068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd

Analysis

max time kernel
146s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2023 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Size

147KB
MD5

75256873a03f4a4bc073185f48c1097c
SHA1

e9023061def67ba21c09826fadc1607fd7f71d88
SHA256

068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd
SHA512

4b718093ad42d7b7b72498dfcbcfd1b39c980ef44e999b7035e6bfe6b782aad6b7553832f1efee45003d9b0c56bf2e408ca55082c550ac4faa19f199f366dede
SSDEEP

3072:s6glyuxE4GsUPnliByocWepvdHFdjFpZ/fgyVF0dj:s6gDBGpvEByocWetdHZ/fgKF0

Score

10^/10

ransomware spyware stealer

Malware Config

Extracted

Path

C:\cHpfiXA9s.README.txt

Ransom Note

~~~ XeqtR Ransomeware The world's fastest ransomware ~~~ >>>> Your data is now stolen and encrypted, pleaes read the following carefully, as it is in your best interest. We are sorry to inform you that a Ransomware Virus has taken control of your computer. ALL of your important files and folders on your computer have been encrypted with a military grade encryption algorithm. Your documents, videos, images and every other forms of data are now inaccessible and completely locked, and cannot be unlocked without the sole decryption key, in which we are the ONLY ones in possession of this key. This key is currently being stored on a remote server. To acquire this key and have all files restored, transfer the amount of 500 USD in the cryptocurrency BITCOIN to the below specified bitcoin wallet address before the time runs out. Once you have read this you now have 36 hours until your files are lost forever. If you fail to take action within this time window, the decryption key will be destroyed and access to your files will be permanently lost. If you are not familiar with cryptocurrency and bitcoin, just do a google search, visit bitcoin.org, go on your mobile to Cash App, or pretty much just ask someone and most likely they can explain it. Once again, 500 USD in the form of Bitcoin to this wallet address bc1q8wqyacjzzvrn57d2g7aj35lnr5r8fqv0dn0394 The second you have sent the bitcoin and the transaction verifies another text file will appear on your desktop with the website to get your key, and the simple instructions on how to use it to get your files back. 36 hours starts now, we suggest you do not waste time. For any reason you should need customer service, email [email protected]

Emails

[email protected]

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3344	35F0.tmp

Modifies extensions of user files 17 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\CloseHide.crw => C:\Users\Admin\Pictures\CloseHide.crw.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File renamed	C:\Users\Admin\Pictures\ConfirmMount.tif => C:\Users\Admin\Pictures\ConfirmMount.tif.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Users\Admin\Pictures\MeasureReset.tiff	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File renamed	C:\Users\Admin\Pictures\NewUnregister.tif => C:\Users\Admin\Pictures\NewUnregister.tif.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Users\Admin\Pictures\NewUnregister.tif.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Users\Admin\Pictures\RequestResume.raw.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Users\Admin\Pictures\CompressExport.raw.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File renamed	C:\Users\Admin\Pictures\MeasureReset.tiff => C:\Users\Admin\Pictures\MeasureReset.tiff.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Users\Admin\Pictures\MeasureReset.tiff.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File renamed	C:\Users\Admin\Pictures\RequestResume.raw => C:\Users\Admin\Pictures\RequestResume.raw.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Users\Admin\Pictures\CloseHide.crw.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File renamed	C:\Users\Admin\Pictures\CopySave.tif => C:\Users\Admin\Pictures\CopySave.tif.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Users\Admin\Pictures\SkipOut.crw.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File renamed	C:\Users\Admin\Pictures\CompressExport.raw => C:\Users\Admin\Pictures\CompressExport.raw.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Users\Admin\Pictures\ConfirmMount.tif.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Users\Admin\Pictures\CopySave.tif.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File renamed	C:\Users\Admin\Pictures\SkipOut.crw => C:\Users\Admin\Pictures\SkipOut.crw.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	35F0.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\desktop.ini	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\cHpfiXA9s.bmp"	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\cHpfiXA9s.bmp"	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
3344	35F0.tmp

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_close.png.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.HostIntegration.Connectors.dll	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-16.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vccorlib140.dll	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\NIRMALAB.TTF	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\PortalConnect.dll	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\ui-strings.js.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libcache_read_plugin.dll	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Shared.v11.1.dll	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_ja.jar	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner-2x.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\ui-strings.js	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-400_contrast-white.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\cHpfiXA9s.README.txt	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSmallTile.scale-400.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\cHpfiXA9s.README.txt	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_download_18.svg.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_zh_4.4.0.v20140623020002.jar.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\cHpfiXA9s.README.txt	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-tw_get.svg.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\cHpfiXA9s.README.txt	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-cn\cHpfiXA9s.README.txt	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.scale-125.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-modules-appui.jar	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\selector.js	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\stickers\word_art\sticker22.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageMedTile.scale-100.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\ZY______.PFB.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\de-de\ui-strings.js	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\cHpfiXA9s.README.txt	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\cHpfiXA9s.README.txt	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\offsymxb.ttf	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ppd.xrm-ms.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH.HXS.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SplashScreen.scale-100.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.Office.Excel.DataModel.dll.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000C.DLL.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSquare310x310Logo.scale-100_contrast-black.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\2px.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.dll.mui	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsStoreLogo.scale-125.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl64.dlla.manifest	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\de-de\ui-strings.js	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Office365LogoWLockup.scale-180.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\chocolateyInstall.ps1.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\cHpfiXA9s.README.txt	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_rename_18.svg.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\msipc.dll.mui	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.HostIntegration.Connectors.dll.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\Desktop	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\Desktop\WallpaperStyle = "10"	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

Modifies registry class 48 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cHpfiXA9s\ = "cHpfiXA9s"	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cHpfiXA9s\DefaultIcon	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2211"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "9079"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "10910"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "5299"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "10057"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2211"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "5299"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "10057"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "162"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "129"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1949"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "162"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "8401"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "10910"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "10910"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "5299"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1949"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "8401"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "8401"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "9079"	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cHpfiXA9s\DefaultIcon\ = "C:\\ProgramData\\cHpfiXA9s.ico"	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "162"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "129"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1949"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "129"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "2211"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "9079"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "10057"	SearchApp.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

Suspicious behavior: RenamesItself 26 IoCs

pid	Process
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp
3344	35F0.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeDebugPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: 36	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeImpersonatePrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeIncBasePriorityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeIncreaseQuotaPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: 33	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeManageVolumePrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeProfSingleProcessPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeRestorePrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSystemProfilePrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeTakeOwnershipPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeShutdownPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeDebugPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	1720	vssvc.exe
Token: SeRestorePrivilege	1720	vssvc.exe
Token: SeAuditPrivilege	1720	vssvc.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3488	StartMenuExperienceHost.exe
1884	SearchApp.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 3344	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe	109
PID 2752 wrote to memory of 3344	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe	109
PID 2752 wrote to memory of 3344	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe	109
PID 2752 wrote to memory of 3344	2752	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe	109
PID 3344 wrote to memory of 2096	3344	35F0.tmp	110
PID 3344 wrote to memory of 2096	3344	35F0.tmp	110
PID 3344 wrote to memory of 2096	3344	35F0.tmp	110

C:\Users\Admin\AppData\Local\Temp\068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
"C:\Users\Admin\AppData\Local\Temp\068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752
- C:\ProgramData\35F0.tmp
  "C:\ProgramData\35F0.tmp"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\35F0.tmp >> NUL
    3⤵
    PID:2096

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3488

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\AAAAAAAAAAA

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\BBBBBBBBBBB

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\CCCCCCCCCCC

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\DDDDDDDDDDD

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\EEEEEEEEEEE

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\FFFFFFFFFFF

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\GGGGGGGGGGG

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\HHHHHHHHHHH

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\IIIIIIIIIII

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\JJJJJJJJJJJ

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\KKKKKKKKKKK

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\LLLLLLLLLLL

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\MMMMMMMMMMM

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\NNNNNNNNNNN

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\OOOOOOOOOOO

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\PPPPPPPPPPP

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\QQQQQQQQQQQ

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\RRRRRRRRRRR

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\SSSSSSSSSSS

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\TTTTTTTTTTT

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\UUUUUUUUUUU

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\VVVVVVVVVVV

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\WWWWWWWWWWW

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\XXXXXXXXXXX

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\YYYYYYYYYYY

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\desktop.ini

Filesize
129B

MD5
b312009b6cf0227dd6f7b4841ef14515

SHA1
6b61a2db87516141a9161420ae8a3529af1eec3a

SHA256
fadcee98b19ad50ae936710a9cf25df8e3e27aa4bf714beaa9b44d319948d07d

SHA512
8bbba94bbf3615333e44a036739576d4a271e3b6b43c6216f10def8ea2a6a637cbe52ee275c6593288c4e76d82ff99c0f39f58854c9f458bfbea4b8b6b520f59

Download Submit
C:\ProgramData\35F0.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
C:\ProgramData\35F0.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
memory/1884-167-0x000002B5BF850000-0x000002B5BF870000-memory.dmp

Filesize
128KB

Download
memory/1884-173-0x000002B5C1022000-0x000002B5C1025000-memory.dmp

Filesize
12KB

Download
memory/1884-174-0x000002B5C1022000-0x000002B5C1025000-memory.dmp

Filesize
12KB

Download
memory/1884-175-0x000002B5C1022000-0x000002B5C1025000-memory.dmp

Filesize
12KB

Download
memory/1884-177-0x000002B5D34B0000-0x000002B5D34B8000-memory.dmp

Filesize
32KB

Download
memory/1884-180-0x000002B5BF0E0000-0x000002B5BF100000-memory.dmp

Filesize
128KB

Download
memory/1884-181-0x000002B5BF0C0000-0x000002B5BF0E0000-memory.dmp

Filesize
128KB

Download
memory/1884-172-0x000002B5C1022000-0x000002B5C1025000-memory.dmp

Filesize
12KB

Download
memory/1884-166-0x000002B5BF020000-0x000002B5BF040000-memory.dmp

Filesize
128KB

Download
memory/3344-188-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download