medusalocker | cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad

Analysis

max time kernel
150s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10-11-2022 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
Size

710KB
MD5

674a54ed8c9614aea4808f6a09cc2236
SHA1

10e78765c5b245a6d19e77f54cb40bcdbb91ddcd
SHA256

cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad
SHA512

fb513afef9f44834e6461645a7f3121a343f07074f91b1e999faabeca332898f45426a67e70944ad979f80aa149eff5006547cc7b2ccb06af1a08b08df537ae1
SSDEEP

12288:XA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DXKD/KeXQF:wuf4wTuV2Ux3uIZeUBi2Te6HWCKrKea

Score

10^/10

medusalocker neshta evasion persistence ransomware spyware stealer trojan

Malware Config

Signatures

Detect Neshta payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0001000000010321-69.dat	family_neshta

MedusaLocker
Ransomware with several variants first seen in September 2019.
ransomware medusalocker

MedusaLocker payload 6 IoCs

resource	yara_rule
behavioral1/files/0x0008000000014151-55.dat	family_medusalocker
behavioral1/files/0x0008000000014151-57.dat	family_medusalocker
behavioral1/files/0x0008000000014151-59.dat	family_medusalocker
behavioral1/files/0x00060000000142cb-68.dat	family_medusalocker
behavioral1/files/0x00060000000142cb-67.dat	family_medusalocker
behavioral1/files/0x00060000000142cb-71.dat	family_medusalocker

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Executes dropped EXE 2 IoCs

pid	Process
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
1776	svhost.exe

Modifies extensions of user files 14 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\BackupConvertFrom.tif => C:\Users\Admin\Pictures\BackupConvertFrom.tif.netlock12	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File renamed	C:\Users\Admin\Pictures\MeasureSelect.tif => C:\Users\Admin\Pictures\MeasureSelect.tif.netlock12	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File renamed	C:\Users\Admin\Pictures\UnprotectPop.raw => C:\Users\Admin\Pictures\UnprotectPop.raw.netlock12	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File renamed	C:\Users\Admin\Pictures\EnableComplete.crw => C:\Users\Admin\Pictures\EnableComplete.crw.netlock12	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File renamed	C:\Users\Admin\Pictures\ResumeUnpublish.tiff => C:\Users\Admin\Pictures\ResumeUnpublish.tiff.netlock12	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\Users\Admin\Pictures\ResumeUnpublish.tiff	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File renamed	C:\Users\Admin\Pictures\SearchNew.png => C:\Users\Admin\Pictures\SearchNew.png.netlock12	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File renamed	C:\Users\Admin\Pictures\CompressHide.png => C:\Users\Admin\Pictures\CompressHide.png.netlock12	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File renamed	C:\Users\Admin\Pictures\ConvertFind.tif => C:\Users\Admin\Pictures\ConvertFind.tif.netlock12	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File renamed	C:\Users\Admin\Pictures\PublishRead.png => C:\Users\Admin\Pictures\PublishRead.png.netlock12	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File renamed	C:\Users\Admin\Pictures\StepProtect.raw => C:\Users\Admin\Pictures\StepProtect.raw.netlock12	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File renamed	C:\Users\Admin\Pictures\UpdateBlock.png => C:\Users\Admin\Pictures\UpdateBlock.png.netlock12	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File renamed	C:\Users\Admin\Pictures\DismountPublish.tif => C:\Users\Admin\Pictures\DismountPublish.tif.netlock12	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File renamed	C:\Users\Admin\Pictures\OutCheckpoint.crw => C:\Users\Admin\Pictures\OutCheckpoint.crw.netlock12	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe

Loads dropped DLL 3 IoCs

pid	Process
816	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
816	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
816	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	\??\Z:\$RECYCLE.BIN\S-1-5-21-2292972927-2705560509-2768824231-1000\desktop.ini	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\N:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\O:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\P:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\U:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\Y:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\F:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\H:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\Z:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\Q:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\R:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\T:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\X:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\J:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\L:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\S:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\B:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\E:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\I:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\K:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\V:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\W:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\A:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened (read-only)	\??\G:	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1312	vssadmin.exe
1176	vssadmin.exe
1996	vssadmin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

description	pid	Process
Token: SeBackupPrivilege	844	vssvc.exe
Token: SeRestorePrivilege	844	vssvc.exe
Token: SeAuditPrivilege	844	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1800	wmic.exe
Token: SeSecurityPrivilege	1800	wmic.exe
Token: SeTakeOwnershipPrivilege	1800	wmic.exe
Token: SeLoadDriverPrivilege	1800	wmic.exe
Token: SeSystemProfilePrivilege	1800	wmic.exe
Token: SeSystemtimePrivilege	1800	wmic.exe
Token: SeProfSingleProcessPrivilege	1800	wmic.exe
Token: SeIncBasePriorityPrivilege	1800	wmic.exe
Token: SeCreatePagefilePrivilege	1800	wmic.exe
Token: SeBackupPrivilege	1800	wmic.exe
Token: SeRestorePrivilege	1800	wmic.exe
Token: SeShutdownPrivilege	1800	wmic.exe
Token: SeDebugPrivilege	1800	wmic.exe
Token: SeSystemEnvironmentPrivilege	1800	wmic.exe
Token: SeRemoteShutdownPrivilege	1800	wmic.exe
Token: SeUndockPrivilege	1800	wmic.exe
Token: SeManageVolumePrivilege	1800	wmic.exe
Token: 33	1800	wmic.exe
Token: 34	1800	wmic.exe
Token: 35	1800	wmic.exe
Token: SeIncreaseQuotaPrivilege	392	wmic.exe
Token: SeSecurityPrivilege	392	wmic.exe
Token: SeTakeOwnershipPrivilege	392	wmic.exe
Token: SeLoadDriverPrivilege	392	wmic.exe
Token: SeSystemProfilePrivilege	392	wmic.exe
Token: SeSystemtimePrivilege	392	wmic.exe
Token: SeProfSingleProcessPrivilege	392	wmic.exe
Token: SeIncBasePriorityPrivilege	392	wmic.exe
Token: SeCreatePagefilePrivilege	392	wmic.exe
Token: SeBackupPrivilege	392	wmic.exe
Token: SeRestorePrivilege	392	wmic.exe
Token: SeShutdownPrivilege	392	wmic.exe
Token: SeDebugPrivilege	392	wmic.exe
Token: SeSystemEnvironmentPrivilege	392	wmic.exe
Token: SeRemoteShutdownPrivilege	392	wmic.exe
Token: SeUndockPrivilege	392	wmic.exe
Token: SeManageVolumePrivilege	392	wmic.exe
Token: 33	392	wmic.exe
Token: 34	392	wmic.exe
Token: 35	392	wmic.exe
Token: SeIncreaseQuotaPrivilege	520	wmic.exe
Token: SeSecurityPrivilege	520	wmic.exe
Token: SeTakeOwnershipPrivilege	520	wmic.exe
Token: SeLoadDriverPrivilege	520	wmic.exe
Token: SeSystemProfilePrivilege	520	wmic.exe
Token: SeSystemtimePrivilege	520	wmic.exe
Token: SeProfSingleProcessPrivilege	520	wmic.exe
Token: SeIncBasePriorityPrivilege	520	wmic.exe
Token: SeCreatePagefilePrivilege	520	wmic.exe
Token: SeBackupPrivilege	520	wmic.exe
Token: SeRestorePrivilege	520	wmic.exe
Token: SeShutdownPrivilege	520	wmic.exe
Token: SeDebugPrivilege	520	wmic.exe
Token: SeSystemEnvironmentPrivilege	520	wmic.exe
Token: SeRemoteShutdownPrivilege	520	wmic.exe
Token: SeUndockPrivilege	520	wmic.exe
Token: SeManageVolumePrivilege	520	wmic.exe
Token: 33	520	wmic.exe
Token: 34	520	wmic.exe
Token: 35	520	wmic.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 2004	816	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	27
PID 816 wrote to memory of 2004	816	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	27
PID 816 wrote to memory of 2004	816	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	27
PID 816 wrote to memory of 2004	816	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	27
PID 2004 wrote to memory of 1176	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	28
PID 2004 wrote to memory of 1176	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	28
PID 2004 wrote to memory of 1176	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	28
PID 2004 wrote to memory of 1176	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	28
PID 2004 wrote to memory of 1800	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	31
PID 2004 wrote to memory of 1800	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	31
PID 2004 wrote to memory of 1800	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	31
PID 2004 wrote to memory of 1800	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	31
PID 2004 wrote to memory of 1996	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	33
PID 2004 wrote to memory of 1996	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	33
PID 2004 wrote to memory of 1996	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	33
PID 2004 wrote to memory of 1996	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	33
PID 2004 wrote to memory of 392	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	35
PID 2004 wrote to memory of 392	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	35
PID 2004 wrote to memory of 392	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	35
PID 2004 wrote to memory of 392	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	35
PID 2004 wrote to memory of 1312	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	37
PID 2004 wrote to memory of 1312	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	37
PID 2004 wrote to memory of 1312	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	37
PID 2004 wrote to memory of 1312	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	37
PID 2004 wrote to memory of 520	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	39
PID 2004 wrote to memory of 520	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	39
PID 2004 wrote to memory of 520	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	39
PID 2004 wrote to memory of 520	2004	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe	39
PID 700 wrote to memory of 1776	700	taskeng.exe	44
PID 700 wrote to memory of 1776	700	taskeng.exe	44
PID 700 wrote to memory of 1776	700	taskeng.exe	44
PID 700 wrote to memory of 1776	700	taskeng.exe	44

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe

C:\Users\Admin\AppData\Local\Temp\cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
"C:\Users\Admin\AppData\Local\Temp\cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:816
- C:\Users\Admin\AppData\Local\Temp\3582-490\cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Modifies extensions of user files
  - Checks whether UAC is enabled
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2004
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:1176
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic.exe SHADOWCOPY /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1800
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:1996
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic.exe SHADOWCOPY /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:392
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:1312
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic.exe SHADOWCOPY /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:520

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:844

C:\Windows\system32\taskeng.exe
taskeng.exe {D308E3B8-3E2E-43EB-8EF7-5FD6059CE6C0} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:700
- C:\Users\Admin\AppData\Roaming\svhost.exe
  C:\Users\Admin\AppData\Roaming\svhost.exe
  2⤵
  - Executes dropped EXE
  PID:1776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

File Deletion

T1107

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE

Filesize
864KB

MD5
fa9fbacb725e3c38850a20232f2bf4b6

SHA1
4dd5c86538af0e79ce5d194176b960317efb1370

SHA256
b04eddca3cc4094a12f1dae4b0ae1ed151c8617adf0a94eff27fd41da80d12ba

SHA512
491f00cb6746b301c50def1f369a3f86364535ea8d7a6f9f07c3e5a68ef0e6cd5188e672dfbd18735702a846ddaa1739fcde9f3eb67e802d6b32c9162a73c191

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe

Filesize
669KB

MD5
ac546514c037b432430bebc8e3884dad

SHA1
f4e2e0eea53546e9a2b1cf136eb8a5ce7015f06d

SHA256
b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009

SHA512
b4f703141e1fc471df35e968977535e4b64cddebc9bba66037b259265234ed254249d9b451f0856cc902919cce77062c6242d49752dcd5e488f7c3d486bc5d99

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe

Filesize
669KB

MD5
ac546514c037b432430bebc8e3884dad

SHA1
f4e2e0eea53546e9a2b1cf136eb8a5ce7015f06d

SHA256
b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009

SHA512
b4f703141e1fc471df35e968977535e4b64cddebc9bba66037b259265234ed254249d9b451f0856cc902919cce77062c6242d49752dcd5e488f7c3d486bc5d99

Download Submit
C:\Users\Admin\AppData\Roaming\svhost.exe

Filesize
669KB

MD5
ac546514c037b432430bebc8e3884dad

SHA1
f4e2e0eea53546e9a2b1cf136eb8a5ce7015f06d

SHA256
b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009

SHA512
b4f703141e1fc471df35e968977535e4b64cddebc9bba66037b259265234ed254249d9b451f0856cc902919cce77062c6242d49752dcd5e488f7c3d486bc5d99

Download Submit
C:\Users\Admin\AppData\Roaming\svhost.exe

Filesize
669KB

MD5
ac546514c037b432430bebc8e3884dad

SHA1
f4e2e0eea53546e9a2b1cf136eb8a5ce7015f06d

SHA256
b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009

SHA512
b4f703141e1fc471df35e968977535e4b64cddebc9bba66037b259265234ed254249d9b451f0856cc902919cce77062c6242d49752dcd5e488f7c3d486bc5d99

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe

Filesize
669KB

MD5
ac546514c037b432430bebc8e3884dad

SHA1
f4e2e0eea53546e9a2b1cf136eb8a5ce7015f06d

SHA256
b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009

SHA512
b4f703141e1fc471df35e968977535e4b64cddebc9bba66037b259265234ed254249d9b451f0856cc902919cce77062c6242d49752dcd5e488f7c3d486bc5d99

Download Submit
\Users\Admin\AppData\Roaming\svhost.exe

Filesize
669KB

MD5
ac546514c037b432430bebc8e3884dad

SHA1
f4e2e0eea53546e9a2b1cf136eb8a5ce7015f06d

SHA256
b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009

SHA512
b4f703141e1fc471df35e968977535e4b64cddebc9bba66037b259265234ed254249d9b451f0856cc902919cce77062c6242d49752dcd5e488f7c3d486bc5d99

Download Submit
memory/816-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download