2
SHA256332bca23e362f6c95326ecc943cb39e93d6fdcf454d72a5e60c9e14f5802ce5a
SHA512cbec5875fdbcd1182ce9cb87728f36f9a36da032589394b20418229780a2182f6641519fd7545bd812257492a0fd9a68ebfd487d6ec5ebb9e3f666558bb81874
-
memory/460-22-0x0000000000000000-mapping.dmp
-
memory/548-30-0x0000000000000000-mapping.dmp
-
memory/576-5-0x0000000000000000-mapping.dmp
-
memory/640-19-0x0000000000000000-mapping.dmp
-
memory/672-2-0x000007FEF7800000-0x000007FEF7A7A000-memory.dmpFilesize
2.5MB
-
memory/812-25-0x0000000000000000-mapping.dmp
-
memory/1060-27-0x0000000000000000-mapping.dmp
-
memory/1088-31-0x0000000000000000-mapping.dmp
-
memory/1188-28-0x0000000000000000-mapping.dmp
-
memory/1460-8-0x0000000000000000-mapping.dmp
-
memory/1460-7-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/1572-20-0x0000000000000000-mapping.dmp
-
memory/1628-23-0x0000000000000000-mapping.dmp
-
memory/1700-21-0x0000000000000000-mapping.dmp
-
memory/1816-18-0x0000000000000000-mapping.dmp