068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd

Analysis

max time kernel
145s
max time network
105s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
12-01-2023 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Size

147KB
MD5

75256873a03f4a4bc073185f48c1097c
SHA1

e9023061def67ba21c09826fadc1607fd7f71d88
SHA256

068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd
SHA512

4b718093ad42d7b7b72498dfcbcfd1b39c980ef44e999b7035e6bfe6b782aad6b7553832f1efee45003d9b0c56bf2e408ca55082c550ac4faa19f199f366dede
SSDEEP

3072:s6glyuxE4GsUPnliByocWepvdHFdjFpZ/fgyVF0dj:s6gDBGpvEByocWetdHZ/fgKF0

Score

10^/10

ransomware spyware stealer

Malware Config

Extracted

Path

C:\cHpfiXA9s.README.txt

Ransom Note

~~~ XeqtR Ransomeware The world's fastest ransomware ~~~ >>>> Your data is now stolen and encrypted, pleaes read the following carefully, as it is in your best interest. We are sorry to inform you that a Ransomware Virus has taken control of your computer. ALL of your important files and folders on your computer have been encrypted with a military grade encryption algorithm. Your documents, videos, images and every other forms of data are now inaccessible and completely locked, and cannot be unlocked without the sole decryption key, in which we are the ONLY ones in possession of this key. This key is currently being stored on a remote server. To acquire this key and have all files restored, transfer the amount of 500 USD in the cryptocurrency BITCOIN to the below specified bitcoin wallet address before the time runs out. Once you have read this you now have 36 hours until your files are lost forever. If you fail to take action within this time window, the decryption key will be destroyed and access to your files will be permanently lost. If you are not familiar with cryptocurrency and bitcoin, just do a google search, visit bitcoin.org, go on your mobile to Cash App, or pretty much just ask someone and most likely they can explain it. Once again, 500 USD in the form of Bitcoin to this wallet address bc1q8wqyacjzzvrn57d2g7aj35lnr5r8fqv0dn0394 The second you have sent the bitcoin and the transaction verifies another text file will appear on your desktop with the website to get your key, and the simple instructions on how to use it to get your files back. 36 hours starts now, we suggest you do not waste time. For any reason you should need customer service, email [email protected]

Emails

[email protected]

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1544	4D27.tmp

Modifies extensions of user files 14 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\ConvertToSet.raw.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Users\Admin\Pictures\GrantWait.png.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Users\Admin\Pictures\ImportComplete.raw.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File renamed	C:\Users\Admin\Pictures\ResumeEdit.tiff => C:\Users\Admin\Pictures\ResumeEdit.tiff.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Users\Admin\Pictures\UnregisterGrant.raw.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File renamed	C:\Users\Admin\Pictures\ConvertToSet.raw => C:\Users\Admin\Pictures\ConvertToSet.raw.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File renamed	C:\Users\Admin\Pictures\ImportComplete.raw => C:\Users\Admin\Pictures\ImportComplete.raw.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Users\Admin\Pictures\NewBackup.tiff.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Users\Admin\Pictures\ResumeEdit.tiff	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Users\Admin\Pictures\ResumeEdit.tiff.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File renamed	C:\Users\Admin\Pictures\GrantWait.png => C:\Users\Admin\Pictures\GrantWait.png.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Users\Admin\Pictures\NewBackup.tiff	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File renamed	C:\Users\Admin\Pictures\NewBackup.tiff => C:\Users\Admin\Pictures\NewBackup.tiff.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File renamed	C:\Users\Admin\Pictures\UnregisterGrant.raw => C:\Users\Admin\Pictures\UnregisterGrant.raw.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

Deletes itself 1 IoCs

pid	Process
1544	4D27.tmp

Loads dropped DLL 1 IoCs

pid	Process
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\desktop.ini	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\cHpfiXA9s.bmp"	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\cHpfiXA9s.bmp"	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
1544	4D27.tmp

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18203_.WMF.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105912.WMF	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\RestartMerge.mpeg2	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libreal_plugin.dll.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Almaty.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+11	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\IPEDINTL.DLL.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.GIF	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\cHpfiXA9s.README.txt	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Java\jre7\lib\security\local_policy.jar.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_down.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Selectors.Resources.dll	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099153.WMF	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\Office64MUI.XML.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Java\jre7\lib\classlist	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\HEADER.GIF.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01158_.WMF	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\MCABOUT.HTM.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\settings.js	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Windows Journal\Templates\blank.jtp	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.policy.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGREPFRM.XML	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\ACWZDAT12.ACCDU.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\ONINTL.REST.IDX_DLL	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_fr.properties	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Santo_Domingo.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090777.WMF	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libfluidsynth_plugin.dll.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\chkrzm.exe.mui.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Stockholm	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\2 Top.accdt	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGLOGO.XML.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14755_.GIF.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME-JAVAFX.txt.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\vlc.mo	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Design.resources.dll	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Pago_Pago.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\cHpfiXA9s.README.txt	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-heapwalker.jar	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\drag.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGTOC.DPV	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Grid.thmx.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02431_.WMF.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MLCFG32.CPL	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_left_over.gif.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\ConvertRename.docm.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00694_.WMF.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00728_.WMF	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\Desktop	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\Desktop\WallpaperStyle = "10"	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cHpfiXA9s\DefaultIcon\ = "C:\\ProgramData\\cHpfiXA9s.ico"	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cHpfiXA9s\ = "cHpfiXA9s"	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cHpfiXA9s\DefaultIcon	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

Suspicious behavior: RenamesItself 26 IoCs

pid	Process
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp
1544	4D27.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeDebugPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: 36	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeImpersonatePrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeIncBasePriorityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeIncreaseQuotaPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: 33	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeManageVolumePrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeProfSingleProcessPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeRestorePrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSystemProfilePrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeTakeOwnershipPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeShutdownPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeDebugPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 1544	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe	30
PID 840 wrote to memory of 1544	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe	30
PID 840 wrote to memory of 1544	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe	30
PID 840 wrote to memory of 1544	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe	30
PID 840 wrote to memory of 1544	840	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe	30
PID 1544 wrote to memory of 960	1544	4D27.tmp	31
PID 1544 wrote to memory of 960	1544	4D27.tmp	31
PID 1544 wrote to memory of 960	1544	4D27.tmp	31
PID 1544 wrote to memory of 960	1544	4D27.tmp	31

C:\Users\Admin\AppData\Local\Temp\068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
"C:\Users\Admin\AppData\Local\Temp\068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe"
1⤵
- Modifies extensions of user files
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840
- C:\ProgramData\4D27.tmp
  "C:\ProgramData\4D27.tmp"
  2⤵
  - Executes dropped EXE
  - Deletes itself
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\4D27.tmp >> NUL
    3⤵
    PID:960

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x154
1⤵
PID:1492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\AAAAAAAAAAA

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\BBBBBBBBBBB

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\CCCCCCCCCCC

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\DDDDDDDDDDD

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\EEEEEEEEEEE

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\FFFFFFFFFFF

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\GGGGGGGGGGG

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\HHHHHHHHHHH

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\IIIIIIIIIII

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\JJJJJJJJJJJ

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\KKKKKKKKKKK

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\LLLLLLLLLLL

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\MMMMMMMMMMM

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\NNNNNNNNNNN

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\OOOOOOOOOOO

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\PPPPPPPPPPP

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\QQQQQQQQQQQ

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\RRRRRRRRRRR

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\SSSSSSSSSSS

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\TTTTTTTTTTT

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\UUUUUUUUUUU

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\VVVVVVVVVVV

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\WWWWWWWWWWW

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\XXXXXXXXXXX

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\YYYYYYYYYYY

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\desktop.ini

Filesize
129B

MD5
81ec4c9067802a859a95074b2469a6ec

SHA1
d649df6388c9b51acebdd6bb152f4bb8ab067c12

SHA256
d8e536f0b35b3b4a9c442999df99c60a8a3f0c47c4ccc5d812106db28a2659ff

SHA512
f35ca5c57b97d7a987d1da76f834ca5c26926677c40eea887c76df7d49c0b8517c017f525ac61b5f423030b6717dc44cd556e4542f939ecaf68947ed11c9fd6f

Download Submit
C:\ProgramData\4D27.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
C:\ProgramData\4D27.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
\ProgramData\4D27.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
memory/840-81-0x0000000000205000-0x0000000000216000-memory.dmp

Filesize
68KB

Download
memory/840-54-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/1544-88-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1544-89-0x00000000002D5000-0x00000000002E6000-memory.dmp

Filesize
68KB

Download