neshta | a4008ecc4d4ff0cb00b21beb49dfd9ff74f21dac59d7d9495f7556af02e09196

Analysis

max time kernel
539s
max time network
375s
platform
windows10_x64
resource
win10-en-20211208
submitted
31-01-2022 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fast.exe
Size

96KB
MD5

450530b6fe77db0c5283fdbc8461a6b5
SHA1

0f6d22fd7a5b78ae62d048d9d648f954a06b7a22
SHA256

a4008ecc4d4ff0cb00b21beb49dfd9ff74f21dac59d7d9495f7556af02e09196
SHA512

f2239705b8ae7aaf42ae4a4f3b28550539f08cd5b7c7e351b81892c205200c1a6786169d8bd3090b6a825c742df20277fda0f64e369739657f8d9cfd5d384c7d

Score

10^/10

neshta phobos evasion persistence ransomware spyware stealer

Malware Config

Signatures

Detect Neshta Payload 49 IoCs

Processes:

resource	yara_rule
C:\Windows\svchost.com	family_neshta
C:\Windows\svchost.com	family_neshta
C:\odt\OFFICE~1.EXE	family_neshta
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	family_neshta
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	family_neshta
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	family_neshta
C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	family_neshta
C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	family_neshta
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	family_neshta
C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	family_neshta
C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	family_neshta
C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	family_neshta
C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe	family_neshta
C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	family_neshta
C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	family_neshta
C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	family_neshta
C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	family_neshta
C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	family_neshta
C:\PROGRA~2\Google\Update\DISABL~1.EXE	family_neshta
C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\Fast.exe	family_neshta
C:\Users\Admin\AppData\Local\Fast.exe	family_neshta
C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE	family_neshta
C:\Users\Admin\AppData\Local\Fast.exe	family_neshta
C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\181510~1.001\FILESY~1.EXE	family_neshta
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Fast.exe	family_neshta
C:\Users\ALLUSE~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	family_neshta
C:\Users\ALLUSE~1\Adobe\Setup\{AC76B~1\setup.exe	family_neshta
C:\Users\ALLUSE~1\MICROS~1\Windows\STARTM~1\Programs\Startup\Fast.exe	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE	family_neshta
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	family_neshta
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	family_neshta
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	family_neshta
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	family_neshta
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	family_neshta
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	family_neshta
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	family_neshta
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	family_neshta
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	family_neshta
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	family_neshta
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	family_neshta
C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateCore.exe	family_neshta
C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdate.exe	family_neshta
C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler.exe	family_neshta
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	family_neshta
C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	family_neshta
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe	family_neshta
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe	family_neshta
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe	family_neshta

Modifies system executable filetype association 2 TTPs 1 IoCs
persistence

Modify Registry
T1112

Change Default File Association
T1042

Processes:

Fast.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Fast.exe
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

3436 bcdedit.exe
3044 bcdedit.exe
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

2700 wbadmin.exe
Executes dropped EXE 3 IoCs

Processes:

Fast.exeFast.exesvchost.com

pid process

852 Fast.exe
3504 Fast.exe
996 svchost.com
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
ransomware

Processes:

Fast.exe

description ioc process

File opened for modification C:\Users\Admin\Pictures\ConvertSkip.tiff Fast.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	Fast.exe

pid	process
3436	bcdedit.exe
3044	bcdedit.exe

pid	process
2700	wbadmin.exe

pid	process
852	Fast.exe
3504	Fast.exe
996	svchost.com

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\ConvertSkip.tiff	Fast.exe

Drops startup file 3 IoCs

Processes:

Fast.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	Fast.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\Fast.exe	Fast.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Fast.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fast = "C:\\Users\\Admin\\AppData\\Local\\Fast.exe"	Fast.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fast = "C:\\Users\\Admin\\AppData\\Local\\Fast.exe"	Fast.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

Fast.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	Fast.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	Fast.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	Fast.exe
File opened for modification	C:\Program Files\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	Fast.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	Fast.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-369956170-74428499-1628131376-1000\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	Fast.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	Fast.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	Fast.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	Fast.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	Fast.exe

Drops file in Program Files directory 64 IoCs

Processes:

Fast.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.alert.zh_CN_5.5.0.165303.jar.id[9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_zh_4.4.0.v20140623020002.jar.id[9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.id[9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\Add-Numbers.Tests.ps1	Fast.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.SF	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	Fast.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-cn\ui-strings.js.id[9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-100_contrast-high.png	Fast.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\gimap.jar	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Microsoft.Packaging.RichJPG.dll	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms	Fast.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SyncFusion.Grid.Base.dll.id[9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar.id[9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File opened for modification	C:\Program Files\Windows Defender\MpUXSrv.exe	Fast.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Fast.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\QUAD.INF.id[9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	Fast.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\openssl64.dlla.manifest.id[9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\_Resources\3.rsrc	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Workflow\NavColumn_Black\Icon_Printer.png	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\ga_16x11.png	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-48_altform-unplated.png	Fast.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2017.125.40.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.scale-200.png	Fast.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\s_empty_folder_state.svg	Fast.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldMatch.snippets.ps1xml	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WIND.WAV	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\6478_40x40x32.png	Fast.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.GRAPH.16.1033.hxn.id[9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5313_24x24x32.png	Fast.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.id[9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\toivo.png	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-24.png	Fast.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAME.DLL.id[9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\gf_60x42.png	Fast.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\bin\java_crw_demo.dll.id[9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_super.gif	Fast.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover_2x.png	Fast.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected][9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Speech.resources.dll	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-16.png	Fast.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\illustrations.png	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ul-oob.xrm-ms	Fast.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png.id[9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msproof7.dll.id[9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\tr-tr\ui-strings.js.id[9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\kn.pak.id[9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-private-l1-1-0.dll	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\MicrosoftAccount.scale-140.png	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-20_altform-unplated_contrast-black.png	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe\Assets\contrast-black\MusicStoreLogo.scale-150_contrast-black.png	Fast.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\ant-javafx.jar.id[9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\packager.jar	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\2_32x32x32.png	Fast.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hr-hr\ui-strings.js.id[9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-phn.xrm-ms.id[9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSmallTile.scale-150.png	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-80.png	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Autumn\mask\1h.png	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\my_60x42.png	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\MapsAppList.targetsize-36_altform-unplated.png	Fast.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.id[9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\example_icons2x.png.id[9CDCF7C7-3009].[[email protected]].makop	Fast.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupSmallTile.scale-125.png	Fast.exe

Drops file in Windows directory 5 IoCs

Processes:

Fast.exesvchost.comtaskmgr.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	Fast.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File created	C:\Windows\rescache\_merged\4183903823\97717462.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\1361672858.pri	taskmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 7 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vds.exetaskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1148 vssadmin.exe
Modifies registry class 1 IoCs

Processes:

Fast.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Fast.exe

pid	process
1148	vssadmin.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	Fast.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

taskmgr.exeFast.exe

pid	process
340	taskmgr.exe
340	taskmgr.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe
852	Fast.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid process

340 taskmgr.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

Processes:

taskmgr.exeFast.exevssvc.exeWMIC.exewbengine.exe

description	pid	process
Token: SeDebugPrivilege	340	taskmgr.exe
Token: SeSystemProfilePrivilege	340	taskmgr.exe
Token: SeCreateGlobalPrivilege	340	taskmgr.exe
Token: SeDebugPrivilege	852	Fast.exe
Token: SeBackupPrivilege	2072	vssvc.exe
Token: SeRestorePrivilege	2072	vssvc.exe
Token: SeAuditPrivilege	2072	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1680	WMIC.exe
Token: SeSecurityPrivilege	1680	WMIC.exe
Token: SeTakeOwnershipPrivilege	1680	WMIC.exe
Token: SeLoadDriverPrivilege	1680	WMIC.exe
Token: SeSystemProfilePrivilege	1680	WMIC.exe
Token: SeSystemtimePrivilege	1680	WMIC.exe
Token: SeProfSingleProcessPrivilege	1680	WMIC.exe
Token: SeIncBasePriorityPrivilege	1680	WMIC.exe
Token: SeCreatePagefilePrivilege	1680	WMIC.exe
Token: SeBackupPrivilege	1680	WMIC.exe
Token: SeRestorePrivilege	1680	WMIC.exe
Token: SeShutdownPrivilege	1680	WMIC.exe
Token: SeDebugPrivilege	1680	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1680	WMIC.exe
Token: SeRemoteShutdownPrivilege	1680	WMIC.exe
Token: SeUndockPrivilege	1680	WMIC.exe
Token: SeManageVolumePrivilege	1680	WMIC.exe
Token: 33	1680	WMIC.exe
Token: 34	1680	WMIC.exe
Token: 35	1680	WMIC.exe
Token: 36	1680	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1680	WMIC.exe
Token: SeSecurityPrivilege	1680	WMIC.exe
Token: SeTakeOwnershipPrivilege	1680	WMIC.exe
Token: SeLoadDriverPrivilege	1680	WMIC.exe
Token: SeSystemProfilePrivilege	1680	WMIC.exe
Token: SeSystemtimePrivilege	1680	WMIC.exe
Token: SeProfSingleProcessPrivilege	1680	WMIC.exe
Token: SeIncBasePriorityPrivilege	1680	WMIC.exe
Token: SeCreatePagefilePrivilege	1680	WMIC.exe
Token: SeBackupPrivilege	1680	WMIC.exe
Token: SeRestorePrivilege	1680	WMIC.exe
Token: SeShutdownPrivilege	1680	WMIC.exe
Token: SeDebugPrivilege	1680	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1680	WMIC.exe
Token: SeRemoteShutdownPrivilege	1680	WMIC.exe
Token: SeUndockPrivilege	1680	WMIC.exe
Token: SeManageVolumePrivilege	1680	WMIC.exe
Token: 33	1680	WMIC.exe
Token: 34	1680	WMIC.exe
Token: 35	1680	WMIC.exe
Token: 36	1680	WMIC.exe
Token: SeBackupPrivilege	2232	wbengine.exe
Token: SeRestorePrivilege	2232	wbengine.exe
Token: SeSecurityPrivilege	2232	wbengine.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exe

pid	process
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	process
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

Fast.exesvchost.comFast.execmd.execmd.exe

description	pid	process	target process
PID 2828 wrote to memory of 852	2828	Fast.exe	Fast.exe
PID 2828 wrote to memory of 852	2828	Fast.exe	Fast.exe
PID 2828 wrote to memory of 852	2828	Fast.exe	Fast.exe
PID 996 wrote to memory of 340	996	svchost.com	taskmgr.exe
PID 996 wrote to memory of 340	996	svchost.com	taskmgr.exe
PID 996 wrote to memory of 340	996	svchost.com	taskmgr.exe
PID 852 wrote to memory of 704	852	Fast.exe	cmd.exe
PID 852 wrote to memory of 1912	852	Fast.exe	cmd.exe
PID 852 wrote to memory of 704	852	Fast.exe	cmd.exe
PID 852 wrote to memory of 1912	852	Fast.exe	cmd.exe
PID 704 wrote to memory of 3924	704	cmd.exe	netsh.exe
PID 704 wrote to memory of 3924	704	cmd.exe	netsh.exe
PID 1912 wrote to memory of 1148	1912	cmd.exe	vssadmin.exe
PID 1912 wrote to memory of 1148	1912	cmd.exe	vssadmin.exe
PID 1912 wrote to memory of 1680	1912	cmd.exe	WMIC.exe
PID 1912 wrote to memory of 1680	1912	cmd.exe	WMIC.exe
PID 1912 wrote to memory of 3436	1912	cmd.exe	bcdedit.exe
PID 1912 wrote to memory of 3436	1912	cmd.exe	bcdedit.exe
PID 1912 wrote to memory of 3044	1912	cmd.exe	bcdedit.exe
PID 1912 wrote to memory of 3044	1912	cmd.exe	bcdedit.exe
PID 1912 wrote to memory of 2700	1912	cmd.exe	wbadmin.exe
PID 1912 wrote to memory of 2700	1912	cmd.exe	wbadmin.exe
PID 704 wrote to memory of 3248	704	cmd.exe	netsh.exe
PID 704 wrote to memory of 3248	704	cmd.exe	netsh.exe
PID 852 wrote to memory of 3948	852	Fast.exe	mshta.exe
PID 852 wrote to memory of 3948	852	Fast.exe	mshta.exe
PID 852 wrote to memory of 3948	852	Fast.exe	mshta.exe

C:\Users\Admin\AppData\Local\Temp\Fast.exe
"C:\Users\Admin\AppData\Local\Temp\Fast.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2828

C:\Users\Admin\AppData\Local\Temp\3582-490\Fast.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\Fast.exe"
2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852

C:\Users\Admin\AppData\Local\Temp\3582-490\Fast.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\Fast.exe"
3⤵
- Executes dropped EXE
PID:3504

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:704

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
4⤵
PID:3924

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
4⤵
PID:3248

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:1148

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1680

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:3436

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:3044

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
4⤵
- Deletes backup catalog
PID:2700

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
3⤵
PID:3948

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\Windows\system32\taskmgr.exe" /4
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\taskmgr.exe
C:\Windows\system32\taskmgr.exe /4
2⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:340

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2072

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2232

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2372

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:2308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Change Default File Association

T1042

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
MD5
a344438de9e499ca3d9038688440f406

SHA1
c961917349de7e9d269f6f4a5593b6b9d3fcd4d2

SHA256
715f6420c423ae4068b25a703d5575f7c147b26e388f0fff1ae20c6abe821557

SHA512
8bf3c621725fddafa6326b057fee9beee95966e43c5fbab40ebaa4a1a64d17acca97a19d0ece10c3574e13e194ff191316871d1d46d4d74ffc0ac3efb403bca9

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
MD5
3b73078a714bf61d1c19ebc3afc0e454

SHA1
9abeabd74613a2f533e2244c9ee6f967188e4e7e

SHA256
ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

SHA512
75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
MD5
09acdc5bbec5a47e8ae47f4a348541e2

SHA1
658f64967b2a9372c1c0bdd59c6fb2a18301d891

SHA256
1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403

SHA512
3867bf98e1a0e253114a98b78b047b0d8282b5abf4aaf836f31cc0e26224e2a1b802c65df9d90dc7696a6dbcb9a8e4b900f1d1299e1b11e36f095ebaf8a2e5b8

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
MD5
576410de51e63c3b5442540c8fdacbee

SHA1
8de673b679e0fee6e460cbf4f21ab728e41e0973

SHA256
3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe

SHA512
f7761f3878775b30cc3d756fa122e74548dfc0a27e38fa4109e34a59a009df333d074bf14a227549ae347605f271be47984c55148685faac479aeb481f7191db

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
MD5
8ffc3bdf4a1903d9e28b99d1643fc9c7

SHA1
919ba8594db0ae245a8abd80f9f3698826fc6fe5

SHA256
8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6

SHA512
0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
MD5
8c753d6448183dea5269445738486e01

SHA1
ebbbdc0022ca7487cd6294714cd3fbcb70923af9

SHA256
473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997

SHA512
4f6fddefc42455540448eac0b693a4847e21b68467486376a4186776bfe137337733d3075b7b87ed7dac532478dc9afc63883607ec8205df3f155fee64c7a9be

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
MD5
176436d406fd1aabebae353963b3ebcf

SHA1
9ffdfdb8cc832a0c6501c4c0e85b23a0f7eff57a

SHA256
2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f

SHA512
a2d1a714e0c1e5463260c64048ba8fd5064cfa06d4a43d02fc04a30748102ff5ba86d20a08e611e200dc778e2b7b3ae808da48132a05a61aa09ac424a182a06a

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
MD5
cce8964848413b49f18a44da9cb0a79b

SHA1
0b7452100d400acebb1c1887542f322a92cbd7ae

SHA256
fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5

SHA512
bf8fc270229d46a083ced30da6637f3ca510b0ce44624a9b21ec6aacac81666dffd41855053a936aa9e8ea6e745a09b820b506ec7bf1173b6f1837828a35103d

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
MD5
92dc0a5b61c98ac6ca3c9e09711e0a5d

SHA1
f809f50cfdfbc469561bced921d0bad343a0d7b4

SHA256
3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc

SHA512
d9eefb19f82e0786d9be0dbe5e339d25473fb3a09682f40c6d190d4c320cca5556abb72b5d97c6b0da4f8faefdc6d39ac9d0415fdf94ebcc90ecdf2e513c6a31

Download Submit
C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe
MD5
8db8df5afb216d89fcb0bdf24662c9b5

SHA1
f0819d096526f02b0f7c50b56cebd7c521600897

SHA256
bc9c19ede72076a2c8cc18a4b2305cabc999244fb92d471c87036bb796d3f89f

SHA512
dc63a71b6b04e89ecf744bf890c74caa11cb3525aeccaede6dafa72fa3eebd40b8d352651d0bc8b1deb0768a38e5c2660200cac84eec48ddab01beaa8c9c0bea

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
MD5
cbd96ba6abe7564cb5980502eec0b5f6

SHA1
74e1fe1429cec3e91f55364e5cb8385a64bb0006

SHA256
405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa

SHA512
a551001853f6b93dfbc6cf6a681820af31330a19d5411076ff3dbce90937b3d92173085a15f29ebf56f2ef12a4e86860ac6723ebc89c98ea31ea7a6c7e3d7cdc

Download Submit
C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE
MD5
950000c930454e0c30644f13ed60e9c3

SHA1
5f6b06e8a02e1390e7499722b277135b4950723d

SHA256
09786f64db91266470b56046098d9825253ba5d6a5361c2f4e6dbc8ec28c9bb2

SHA512
22e3c677c83c755e53a7bf8735734541223f57151d588c3380bc758e5433b706441666d0d95c42bd23a720b093a6942a62346dab24ee3f0a18bee3e5ad1cd9d9

Download Submit
C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE
MD5
ad0efa1df844814c2e8ddc188cb0e3b5

SHA1
b1a8a09f2223aab8b8e3e9bc0e58cc83d402f8ab

SHA256
c87fd5b223cb6dc716815b442b4964d4670a30b5c79f4fb9f1c3a65ec9072e5a

SHA512
532cc173d9ef27098ff10b6b652c64231b4a14f99df3b5de2eb1423370c19590e2a6032023d3ed02e2080f2f087b620ebbbd079e4a47a584ef11f3eaa0eb8520

Download Submit
C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE
MD5
fafb18b930b2b05ac8c5ddb988e9062f

SHA1
825ea5069601fb875f8d050aa01300eac03d3826

SHA256
c17785fe7e6b5e08fe5a4ca3679fee85ba6f2e5efcce0fb9807727cf8aa25265

SHA512
be034e7377bd27092aad02e13a152fb80ff74c1ba2fb63ccb344cd55315d115ee47e46727cbe55ca808efafa58d7924e3eed965e9a2fd3b9ae2dff7834383e54

Download Submit
C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE
MD5
ea78ed9e7eb4cc64544163627476fe4b

SHA1
67aed91a59742a36c0ff635b15c692cde3eb3a9d

SHA256
d5adfd6c8160892716ad5f2907cc66888aee97e1d296404503e1d42dd30ba562

SHA512
eeee54e5ffbd243fe7ef6c93744c754bc238e5b05e85c7ca3b25edc02a8692cd10225edff40444fe2536608d0ed25578573e309503cb8f90f43d089d86f8710f

Download Submit
C:\PROGRA~2\Google\Update\DISABL~1.EXE
MD5
dd5586c90fad3d0acb402c1aab8f6642

SHA1
3440cd9e78d4e4b3c2f5ba31435cedaa559e5c7f

SHA256
fba2b9270ade0ce80e8dfc5e3279db683324502f6103e451cd090c69da56415e

SHA512
e56f6d6b446411ba4ed24f0d113953d9c9e874b2ac4511d33e5c5b85dddd81216579695e35c34b6054c187b00ee214d5648594dad498297f487f2fd47f040a4d

Download Submit
C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\Fast.exe
MD5
450530b6fe77db0c5283fdbc8461a6b5

SHA1
0f6d22fd7a5b78ae62d048d9d648f954a06b7a22

SHA256
a4008ecc4d4ff0cb00b21beb49dfd9ff74f21dac59d7d9495f7556af02e09196

SHA512
f2239705b8ae7aaf42ae4a4f3b28550539f08cd5b7c7e351b81892c205200c1a6786169d8bd3090b6a825c742df20277fda0f64e369739657f8d9cfd5d384c7d

Download Submit
C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE
MD5
fa982a173f9d3628c2b3ff62bd8a2f87

SHA1
2cfb18d542ae6b6cf5a1223f1a77defd9b91fa56

SHA256
bc5d80d05a1bd474cb5160782765bf973ba34ea25dedf7e96dfaf932b9935032

SHA512
95ca9066a2e5272494b8e234220b6028c14892679023ca70801475c38d341032363589375ec6ffc4cde3416dd88d0e3082d315f7beddccdf014122ddd0a90644

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe
MD5
a344438de9e499ca3d9038688440f406

SHA1
c961917349de7e9d269f6f4a5593b6b9d3fcd4d2

SHA256
715f6420c423ae4068b25a703d5575f7c147b26e388f0fff1ae20c6abe821557

SHA512
8bf3c621725fddafa6326b057fee9beee95966e43c5fbab40ebaa4a1a64d17acca97a19d0ece10c3574e13e194ff191316871d1d46d4d74ffc0ac3efb403bca9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
MD5
b8c0f0237bbcb4af99acd107e6cdd775

SHA1
bc89159e1bba2af84c75f197557d57872973874e

SHA256
c1cde92c5bb9d3ebf99b587c71ac519bcaed43dcd5b6418d59764c86f773503c

SHA512
062b55dfa2c7548b8fa4612655fe38677d204d1f290fb708910c02e49e6423544b00614d1eaa778e16f97aa7252076feb1d6933a08a76dd7400c16a64b679546

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe
MD5
9dfcdd1ab508b26917bb2461488d8605

SHA1
4ba6342bcf4942ade05fb12db83da89dc8c56a21

SHA256
ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5

SHA512
1afc1b95f160333f1ff2fa14b3f22a28ae33850699c6b5498915a8b6bec1cfc40f33cb69583240aa9206bc2ea7ab14e05e071275b836502a92aa8c529fc1b137

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
MD5
5791075058b526842f4601c46abd59f5

SHA1
b2748f7542e2eebcd0353c3720d92bbffad8678f

SHA256
5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394

SHA512
83e303971ed64019fde9e4ba6f6e889f8fb105088490dfa7dcf579a12baff20ef491f563d132d60c7b24a4fd3cac29bd9dc974571cd162000fae8fba4e0e54fb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
MD5
4ddc609ae13a777493f3eeda70a81d40

SHA1
8957c390f9b2c136d37190e32bccae3ae671c80a

SHA256
16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950

SHA512
9d7f90d1529cab20078c2690bf7bffab5a451a41d8993781effe807e619da0e7292f991da2f0c5c131b111d028b3e6084e5648c90816e74dfb664e7f78181bc5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
MD5
8555718f55b39f60b4a4f101f7bdcabb

SHA1
324e77cec4e1163acd08386d224a5a01b1acb25a

SHA256
c2f274f6d4c4bd8d70f1b5b542e921e8912bd94b13e03465a458c90719f198f5

SHA512
74597b580e9ef646a6dd8d0943b728d57955fad9c086ba53cbdfaa0a8403878b8704646f35623982ebe2143bc36d62c290f850d06ca22b2bf7a18ad9521e0c60

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
MD5
cec6cb4db9605bf927af358d74d6c1dd

SHA1
adbddfadcb55d28209276faee304ae98fc67ebc3

SHA256
eeb00ddd05689a32d3c0afcd7a6c2cbd9a362940e49e43f7edd4b109b906c0fa

SHA512
bad89bee7da75de65122068c15a5edd0b306c3cecdabc04cf533f0bddfec7f43cf974de4fcc1762ec4fb7d9ed38b4e7d2a68edade57a39fab85b046fd3d54efd

Download Submit
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
MD5
d47ed8961782d9e27f359447fa86c266

SHA1
d37d3f962c8d302b18ec468b4abe94f792f72a3b

SHA256
b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a

SHA512
3e33f2cdf35024868b183449019de9278035e7966b342ba320a6c601b5629792cbb98a19850d4ca80b906c85d10e8503b0193794d1f1efa849fa33d26cff0669

Download Submit
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
MD5
bcd0f32f28d3c2ba8f53d1052d05252d

SHA1
c29b4591df930dabc1a4bd0fa2c0ad91500eafb2

SHA256
bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb

SHA512
79f407735853f82f46870c52058ceee4d91857a89db14868ee1169abd5c0fd2e3fa1ed230ab90b5f479a9581b88998643d69b0df498defea29e73b0d487f3b10

Download Submit
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
MD5
d90510a290c2987a2613df8eba3264cf

SHA1
226b619ccd33c2a186aef6cbb759b2d4cf16fff5

SHA256
49577d0c54d9f941d25346dd964f309da452b62bfb09282cabc2fbcb169fdf5d

SHA512
e0554a501009dd67bd1dbd586ad66a90ad2d75aa67782fc5fbb783aeaed7ef8e525e70bd96a6eb8a1f9008f541e2f281061d30b7886aae771f226c5b882d8247

Download Submit
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
MD5
1b767030ec4710c31c5da87202024da8

SHA1
0be0d1eaecb6087da5816a6d19b91c57ade21756

SHA256
03569fad8f118e7ec64538b60e131c053d91fdea9cc322e321f9471aa31d0885

SHA512
d9feae71340251647868ff92104942e47718b60b796266c7430a1f3630e937cd3d2270ae6a74d73a1cf425f81e553e6a256478bd33bce88398fa48809baa1668

Download Submit
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
MD5
6e84b6096aaa18cabc30f1122d5af449

SHA1
e6729edd11b52055b5e34d39e5f3b8f071bbac4f

SHA256
c6b7f9119cf867951f007c5468f75eb4dca59c7eedeb0afdd8ad9d5b9606e759

SHA512
af5b33e7e190587bb152adf65fbcd4c1cd521f638863a6d1c7de29599cce6439b6c7b653180661cb0382007aefa0ae5a1b1b841eaaa116ce715f3a5ba0725a42

Download Submit
C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler.exe
MD5
09f0c144ff13cebc21267e71326324e7

SHA1
338ca67ba76427c48aace86ad68b780eb38a252d

SHA256
56977618a0fbd66c0ef0ca042290dfe464f4ad5b4b737a4b9db47631a7178f13

SHA512
126ed94d3efd7aa54b181ffe35be6dbe6aea1481eaf28f6f418a23717d052e3d53e49c1de8f7aa68120f9be9b84e965ab5ccf3b0f0a1b25de6321217d67e6284

Download Submit
C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdate.exe
MD5
dd5586c90fad3d0acb402c1aab8f6642

SHA1
3440cd9e78d4e4b3c2f5ba31435cedaa559e5c7f

SHA256
fba2b9270ade0ce80e8dfc5e3279db683324502f6103e451cd090c69da56415e

SHA512
e56f6d6b446411ba4ed24f0d113953d9c9e874b2ac4511d33e5c5b85dddd81216579695e35c34b6054c187b00ee214d5648594dad498297f487f2fd47f040a4d

Download Submit
C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateCore.exe
MD5
334742e3ed84cf2f5089727823a3eab0

SHA1
f926d9516c483cea0ae90640d0b6f355127d1315

SHA256
42b1b065da8a058dc5e57cfe061db5983411d315ef4948460ad031bfb2236fba

SHA512
fa27453d1b539220cde869ec1730513862e7ad41048ab97fc640474aa0e4cea850536a804fef4b098ea520ab1582004d45433a0f57ec4ebd07f47046bd34b45f

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
MD5
e63649097c92e21b7607e43555b96f84

SHA1
6ea928ee94aa1edc98c45dba392ff1d30060e405

SHA256
d1c7ca907fcf7523f94072f18ffef6dae309e8ce5c69fe5c1a7ca9994805e2ac

SHA512
9261db8fef94141fca4563ca9eb96ee25455c0956afcb866d9c4d10f0e19a2792e5ca6e504ae1c18449a86982312528dbf63eab84723ff0414ecccd640a5b4d6

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
MD5
38f4a0ea3b840c9f321648ae138f27f9

SHA1
beb19a55c6ab9d0938d143e69764166f85f5d3dd

SHA256
388cfb312fdb46719955e3ccb6c5fe8ef10e62c843b8e9efa9cc0578b420b8cc

SHA512
81cb98edc704751dbcbeb07d9861da94d4a1696666b3ed0778e6d9d6c5b4a6be13be80c6396ef46f8f5fc22b9b27461409c302a616428e2e5e1838b2a16a0e25

Download Submit
C:\Users\ALLUSE~1\Adobe\Setup\{AC76B~1\setup.exe
MD5
8a403bc371b84920c641afa3cf9fef2f

SHA1
d6c9d38f3e571b54132dd7ee31a169c683abfd63

SHA256
614a701b90739e7dbf66b14fbdb6854394290030cc87bbcb3f47e1c45d1f06c3

SHA512
b376ef1f49b793a8cd8b7af587f538cf87cb2fffa70fc144e1d1b7e2e8e365ba4ad0568321a0b1c04e69b4b8b694d77e812597a66be1c59eda626cbf132e2c72

Download Submit
C:\Users\ALLUSE~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE
MD5
62cee57f68ee7e0e3ef51ef37792ac37

SHA1
d21783c2e444c89467ed578f7fa735a3203316ee

SHA256
72dd833db5bbb2796fe1e339656393cbabb171b114d6183da2e89940c39b9b4b

SHA512
edf2bede3c6ba44eec65460fe39de612dcd3e43da555b3fec644eff66e6db581b98ee676c7924e11ef4b448a8cb037e74dfb5e2fa2347c50ae553d5d33e511eb

Download Submit
C:\Users\ALLUSE~1\MICROS~1\Windows\STARTM~1\Programs\Startup\Fast.exe
MD5
450530b6fe77db0c5283fdbc8461a6b5

SHA1
0f6d22fd7a5b78ae62d048d9d648f954a06b7a22

SHA256
a4008ecc4d4ff0cb00b21beb49dfd9ff74f21dac59d7d9495f7556af02e09196

SHA512
f2239705b8ae7aaf42ae4a4f3b28550539f08cd5b7c7e351b81892c205200c1a6786169d8bd3090b6a825c742df20277fda0f64e369739657f8d9cfd5d384c7d

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE
MD5
87f15006aea3b4433e226882a56f188d

SHA1
e3ad6beb8229af62b0824151dbf546c0506d4f65

SHA256
8d0045c74270281c705009d49441167c8a51ac70b720f84ff941b39fad220919

SHA512
b01a8af6dc836044d2adc6828654fa7a187c3f7ffe2a4db4c73021be6d121f9c1c47b1643513c3f25c0e1b5123b8ce2dc78b2ca8ce638a09c2171f158762c7c1

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
MD5
07e194ce831b1846111eb6c8b176c86e

SHA1
b9c83ec3b0949cb661878fb1a8b43a073e15baf1

SHA256
d882f673ddf40a7ea6d89ce25e4ee55d94a5ef0b5403aa8d86656fd960d0e4ac

SHA512
55f9b6d3199aa60d836b6792ae55731236fb2a99c79ce8522e07e579c64eabb88fa413c02632deb87a361dd8490361aa1424beed2e01ba28be220f8c676a1bb5

Download Submit
C:\Users\Admin\AppData\Local\Fast.exe
MD5
450530b6fe77db0c5283fdbc8461a6b5

SHA1
0f6d22fd7a5b78ae62d048d9d648f954a06b7a22

SHA256
a4008ecc4d4ff0cb00b21beb49dfd9ff74f21dac59d7d9495f7556af02e09196

SHA512
f2239705b8ae7aaf42ae4a4f3b28550539f08cd5b7c7e351b81892c205200c1a6786169d8bd3090b6a825c742df20277fda0f64e369739657f8d9cfd5d384c7d

Download Submit
C:\Users\Admin\AppData\Local\Fast.exe
MD5
450530b6fe77db0c5283fdbc8461a6b5

SHA1
0f6d22fd7a5b78ae62d048d9d648f954a06b7a22

SHA256
a4008ecc4d4ff0cb00b21beb49dfd9ff74f21dac59d7d9495f7556af02e09196

SHA512
f2239705b8ae7aaf42ae4a4f3b28550539f08cd5b7c7e351b81892c205200c1a6786169d8bd3090b6a825c742df20277fda0f64e369739657f8d9cfd5d384c7d

Download Submit
C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\181510~1.001\FILESY~1.EXE
MD5
f3228c24035b3f54f78bb4fd11c36aeb

SHA1
2fe73d1f64575bc4abf1d47a9dddfe7e2d9c9cbb

SHA256
d2767c9c52835f19f6695c604081bf03cdd772a3731cd2e320d9db5e477d8af7

SHA512
b526c63338d9167060bc40ffa1d13a8c2e871f46680cd4a0efc2333d9f15bf21ae75af45f8932de857678c5bf785011a28862ce7879f4bffdb9753c8bc2c19b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
MD5
346d2ff654d6257364a7c32b1ec53c09

SHA1
224301c0f56a870f20383c45801ec16d01dc48d1

SHA256
a811042693bc2b31be7e3f454b12312f67bc97f2b15335a97e8d8f2ba0a6b255

SHA512
223545e3fc9f3cd66c5cbcb50dd7103743788f03a9db398da6dd2744ccaeee291f385ce4f2758d4504fc0f6b968fabbfe16ba03b5f546b743c51dacad7a049c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
MD5
fbbf5d291a79d910211c6c500617a12a

SHA1
d3def7c06937a8dd4f5cf24e20cc5f412d1a5f81

SHA256
1e8366271c6034272c9ee3f73b5283ca4a60f0db1d7225adfd90e510ca7ca7ec

SHA512
1ca2592b14e1f571bf6cab47cd4cec1e575da5e89c108ad886979ac9467653a6cd60b75fed3607b6f418d4d6f58a567c0178684d25d8cafac72dd799f819fc67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
MD5
5a3beda8f38121c491e67a50513c8fb6

SHA1
2ed1bb0f7c1153718c881ccfc4545d936a96377f

SHA256
dbf910bccaa92f01263391882c033ba5db0206f34d8059f8ae8fd1f36dd147de

SHA512
28de9df4c2f22b4ebcb943267a4f1df1e1eff6eb172d0f23f126c9a654bf3fe486f73d7795a08e238dee324f8b7efdf3d0c88d44afc77d3cc8d9657ffe2bcc5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PRICache\1601268389\1361672858.pri
MD5
050f862ebe4280881ec261b7de17a5eb

SHA1
f88837dcc7727abd92298f2868a4e603e36dd4ae

SHA256
5a9ee4039e88417093c55cfb4c7b7aea8c5f09695a111fd1c2a78b170536afb4

SHA512
b77852e2179808744c1d0234d93f6a11dc7c1b74f2f2951af6b21bce10a0fba95b643af159c64ab3168074855cd26aa30aa625a8363f69b1dd98ca49c90b14b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PRICache\4183903823\97717462.pri
MD5
b6001b9e5fc5c3d537375f572212762b

SHA1
f03b0351d2730994e847d9afcf118395c331e400

SHA256
0ee6fb6ae927f06a3f74721d0a2be1d7b2158e171e9d32b68747121054e7f910

SHA512
918db362fd4f49d8720c34299dcc1f119bc7a0981f48d9939fcad29e14c58262daab23a131cd386437587bf8084a1dce43a58218dec757074e0004794db1129b

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\Fast.exe
MD5
93e8cbb2c4da8376bb16a0a7e964c046

SHA1
e76c4631f9a8b6019450d5072e4de3cf44a26896

SHA256
58fb76057468661da38efc981c64292987184226f82b7eddeff1844f6a725d95

SHA512
e06b8a1c7380dfef268737f0838c4839f8f94cd205f2f11c6bc18b7710565038b76fc0e8339e2cb2d0f38137d12551535cf6f32c76d117d4195b9ba6aa0655e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\Fast.exe
MD5
93e8cbb2c4da8376bb16a0a7e964c046

SHA1
e76c4631f9a8b6019450d5072e4de3cf44a26896

SHA256
58fb76057468661da38efc981c64292987184226f82b7eddeff1844f6a725d95

SHA512
e06b8a1c7380dfef268737f0838c4839f8f94cd205f2f11c6bc18b7710565038b76fc0e8339e2cb2d0f38137d12551535cf6f32c76d117d4195b9ba6aa0655e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\Fast.exe
MD5
93e8cbb2c4da8376bb16a0a7e964c046

SHA1
e76c4631f9a8b6019450d5072e4de3cf44a26896

SHA256
58fb76057468661da38efc981c64292987184226f82b7eddeff1844f6a725d95

SHA512
e06b8a1c7380dfef268737f0838c4839f8f94cd205f2f11c6bc18b7710565038b76fc0e8339e2cb2d0f38137d12551535cf6f32c76d117d4195b9ba6aa0655e5

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Fast.exe
MD5
450530b6fe77db0c5283fdbc8461a6b5

SHA1
0f6d22fd7a5b78ae62d048d9d648f954a06b7a22

SHA256
a4008ecc4d4ff0cb00b21beb49dfd9ff74f21dac59d7d9495f7556af02e09196

SHA512
f2239705b8ae7aaf42ae4a4f3b28550539f08cd5b7c7e351b81892c205200c1a6786169d8bd3090b6a825c742df20277fda0f64e369739657f8d9cfd5d384c7d

Download Submit
C:\Windows\svchost.com
MD5
36fd5e09c417c767a952b4609d73a54b

SHA1
299399c5a2403080a5bf67fb46faec210025b36d

SHA256
980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

SHA512
1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

Download Submit
C:\Windows\svchost.com
MD5
36fd5e09c417c767a952b4609d73a54b

SHA1
299399c5a2403080a5bf67fb46faec210025b36d

SHA256
980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

SHA512
1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

Download Submit
C:\odt\OFFICE~1.EXE
MD5
02c3d242fe142b0eabec69211b34bc55

SHA1
ea0a4a6d6078b362f7b3a4ad1505ce49957dc16e

SHA256
2a1ed24be7e3859b46ec3ebc316789ead5f12055853f86a9656e04b4bb771842

SHA512
0efb08492eaaa2e923beddc21566e98fbbef3a102f9415ff310ec616f5c84fd2ba3a7025b05e01c0bdf37e5e2f64dfd845f9254a376144cc7d827e7577dbb099

Download Submit