phobos | 239c93b0a44ce8723f181a2ec6d17e9fd9516c17241d8f5b2b0212c6d56a9eb2

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2023 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5237a3f0b1db945c1fe3f9ba71e3ff2.exe
Size

335KB
MD5

b5237a3f0b1db945c1fe3f9ba71e3ff2
SHA1

ba302c3c2490a3b1b04cfbdd76097f2444a54700
SHA256

239c93b0a44ce8723f181a2ec6d17e9fd9516c17241d8f5b2b0212c6d56a9eb2
SHA512

9879c4cd6e995916cbd8cb16f6cb3982b48b0ffc5d01479e2c2f3f73ae46a5129893571f94ded70a0ad61a1340c67ef8214018bbc7e1e17fd5395a4f55fb78a1
SSDEEP

6144:d/sM+uEe4oleWZxrigxyZdXlgdqUh+LoXl4m34fX6Rs+j2exWLsxAFFDwkGklYkv:5sM+uEe30D67j2exWPFxwkiVi

Score

10^/10

phobos redline smokeloader systembc 1 backdoor collection evasion infostealer persistence ransomware spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

dexstat255.xyz:46578

Attributes

auth_value
c4805fc19583231a4c5bb64b0e833716

Extracted

Family

systembc

adstat277xm.xyz:4044

demstat377xm.xyz:4044

Extracted

Family

smokeloader

Version

2022

http://serverlogs37.xyz/statweb255/

http://servblog757.xyz/statweb255/

http://dexblog45.xyz/statweb255/

http://admlogs.online/statweb255/

http://blogstat355.xyz/statweb255/

http://blogstatserv25.xyz/statweb255/

rc4.i32

Extracted

Path

C:\info.hta

Ransom Note

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'> <html> <head> <meta charset='windows-1251'> <title>cartilage</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language='JScript'> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type='text/css'> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background: #C6B5C4; } img { display:inline-block; } .bold { font-weight: bold; } .mark { background: #B5CC8E; padding: 2px 5px; } .header { text-align: center; font-size: 30px; line-height: 50px; font-weight: bold; margin-bottom:20px; } .info { background: #e6ecf2; border-left: 10px solid #B58CB2; } .alert { background: #FFE4E4; border-left: 10px solid #FFA07A; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } .footer { position:fixed; bottom:0; right:0; text-align: right; } </style> </head> <body> <div class='header'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='> <div>All your files have been encrypted!</div> </div> <div class='bold'>All your files have been encrypted due to a security problem with your PC.</div> <div class='bold'>If you want to restore them, write us to the e-mail <span class='mark'>[email protected]</span></div> <div class='bold'>Or write us to the Tox: <span class='mark'>78E21CFF7AA85F713C1530AEF2E74E62830BEE77238F4B0A73E5E3251EAD56427BF9F7A1A074</span></div> <div class='bold'>Write this ID in the title of your message <span class='mark'>56C78627-3483</span></div> <div> You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. </div> <div class='note info'> <div class='title'>Free decryption as guarantee</div> <ul>Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul> </div> <div class='note info'> <div class='title'>How to obtain Bitcoins</div> <ul> The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. <br><a href='https://localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a> <br> Also you can find other places to buy Bitcoins and beginners guide here: <br><a href='http://www.coindesk.com/information/how-can-i-buy-bitcoins/'>http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a> </ul> </div> <div class='note alert'> <div class='title'>Attention!</div> <ul> <li>Do not rename encrypted files.</li> <li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li> <li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li> </ul> </div> </body> </html>

Emails

class='mark'>[email protected]</span></div>

URLs

http://www.w3.org/TR/html4/strict.dtd'>

Extracted

Path

C:\Users\Admin\Desktop\info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Or write us to the Tox: 78E21CFF7AA85F713C1530AEF2E74E62830BEE77238F4B0A73E5E3251EAD56427BF9F7A1A074 Write this ID in the title of your message 56C78627-3483 You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exebcdedit.exe

pid process

4132 bcdedit.exe
1164 bcdedit.exe
3772 bcdedit.exe
300 bcdedit.exe
Renames multiple (481) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

22 1472 powershell.exe
Deletes backup catalog 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exewbadmin.exe

pid process

4560 wbadmin.exe
3880 wbadmin.exe
Downloads MZ/PE file
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exenetsh.exe

pid process

3764 netsh.exe
900 netsh.exe

pid	process
4132	bcdedit.exe
1164	bcdedit.exe
3772	bcdedit.exe
300	bcdedit.exe

flow	pid	process
22	1472	powershell.exe

pid	process
4560	wbadmin.exe
3880	wbadmin.exe

pid	process
3764	netsh.exe
900	netsh.exe

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

1B87.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\ReadRestart.tiff	1B87.exe
File opened for modification	C:\Users\Admin\Pictures\MergeRepair.tiff	1B87.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

1B87.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Control Panel\International\Geo\Nation 1B87.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Control Panel\International\Geo\Nation	1B87.exe

Drops startup file 3 IoCs

Processes:

1B87.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\1B87.exe	1B87.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	1B87.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[56C78627-3483].[[email protected]].8base	1B87.exe

Executes dropped EXE 6 IoCs

Processes:

ldx999sx.exes777mx.exeldx999sx.exe1B87.exe1D4D.exe1B87.exe

pid process

3356 ldx999sx.exe
2964 s777mx.exe
4856 ldx999sx.exe
948 1B87.exe
4244 1D4D.exe
64 1B87.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3356	ldx999sx.exe
2964	s777mx.exe
4856	ldx999sx.exe
948	1B87.exe
4244	1D4D.exe
64	1B87.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1B87.exes777mx.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1B87 = "C:\\Users\\Admin\\AppData\\Local\\1B87.exe"	1B87.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1B87 = "C:\\Users\\Admin\\AppData\\Local\\1B87.exe"	1B87.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Software\Microsoft\Windows\CurrentVersion\Run	s777mx.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\s777mx.exe'\""	s777mx.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

1B87.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	1B87.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	1B87.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	1B87.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	1B87.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	1B87.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	1B87.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	1B87.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	1B87.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	1B87.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	1B87.exe
File opened for modification	C:\Users\Public\desktop.ini	1B87.exe
File opened for modification	C:\Program Files\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	1B87.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	1B87.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	1B87.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	1B87.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	1B87.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	1B87.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	1B87.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	1B87.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	1B87.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-4129409437-3162877118-52503038-1000\desktop.ini	1B87.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	1B87.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	1B87.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	1B87.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	1B87.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	1B87.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	1B87.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	1B87.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	1B87.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	1B87.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	1B87.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 26 IoCs

Processes:

powershell.exe

pid	process
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

powershell.exeldx999sx.exe

description	pid	process	target process
PID 1472 set thread context of 2508	1472	powershell.exe	aspnet_compiler.exe
PID 3356 set thread context of 4856	3356	ldx999sx.exe	ldx999sx.exe

Drops file in Program Files directory 64 IoCs

Processes:

1B87.exe

description	ioc	process
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdmo_plugin.dll.id[56C78627-3483].[[email protected]].8base	1B87.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\PREVIEW.GIF	1B87.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderMedTile.contrast-white_scale-100.png	1B87.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar	1B87.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd.id[56C78627-3483].[[email protected]].8base	1B87.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png	1B87.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-core-xstate-l2-1-0.dll	1B87.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\AppxSignature.p7x	1B87.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\WideTile.scale-100.png	1B87.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-96_altform-lightunplated.png	1B87.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll	1B87.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\comments.win32.tpn.id[56C78627-3483].[[email protected]].8base	1B87.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldExist.snippets.ps1xml	1B87.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf.id[56C78627-3483].[[email protected]].8base	1B87.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-runtime-l1-1-0.dll	1B87.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.175.29\psmachine.dll	1B87.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Interop.MSDASC.dll	1B87.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\SharePointPortalSite.ico.id[56C78627-3483].[[email protected]].8base	1B87.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pt-br_get.svg.id[56C78627-3483].[[email protected]].8base	1B87.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\ui-strings.js.id[56C78627-3483].[[email protected]].8base	1B87.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\PortalConnectCore.dll	1B87.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll	1B87.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Exist.ps1	1B87.exe
File created	C:\Program Files\Java\jre1.8.0_66\bin\zip.dll.id[56C78627-3483].[[email protected]].8base	1B87.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Storage.XmlSerializers.dll	1B87.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\meBoot.min.js	1B87.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT.id[56C78627-3483].[[email protected]].8base	1B87.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\MSFT_PackageManagementSource.strings.psd1	1B87.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar.id[56C78627-3483].[[email protected]].8base	1B87.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\STINTL.DLL.id[56C78627-3483].[[email protected]].8base	1B87.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-100.png	1B87.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.SmartGlass.Controls\BridgedWebBrowser.xaml	1B87.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nb-no\ui-strings.js	1B87.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.id[56C78627-3483].[[email protected]].8base	1B87.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\46.jpg	1B87.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36.png	1B87.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptySearch.scale-125.png	1B87.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\scanAppLogo.png	1B87.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.id[56C78627-3483].[[email protected]].8base	1B87.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-16_contrast-black.png	1B87.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\rss.gif	1B87.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe.id[56C78627-3483].[[email protected]].8base	1B87.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ONBttnIELinkedNotes.dll	1B87.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\sq.pak.id[56C78627-3483].[[email protected]].8base	1B87.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml	1B87.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms.id[56C78627-3483].[[email protected]].8base	1B87.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar	1B87.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\AppxManifest.xml	1B87.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\sample-thumb.png.id[56C78627-3483].[[email protected]].8base	1B87.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml	1B87.exe
File created	C:\Program Files\Java\jre1.8.0_66\lib\jsse.jar.id[56C78627-3483].[[email protected]].8base	1B87.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.id[56C78627-3483].[[email protected]].8base	1B87.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-30_altform-lightunplated.png	1B87.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons.png.id[56C78627-3483].[[email protected]].8base	1B87.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_zh_TW.properties.id[56C78627-3483].[[email protected]].8base	1B87.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar	1B87.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Microsoft.AnalysisServices.AzureClient.dll	1B87.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\ui-strings.js	1B87.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ko-kr\ui-strings.js.id[56C78627-3483].[[email protected]].8base	1B87.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-settings.jar	1B87.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.GrayF.png.id[56C78627-3483].[[email protected]].8base	1B87.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\reduced_mode.png	1B87.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\Cryptomining.id[56C78627-3483].[[email protected]].8base	1B87.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_checkbox_unselected_18.svg.id[56C78627-3483].[[email protected]].8base	1B87.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4148 64 WerFault.exe 1B87.exe
3184 4244 WerFault.exe 1D4D.exe

pid	pid_target	process	target process
4148	64	WerFault.exe	1B87.exe
3184	4244	WerFault.exe	1D4D.exe

Checks SCSI registry key(s) 3 TTPs 7 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vds.exeldx999sx.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ldx999sx.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ldx999sx.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ldx999sx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe

Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

3732 vssadmin.exe
4088 vssadmin.exe

pid	process
3732	vssadmin.exe
4088	vssadmin.exe

Modifies registry class 3 IoCs

Processes:

1B87.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings	1B87.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exe

pid	process
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2568
Suspicious behavior: MapViewOfSection 31 IoCs

Processes:

ldx999sx.exe

pid process

4856 ldx999sx.exe
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568

pid	process
2568

pid	process
4856	ldx999sx.exe
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568
2568

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exeaspnet_compiler.exe1B87.exevssvc.exeWMIC.exewbengine.exe

description	pid	process
Token: SeDebugPrivilege	1472	powershell.exe
Token: SeShutdownPrivilege	1472	powershell.exe
Token: SeCreatePagefilePrivilege	1472	powershell.exe
Token: SeDebugPrivilege	2508	aspnet_compiler.exe
Token: SeShutdownPrivilege	2568
Token: SeCreatePagefilePrivilege	2568
Token: SeShutdownPrivilege	2568
Token: SeCreatePagefilePrivilege	2568
Token: SeDebugPrivilege	948	1B87.exe
Token: SeBackupPrivilege	4124	vssvc.exe
Token: SeRestorePrivilege	4124	vssvc.exe
Token: SeAuditPrivilege	4124	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4036	WMIC.exe
Token: SeSecurityPrivilege	4036	WMIC.exe
Token: SeTakeOwnershipPrivilege	4036	WMIC.exe
Token: SeLoadDriverPrivilege	4036	WMIC.exe
Token: SeSystemProfilePrivilege	4036	WMIC.exe
Token: SeSystemtimePrivilege	4036	WMIC.exe
Token: SeProfSingleProcessPrivilege	4036	WMIC.exe
Token: SeIncBasePriorityPrivilege	4036	WMIC.exe
Token: SeCreatePagefilePrivilege	4036	WMIC.exe
Token: SeBackupPrivilege	4036	WMIC.exe
Token: SeRestorePrivilege	4036	WMIC.exe
Token: SeShutdownPrivilege	4036	WMIC.exe
Token: SeDebugPrivilege	4036	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4036	WMIC.exe
Token: SeRemoteShutdownPrivilege	4036	WMIC.exe
Token: SeUndockPrivilege	4036	WMIC.exe
Token: SeManageVolumePrivilege	4036	WMIC.exe
Token: 33	4036	WMIC.exe
Token: 34	4036	WMIC.exe
Token: 35	4036	WMIC.exe
Token: 36	4036	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4036	WMIC.exe
Token: SeSecurityPrivilege	4036	WMIC.exe
Token: SeTakeOwnershipPrivilege	4036	WMIC.exe
Token: SeLoadDriverPrivilege	4036	WMIC.exe
Token: SeSystemProfilePrivilege	4036	WMIC.exe
Token: SeSystemtimePrivilege	4036	WMIC.exe
Token: SeProfSingleProcessPrivilege	4036	WMIC.exe
Token: SeIncBasePriorityPrivilege	4036	WMIC.exe
Token: SeCreatePagefilePrivilege	4036	WMIC.exe
Token: SeBackupPrivilege	4036	WMIC.exe
Token: SeRestorePrivilege	4036	WMIC.exe
Token: SeShutdownPrivilege	4036	WMIC.exe
Token: SeDebugPrivilege	4036	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4036	WMIC.exe
Token: SeRemoteShutdownPrivilege	4036	WMIC.exe
Token: SeUndockPrivilege	4036	WMIC.exe
Token: SeManageVolumePrivilege	4036	WMIC.exe
Token: 33	4036	WMIC.exe
Token: 34	4036	WMIC.exe
Token: 35	4036	WMIC.exe
Token: 36	4036	WMIC.exe
Token: SeBackupPrivilege	4368	wbengine.exe
Token: SeRestorePrivilege	4368	wbengine.exe
Token: SeSecurityPrivilege	4368	wbengine.exe
Token: SeShutdownPrivilege	2568
Token: SeCreatePagefilePrivilege	2568
Token: SeShutdownPrivilege	2568
Token: SeCreatePagefilePrivilege	2568
Token: SeShutdownPrivilege	2568
Token: SeCreatePagefilePrivilege	2568
Token: SeShutdownPrivilege	2568

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b5237a3f0b1db945c1fe3f9ba71e3ff2.exepowershell.exeaspnet_compiler.exeldx999sx.exe1B87.execmd.execmd.exe

description	pid	process	target process
PID 2384 wrote to memory of 1472	2384	b5237a3f0b1db945c1fe3f9ba71e3ff2.exe	powershell.exe
PID 2384 wrote to memory of 1472	2384	b5237a3f0b1db945c1fe3f9ba71e3ff2.exe	powershell.exe
PID 2384 wrote to memory of 1472	2384	b5237a3f0b1db945c1fe3f9ba71e3ff2.exe	powershell.exe
PID 1472 wrote to memory of 2508	1472	powershell.exe	aspnet_compiler.exe
PID 1472 wrote to memory of 2508	1472	powershell.exe	aspnet_compiler.exe
PID 1472 wrote to memory of 2508	1472	powershell.exe	aspnet_compiler.exe
PID 1472 wrote to memory of 2508	1472	powershell.exe	aspnet_compiler.exe
PID 1472 wrote to memory of 2508	1472	powershell.exe	aspnet_compiler.exe
PID 1472 wrote to memory of 2508	1472	powershell.exe	aspnet_compiler.exe
PID 1472 wrote to memory of 2508	1472	powershell.exe	aspnet_compiler.exe
PID 1472 wrote to memory of 2508	1472	powershell.exe	aspnet_compiler.exe
PID 2508 wrote to memory of 3356	2508	aspnet_compiler.exe	ldx999sx.exe
PID 2508 wrote to memory of 3356	2508	aspnet_compiler.exe	ldx999sx.exe
PID 2508 wrote to memory of 3356	2508	aspnet_compiler.exe	ldx999sx.exe
PID 2508 wrote to memory of 2964	2508	aspnet_compiler.exe	s777mx.exe
PID 2508 wrote to memory of 2964	2508	aspnet_compiler.exe	s777mx.exe
PID 2508 wrote to memory of 2964	2508	aspnet_compiler.exe	s777mx.exe
PID 3356 wrote to memory of 4856	3356	ldx999sx.exe	ldx999sx.exe
PID 3356 wrote to memory of 4856	3356	ldx999sx.exe	ldx999sx.exe
PID 3356 wrote to memory of 4856	3356	ldx999sx.exe	ldx999sx.exe
PID 3356 wrote to memory of 4856	3356	ldx999sx.exe	ldx999sx.exe
PID 3356 wrote to memory of 4856	3356	ldx999sx.exe	ldx999sx.exe
PID 3356 wrote to memory of 4856	3356	ldx999sx.exe	ldx999sx.exe
PID 2568 wrote to memory of 948	2568		1B87.exe
PID 2568 wrote to memory of 948	2568		1B87.exe
PID 2568 wrote to memory of 948	2568		1B87.exe
PID 2568 wrote to memory of 4244	2568		1D4D.exe
PID 2568 wrote to memory of 4244	2568		1D4D.exe
PID 2568 wrote to memory of 4244	2568		1D4D.exe
PID 2568 wrote to memory of 3864	2568		explorer.exe
PID 2568 wrote to memory of 3864	2568		explorer.exe
PID 2568 wrote to memory of 3864	2568		explorer.exe
PID 2568 wrote to memory of 3864	2568		explorer.exe
PID 2568 wrote to memory of 4624	2568		explorer.exe
PID 2568 wrote to memory of 4624	2568		explorer.exe
PID 2568 wrote to memory of 4624	2568		explorer.exe
PID 2568 wrote to memory of 828	2568		explorer.exe
PID 2568 wrote to memory of 828	2568		explorer.exe
PID 2568 wrote to memory of 828	2568		explorer.exe
PID 2568 wrote to memory of 828	2568		explorer.exe
PID 2568 wrote to memory of 436	2568		explorer.exe
PID 2568 wrote to memory of 436	2568		explorer.exe
PID 2568 wrote to memory of 436	2568		explorer.exe
PID 2568 wrote to memory of 436	2568		explorer.exe
PID 2568 wrote to memory of 380	2568		explorer.exe
PID 2568 wrote to memory of 380	2568		explorer.exe
PID 2568 wrote to memory of 380	2568		explorer.exe
PID 2568 wrote to memory of 380	2568		explorer.exe
PID 948 wrote to memory of 1104	948	1B87.exe	cmd.exe
PID 948 wrote to memory of 1104	948	1B87.exe	cmd.exe
PID 948 wrote to memory of 1388	948	1B87.exe	cmd.exe
PID 948 wrote to memory of 1388	948	1B87.exe	cmd.exe
PID 2568 wrote to memory of 4632	2568		explorer.exe
PID 2568 wrote to memory of 4632	2568		explorer.exe
PID 2568 wrote to memory of 4632	2568		explorer.exe
PID 2568 wrote to memory of 5052	2568		explorer.exe
PID 2568 wrote to memory of 5052	2568		explorer.exe
PID 2568 wrote to memory of 5052	2568		explorer.exe
PID 2568 wrote to memory of 5052	2568		explorer.exe
PID 1388 wrote to memory of 3764	1388	cmd.exe	netsh.exe
PID 1388 wrote to memory of 3764	1388	cmd.exe	netsh.exe
PID 1104 wrote to memory of 3732	1104	cmd.exe	vssadmin.exe
PID 1104 wrote to memory of 3732	1104	cmd.exe	vssadmin.exe
PID 1104 wrote to memory of 4036	1104	cmd.exe	WMIC.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Users\Admin\AppData\Local\Temp\b5237a3f0b1db945c1fe3f9ba71e3ff2.exe
"C:\Users\Admin\AppData\Local\Temp\b5237a3f0b1db945c1fe3f9ba71e3ff2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2384

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
2⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
C:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508

C:\Users\Admin\AppData\Local\Temp\ldx999sx.exe
"C:\Users\Admin\AppData\Local\Temp\ldx999sx.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3356

C:\Users\Admin\AppData\Local\Temp\ldx999sx.exe
"C:\Users\Admin\AppData\Local\Temp\ldx999sx.exe"
5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4856

C:\Users\Admin\AppData\Local\Temp\s777mx.exe
"C:\Users\Admin\AppData\Local\Temp\s777mx.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2964

C:\Users\Admin\AppData\Local\Temp\1B87.exe
C:\Users\Admin\AppData\Local\Temp\1B87.exe
1⤵
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948

C:\Users\Admin\AppData\Local\Temp\1B87.exe
"C:\Users\Admin\AppData\Local\Temp\1B87.exe"
2⤵
- Executes dropped EXE
PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 460
3⤵
- Program crash
PID:4148

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
3⤵
- Modifies Windows Firewall
PID:3764

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
3⤵
- Modifies Windows Firewall
PID:900

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:3732

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4036

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
- Modifies boot configuration data using bcdedit
PID:4132

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
3⤵
- Modifies boot configuration data using bcdedit
PID:1164

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
3⤵
- Deletes backup catalog
PID:4560

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
2⤵
PID:3928

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
2⤵
PID:3292

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
2⤵
PID:3916

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
2⤵
PID:216

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
PID:2064

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:4088

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
PID:4648

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
- Modifies boot configuration data using bcdedit
PID:3772

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
3⤵
- Modifies boot configuration data using bcdedit
PID:300

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
3⤵
- Deletes backup catalog
PID:3880

C:\Users\Admin\AppData\Local\Temp\1D4D.exe
C:\Users\Admin\AppData\Local\Temp\1D4D.exe
1⤵
- Executes dropped EXE
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 252
2⤵
- Program crash
PID:3184

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:3864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 64 -ip 64
1⤵
PID:3712

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4624

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:828

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:436

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:380

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4632

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5052

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1800

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:3356

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:1464

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:536

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4928

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:620

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:972

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1564

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1980

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4244 -ip 4244
1⤵
PID:2192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[56C78627-3483].[[email protected]].8base

Filesize
3.2MB

MD5
89c44b8f8f4ad7079cd1eb0bddb91dd6

SHA1
ff624ecc60037fbe0260ef6e860242fefa484380

SHA256
1815233a7cec67d412f58de7ba870657e5890b7be1b395aeb1f94e8fea80feae

SHA512
1060c5d838aad6f61b1bb156e283477476acdc74eb312c4f783be14bd46bcd702d0177e1c757ddb989264ff1f299af3ae3a7d2a482a1246b81bdc29c8cb51528

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\1B87.exe

Filesize
235KB

MD5
0f281d2506515a64082d6e774573afb7

SHA1
8949f27465913bf475fceb5796b205429083df58

SHA256
2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb

SHA512
f4ddb22c7dec04ca862d3df88e285025e02c185dbb2c061e9d0092ba3e8e8e083ca55612aae6b2d5792038729c55c0eaf193048991c0b06c8639a52017102622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aspnet_compiler.exe.log

Filesize
2KB

MD5
9b756bc85e5324eb8f87a69e3f9959ab

SHA1
1778b2e2d6a00c421578a284db1e743931611d66

SHA256
e347a39e49ca8c835cc47d3f039230969e7c4156089f2e83e8a0aed1df88016e

SHA512
c897af3307e3c3163762021f49934ac5fbeab27f123e814bc390bdf1f0ed46671afeadcc87a8a4b18ddf13f4abd0d8ef00343af91ff999d7d447c96505d866d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\b5237a3f0b1db945c1fe3f9ba71e3ff2.exe.log

Filesize
1KB

MD5
fe0908886369b89d8054d60627e3a368

SHA1
49eae30bd2067c7750f978dabb47114eaf16015d

SHA256
213132b28845eeec2a3907abab14ffe8e3656e5dd809b71621e067a4282f692b

SHA512
e0c9cbf7fecf4a880aeaa5b367ae52d8f10e885514df33c1c559c4ff320bda0764f51c5af592758536fc829740ee541dddd4e947c74cef9db2bb0a3e6d8348df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
34d461b8b826e81426975ca16787672f

SHA1
82737839fcf9e0f0eca8a879035ea512fd2edaa4

SHA256
45f4b6bf317f54ca9f783d88793ffd40ea9b43f3d89ac3d4c494031945a03705

SHA512
1891e62ecff1cc6b96b9834358a07dd33818e8f4f42f67967fdc72da5cf68df6bb8d7ac26e1401aef51af480514e7ee5582cc0af7abfbc879597ffc2e8d6f89e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000023.db.id[56C78627-3483].[[email protected]].8base

Filesize
96KB

MD5
fb46ea0b68b69326f621c0cf2488ce7e

SHA1
13ebf68d8ceae14aba66d94a9f62d5f004413f15

SHA256
fe67de9e002b2ca8747a12ad0a10e642a33ce1932cb8727b3e40ce96fecc6d12

SHA512
19aaae677e644b03890c1955e623cc7a2ac04b41ec9c44ecaac6dd3423881a16bbac532d1312c0e77935a68e0b705a5c99ab07b67d14fb3b1d30a15ee3cc07c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
3337d66209faa998d52d781d0ff2d804

SHA1
6594b85a70f998f79f43cdf1ca56137997534156

SHA256
9b946b062865f68b9f0f43a011d33d7ea0926a3c8f78fb20d9cab6144314e1bd

SHA512
8bbd14bd73111f7b55712f5d1e1b727e41db8e6e0c1243ee6809ff32b509e52dec7af34c064151fb5beccd59dda434a3f83abe987c561a25abfbb4cbcf9c7f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
21KB

MD5
be7e1d310d3d21c2721265966a51e081

SHA1
c0ed93cd48d1cbe75f1623aef1d20f667a6541d1

SHA256
60afce48d3afaa612505064eb7d48a42c2de1a82e90c8aaa3665725114a56f4f

SHA512
e820d6c3d3bb0573fc8fb0802190a7584cf647d5e880011a3c3dde3d99245b0448a261f351e77844c3108efe935766d61fcc2be32c33e41572fe64d19fd3cde0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1B87.exe

Filesize
235KB

MD5
0f281d2506515a64082d6e774573afb7

SHA1
8949f27465913bf475fceb5796b205429083df58

SHA256
2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb

SHA512
f4ddb22c7dec04ca862d3df88e285025e02c185dbb2c061e9d0092ba3e8e8e083ca55612aae6b2d5792038729c55c0eaf193048991c0b06c8639a52017102622

Download Submit
C:\Users\Admin\AppData\Local\Temp\1B87.exe

Filesize
235KB

MD5
0f281d2506515a64082d6e774573afb7

SHA1
8949f27465913bf475fceb5796b205429083df58

SHA256
2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb

SHA512
f4ddb22c7dec04ca862d3df88e285025e02c185dbb2c061e9d0092ba3e8e8e083ca55612aae6b2d5792038729c55c0eaf193048991c0b06c8639a52017102622

Download Submit
C:\Users\Admin\AppData\Local\Temp\1B87.exe

Filesize
235KB

MD5
0f281d2506515a64082d6e774573afb7

SHA1
8949f27465913bf475fceb5796b205429083df58

SHA256
2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb

SHA512
f4ddb22c7dec04ca862d3df88e285025e02c185dbb2c061e9d0092ba3e8e8e083ca55612aae6b2d5792038729c55c0eaf193048991c0b06c8639a52017102622

Download Submit
C:\Users\Admin\AppData\Local\Temp\1D4D.exe

Filesize
220KB

MD5
8d7ebe871589d79f195f240dcef43a57

SHA1
f5315edc9bfeb6f37c9df6ad1f10cb3363412d96

SHA256
19397c6dce459330095edc72759d1e79e26f1e12f013cdaee6dbdb90d65aaae8

SHA512
244be66bb480d320ef6d5cbfcd21e526a53726397c1fc4b512935bc50039b0bb773e3f12fd53910d3da9e69ebb8e3fd1a56d22d2fcb2e090c93c9759cdc497cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1D4D.exe

Filesize
220KB

MD5
8d7ebe871589d79f195f240dcef43a57

SHA1
f5315edc9bfeb6f37c9df6ad1f10cb3363412d96

SHA256
19397c6dce459330095edc72759d1e79e26f1e12f013cdaee6dbdb90d65aaae8

SHA512
244be66bb480d320ef6d5cbfcd21e526a53726397c1fc4b512935bc50039b0bb773e3f12fd53910d3da9e69ebb8e3fd1a56d22d2fcb2e090c93c9759cdc497cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.dll

Filesize
4.8MB

MD5
197e685df6a238a6a94f9a4a46d55f11

SHA1
4f4c45b8371a11f79520395313fd5b0aca272006

SHA256
45b4c3d0652e160bbf96bfc9dcb373bae937352d510a15b54c054ff3b774c13b

SHA512
a30efa859db1f7e9af70d435432fcc9c072e21c4eadb686a613da8611935cf9521c04498dc51f093cc28de2331f8065125fced68d130ae6333ffd6a4190153f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.dll.id[56C78627-3483].[[email protected]].8base

Filesize
5.5MB

MD5
cbf81faa91432cae86651c682c523a6a

SHA1
692e73b9032d48ee6c2ef6b791338aae30e79f30

SHA256
2ddf1d2e796426d865e9ddbda338cdb716fda6a39de5550770c8aafe063f8c47

SHA512
47a293ace9b6d9e37cb1a3b2602c546bdec1eb3a1d448f0b1d521411778bafccbb2e8f1a51badc7481ef16d77d57574981249ede092b5940f8e961122afc08f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe

Filesize
18KB

MD5
cfe72ed40a076ae4f4157940ce0c5d44

SHA1
8010f7c746a7ba4864785f798f46ec05caae7ece

SHA256
6868894ab04d08956388a94a81016f03d5b7a7b1646c8a6235057a7e1e45de32

SHA512
f002afa2131d250dd6148d8372ce45f84283b8e1209e91720cee7aff497503d0e566bae3a83cd326701458230ae5c0e200eec617889393dd46ac00ff357ff1b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe.id[56C78627-3483].[[email protected]].8base

Filesize
18KB

MD5
5c84be18452016bc548ecae6f1a2f839

SHA1
19001fa2d58120439b719e56b9e3eb142007d1de

SHA256
e4d962c0c90085bb263d9df8d46d3ece77dba94e8ab42724b96bec8a7a13bd98

SHA512
82de1d1d8f8c923526ff9bed3558bd4fb4439db840318856464c0aa25a4d21b4fbd48ad7ac288207a07ea5641accd841708c3d7c726c4aafb0b7bd091a18fdda

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\ProgramData\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe.xml

Filesize
1KB

MD5
94f90fcd2b8f7f1df69224f845d9e9b7

SHA1
a09e3072cc581cf89adaf1aa20aa89b3af7bf987

SHA256
a16113a66b1c36f919b5f7eaa3fb7aa8e0ba9e057823861aabea703cc06a04c0

SHA512
51f4ee06a8d8bf1121083bf4383433160f16c68d1fe4c44e5d0e0529910d27ba8446c7a4bef359b990574d1d61563da30139c6d09ad0ad1a5b5c7748b8da08f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\ProgramData\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe.xml.id[56C78627-3483].[[email protected]].8base

Filesize
1KB

MD5
10f8e322ca5f720847caf977ba0bf88b

SHA1
615396325ac84a0063ce40182782ce82324b1e7e

SHA256
9dc17782bdbbe2b3d14fb8f877256a29af302660f8da5ac577a51c9f76210ed4

SHA512
e15b592a4e5820a22a40c9f7447402f4f5cf98d57839f88713277c321f621c411c6821d2ced9ff3f6aa78f12576295740190e4ca7f33a06c2bc89ae38a40c69a

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\ProgramData\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe.xml

Filesize
7KB

MD5
108f130067a9df1719c590316a5245f7

SHA1
79bb9a86e7a50c85214cd7e21719f0cb4155f58a

SHA256
c91debd34057ca5c280ca15ac542733930e1c94c7d887448eac6e3385b5a0874

SHA512
d43b3861d5153c7ca54edd078c900d31599fc9f04d6883a449d62c7e86a105a3c5dfb2d232255c41505b210b063caf6325921dc074fcdf93407c9e2c985a5301

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\ProgramData\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe.xml.id[56C78627-3483].[[email protected]].8base

Filesize
7KB

MD5
3bee50de7dcb7913ac35c79912efa464

SHA1
0890c03f69ea0309f738ac6cb3b06b1b0d542b7e

SHA256
e55a5abddf9fcc756cfabe8da73f5ff4cec369e36b1c26ea925d8d471bd883b2

SHA512
da7dab755cc3ca8309f2aa01c75cf6810aa1b13c12a65d3a40dc3981e4952380ec445a82bc34ea66d25519c98ec58184ed6fb9962a3a4fb1144cb648a664bb56

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Users\All Users\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe.xml

Filesize
1KB

MD5
94f90fcd2b8f7f1df69224f845d9e9b7

SHA1
a09e3072cc581cf89adaf1aa20aa89b3af7bf987

SHA256
a16113a66b1c36f919b5f7eaa3fb7aa8e0ba9e057823861aabea703cc06a04c0

SHA512
51f4ee06a8d8bf1121083bf4383433160f16c68d1fe4c44e5d0e0529910d27ba8446c7a4bef359b990574d1d61563da30139c6d09ad0ad1a5b5c7748b8da08f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Users\All Users\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe.xml.id[56C78627-3483].[[email protected]].8base

Filesize
1KB

MD5
ac5b176103125fa40747e84aa53ef32d

SHA1
b9ade97e6d2619c11d37dda2a430feedebb42379

SHA256
d6cf3dc51e43ff965024cbff1041f4bb9b7de87dbfa11677d495df9d7a399314

SHA512
9c02d3554923afcee14053fd20157c5a77cea96a9b9471e6ead4abdbba8c41c114d47812cc6340d14cacf05d72fb10675a51f7bfba5ebb1657d060fbd05dcfb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Users\All Users\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe.xml

Filesize
7KB

MD5
108f130067a9df1719c590316a5245f7

SHA1
79bb9a86e7a50c85214cd7e21719f0cb4155f58a

SHA256
c91debd34057ca5c280ca15ac542733930e1c94c7d887448eac6e3385b5a0874

SHA512
d43b3861d5153c7ca54edd078c900d31599fc9f04d6883a449d62c7e86a105a3c5dfb2d232255c41505b210b063caf6325921dc074fcdf93407c9e2c985a5301

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Users\All Users\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe.xml.id[56C78627-3483].[[email protected]].8base

Filesize
7KB

MD5
33bda5c81c2b8841da58a87a85a73007

SHA1
031fe2ae9092f7cc5855e2f27cda8e1207cf68f6

SHA256
caa69cd3cb5f066d728b4748ac0729c1fba929cd0ec30998932a171d416d4a30

SHA512
7bbe0f7ac0fcff61d59b880bc8b13c895a1b6a8543f185c5f4d3eba4f6b62752ccd806d917c04325979370a4dd7cee2b61417a87845d05d7766d27f4a514bec6

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Windows\SysWOW64\WalletBackgroundServiceProxy.dll

Filesize
10KB

MD5
1097d1e58872f3cf58f78730a697ce4b

SHA1
96db4e4763a957b28dd80ec1e43eb27367869b86

SHA256
83ec0be293b19d00eca4ae51f16621753e1d2b11248786b25a1abaae6230bdef

SHA512
b933eac4eaabacc51069a72b24b649b980aea251b1b87270ff4ffea12de9368d5447cdbe748ac7faf2805548b896c8499f9eceeed2f5efd0c684f94360940351

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Windows\SysWOW64\WalletBackgroundServiceProxy.dll.id[56C78627-3483].[[email protected]].8base

Filesize
10KB

MD5
b88cf31210a52086e96dd2c52d24f20d

SHA1
83e7d36022597e892f73d6c09b4a0019840d9221

SHA256
bdebbe47f927bc50615ca4160d1184eae999499b1cbc02ce0b6debd1ad0d654a

SHA512
c46bb55bad12a070af47ab1176654b06980fb31b34aec90a4696a7c67db6829d12f16b4d0326384580f8285f56bcaf6cf72c7340057d386a8bf8a6e403904e13

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Windows\SysWOW64\WalletProxy.dll

Filesize
36KB

MD5
d09724c29a8f321f2f9c552de6ef6afa

SHA1
d6ce3d3a973695f4f770e7fb3fcb5e2f3df592a3

SHA256
23cc82878957683184fbd0e3098e9e6858978bf78d7812c6d7470ebdc79d1c5c

SHA512
cc8db1b0c4bbd94dfc8a669cd6accf6fa29dc1034ce03d9dae53d6ce117bb86b432bf040fb53230b612c6e9a325e58acc8ebb600f760a8d9d6a383ce751fd6ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Windows\SysWOW64\WalletProxy.dll.id[56C78627-3483].[[email protected]].8base

Filesize
36KB

MD5
a89f329b51cc460ad4d97e0d823d8fd0

SHA1
b51726ba231e6b3a9b808a19cc0bdadfc03d3f94

SHA256
c0fbe11f9aeddc836b08fa7f6b7aff02ce77c45ea4ba2b87e317f5ba9ddc836c

SHA512
7eb5d714c6222fed5f515f36c2d56bc1dd3ebdb1a0c15eaa7f83cf35808257f18d24826a1bebd23134979db4be86308ee8cdb241444b174c09296053c0e708d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Windows\SysWOW64\Windows.ApplicationModel.Wallet.dll

Filesize
402KB

MD5
02557c141c9e153c2b7987b79a3a2dd7

SHA1
a054761382ee68608b6a3b62b68138dc205f576b

SHA256
207c587e769e2655669bd3ce1d28a00bcac08f023013735f026f65c0e3baa6f4

SHA512
a37e29c115bcb9956b1f8fd2022f2e3966c1fa2a0efa5c2ee2d14bc5c41bfddae0deea4d481a681d13ec58e9dec41e7565f8b4eb1c10f2c44c03e58bdd2792b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Windows\SysWOW64\Windows.ApplicationModel.Wallet.dll.id[56C78627-3483].[[email protected]].8base

Filesize
402KB

MD5
6043482b046a54327d9daa52df802105

SHA1
949cb79dd3e908b97d01cb791ba815f5c511e518

SHA256
aa2559cd315ad950efab700d65c5ccd7c6e6d19b20c43a4d01dfc342fa663bcc

SHA512
7af8924b57a6c6b0ed914a2243cd51164fbfba5672714a7d62410d466b253d3dfc225c515ca87fdbd230147eaec215018e6bf939090e968bbfe6f3ee9d14e3e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Windows\System32\WalletBackgroundServiceProxy.dll

Filesize
10KB

MD5
1097d1e58872f3cf58f78730a697ce4b

SHA1
96db4e4763a957b28dd80ec1e43eb27367869b86

SHA256
83ec0be293b19d00eca4ae51f16621753e1d2b11248786b25a1abaae6230bdef

SHA512
b933eac4eaabacc51069a72b24b649b980aea251b1b87270ff4ffea12de9368d5447cdbe748ac7faf2805548b896c8499f9eceeed2f5efd0c684f94360940351

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Windows\System32\WalletBackgroundServiceProxy.dll.id[56C78627-3483].[[email protected]].8base

Filesize
10KB

MD5
dba4b32bdef8e10ad3765526ce4c3524

SHA1
9ae7e130aa349ed0c948aa99d773d7e8ce8a7e24

SHA256
78970317970a94b3b56eb4bb9dd3785b26c9241abcb1a6f2dfcbed0f730e3044

SHA512
39fd7b9152321ccb57fe945e0c6b38dc04bb42f252ba9fbfb8aa0fcbf4c48737eed0e157eb372de10d6154ea29bbb28804cbbffea906c926f69570b79ba8f478

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Windows\System32\WalletProxy.dll

Filesize
36KB

MD5
d09724c29a8f321f2f9c552de6ef6afa

SHA1
d6ce3d3a973695f4f770e7fb3fcb5e2f3df592a3

SHA256
23cc82878957683184fbd0e3098e9e6858978bf78d7812c6d7470ebdc79d1c5c

SHA512
cc8db1b0c4bbd94dfc8a669cd6accf6fa29dc1034ce03d9dae53d6ce117bb86b432bf040fb53230b612c6e9a325e58acc8ebb600f760a8d9d6a383ce751fd6ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Windows\System32\WalletProxy.dll.id[56C78627-3483].[[email protected]].8base

Filesize
36KB

MD5
c5636957e53e8450d76389d57267b553

SHA1
5f65ce8b456e2929e760cc01dc86c551a584a04f

SHA256
c19b64e88a82d169e31ef57f697cba8f61e4c7c2786de44fc9e44637a2888183

SHA512
14258fac86c59c1ea00e9f00f900b35105554d97bc14a0f2ec289ee0a7a19ab59cfeec8ff81217f0088d410ab360938803edfc4b0e1a0b147460969059046180

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Windows\System32\Windows.ApplicationModel.Wallet.dll

Filesize
402KB

MD5
02557c141c9e153c2b7987b79a3a2dd7

SHA1
a054761382ee68608b6a3b62b68138dc205f576b

SHA256
207c587e769e2655669bd3ce1d28a00bcac08f023013735f026f65c0e3baa6f4

SHA512
a37e29c115bcb9956b1f8fd2022f2e3966c1fa2a0efa5c2ee2d14bc5c41bfddae0deea4d481a681d13ec58e9dec41e7565f8b4eb1c10f2c44c03e58bdd2792b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Windows\System32\Windows.ApplicationModel.Wallet.dll.id[56C78627-3483].[[email protected]].8base

Filesize
402KB

MD5
63ee93aaf0aa8f0c2a4111fb505f7ab2

SHA1
53705cb08764bc50c2fa47ae3316008ad0f6d3c3

SHA256
66382092765a2788a4fc0930d986ae8ce1f8f826fe99aca190d6f3acf525450f

SHA512
5d153aad7c92b27b126e12b21354f8c9b2b2eaa1e369120e2484e3fd3e57a81e8d2e0b93f1686a6dff88b8f0d04466869cb5e31df62fc22854e32c093aa5a239

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Windows\WinSxS\wow64_microsoft-windows-w..ice.backgroundproxy_31bf3856ad364e35_10.0.19041.1_none_046b779f2003c415\WalletBackgroundServiceProxy.dll

Filesize
10KB

MD5
1097d1e58872f3cf58f78730a697ce4b

SHA1
96db4e4763a957b28dd80ec1e43eb27367869b86

SHA256
83ec0be293b19d00eca4ae51f16621753e1d2b11248786b25a1abaae6230bdef

SHA512
b933eac4eaabacc51069a72b24b649b980aea251b1b87270ff4ffea12de9368d5447cdbe748ac7faf2805548b896c8499f9eceeed2f5efd0c684f94360940351

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Windows\WinSxS\wow64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_69993b7d6814452d\WalletProxy.dll

Filesize
36KB

MD5
d09724c29a8f321f2f9c552de6ef6afa

SHA1
d6ce3d3a973695f4f770e7fb3fcb5e2f3df592a3

SHA256
23cc82878957683184fbd0e3098e9e6858978bf78d7812c6d7470ebdc79d1c5c

SHA512
cc8db1b0c4bbd94dfc8a669cd6accf6fa29dc1034ce03d9dae53d6ce117bb86b432bf040fb53230b612c6e9a325e58acc8ebb600f760a8d9d6a383ce751fd6ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\465F\C\Windows\WinSxS\wow64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_b3a887dd4a9553e8\Windows.ApplicationModel.Wallet.dll

Filesize
402KB

MD5
02557c141c9e153c2b7987b79a3a2dd7

SHA1
a054761382ee68608b6a3b62b68138dc205f576b

SHA256
207c587e769e2655669bd3ce1d28a00bcac08f023013735f026f65c0e3baa6f4

SHA512
a37e29c115bcb9956b1f8fd2022f2e3966c1fa2a0efa5c2ee2d14bc5c41bfddae0deea4d481a681d13ec58e9dec41e7565f8b4eb1c10f2c44c03e58bdd2792b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_idpjjg5a.3x4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ldx999sx.exe

Filesize
205KB

MD5
9d8a3dd432e255ebb2e890d2a0653ddb

SHA1
0e5741c323e7c35671333863492743ae0c64f64b

SHA256
6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27

SHA512
758efb868176e8179256920f3663a77f8cb47ddfe3ad99a59038392cae0f5daea5fbbb3da85cf65559f6b4c6834db647b43b9544494d1085c49070da62e7da96

Download Submit
C:\Users\Admin\AppData\Local\Temp\ldx999sx.exe

Filesize
205KB

MD5
9d8a3dd432e255ebb2e890d2a0653ddb

SHA1
0e5741c323e7c35671333863492743ae0c64f64b

SHA256
6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27

SHA512
758efb868176e8179256920f3663a77f8cb47ddfe3ad99a59038392cae0f5daea5fbbb3da85cf65559f6b4c6834db647b43b9544494d1085c49070da62e7da96

Download Submit
C:\Users\Admin\AppData\Local\Temp\ldx999sx.exe

Filesize
205KB

MD5
9d8a3dd432e255ebb2e890d2a0653ddb

SHA1
0e5741c323e7c35671333863492743ae0c64f64b

SHA256
6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27

SHA512
758efb868176e8179256920f3663a77f8cb47ddfe3ad99a59038392cae0f5daea5fbbb3da85cf65559f6b4c6834db647b43b9544494d1085c49070da62e7da96

Download Submit
C:\Users\Admin\AppData\Local\Temp\ldx999sx.exe

Filesize
205KB

MD5
9d8a3dd432e255ebb2e890d2a0653ddb

SHA1
0e5741c323e7c35671333863492743ae0c64f64b

SHA256
6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27

SHA512
758efb868176e8179256920f3663a77f8cb47ddfe3ad99a59038392cae0f5daea5fbbb3da85cf65559f6b4c6834db647b43b9544494d1085c49070da62e7da96

Download Submit
C:\Users\Admin\AppData\Local\Temp\s777mx.exe

Filesize
220KB

MD5
8d7ebe871589d79f195f240dcef43a57

SHA1
f5315edc9bfeb6f37c9df6ad1f10cb3363412d96

SHA256
19397c6dce459330095edc72759d1e79e26f1e12f013cdaee6dbdb90d65aaae8

SHA512
244be66bb480d320ef6d5cbfcd21e526a53726397c1fc4b512935bc50039b0bb773e3f12fd53910d3da9e69ebb8e3fd1a56d22d2fcb2e090c93c9759cdc497cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\s777mx.exe

Filesize
220KB

MD5
8d7ebe871589d79f195f240dcef43a57

SHA1
f5315edc9bfeb6f37c9df6ad1f10cb3363412d96

SHA256
19397c6dce459330095edc72759d1e79e26f1e12f013cdaee6dbdb90d65aaae8

SHA512
244be66bb480d320ef6d5cbfcd21e526a53726397c1fc4b512935bc50039b0bb773e3f12fd53910d3da9e69ebb8e3fd1a56d22d2fcb2e090c93c9759cdc497cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\s777mx.exe

Filesize
220KB

MD5
8d7ebe871589d79f195f240dcef43a57

SHA1
f5315edc9bfeb6f37c9df6ad1f10cb3363412d96

SHA256
19397c6dce459330095edc72759d1e79e26f1e12f013cdaee6dbdb90d65aaae8

SHA512
244be66bb480d320ef6d5cbfcd21e526a53726397c1fc4b512935bc50039b0bb773e3f12fd53910d3da9e69ebb8e3fd1a56d22d2fcb2e090c93c9759cdc497cd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg

Filesize
14KB

MD5
2257fa8cef64a74c33655bd5f74ef5e5

SHA1
b9f8baf96166f99cb1983563e632e6e69984ad5c

SHA256
ead48b70e048de6ccca219a229ca90b49a9d1b9c14bf3a7c5eaad544294fcfd3

SHA512
7792be9b935a46a923e97bb76b76957070e116dcc4cb6fcd8b883c2d6f142285ebc9fd26cdf29bd19c8bdff412487f586abaa1724332b613e71afa45d7f3e4f9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg.id[56C78627-3483].[[email protected]].8base

Filesize
52KB

MD5
23e95b2d7cb3d4bd73c69c213741ccea

SHA1
21b889f6956b95b5ba7f6bdea155b550a78d19b3

SHA256
410c23963fa6bb9cb3838f7de85742f2c947e148649454c4707bb5d833e529bc

SHA512
ebb263f021fdc3df7d7a988a0c3a61f110543fd11bdc99a5f772e70db7ba2418a18c718dc57bb7ab08a5f4fb39e0104b71f18c11233e12ead82d002d574abf9a

Download Submit
C:\Users\Admin\AppData\Roaming\erwegwd

Filesize
438KB

MD5
8ae1cc677e2d090310297d8850acfecc

SHA1
70eefbd35714f855c54ba8fb60192abc8d329081

SHA256
7325d6496196de05d8acc9862d43d32e412c28c85a5d3868d0fd935f64da8790

SHA512
b157e196fd9fe3ce2d1f8b7b8c3a0341be83e091166b83834b110a78999c862a06590846dd39a426660329e4cb079d76a33b905866b5a8bc1cda10bbf671a209

Download Submit
C:\Users\Admin\AppData\Roaming\fcfgthi

Filesize
205KB

MD5
9d8a3dd432e255ebb2e890d2a0653ddb

SHA1
0e5741c323e7c35671333863492743ae0c64f64b

SHA256
6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27

SHA512
758efb868176e8179256920f3663a77f8cb47ddfe3ad99a59038392cae0f5daea5fbbb3da85cf65559f6b4c6834db647b43b9544494d1085c49070da62e7da96

Download Submit
C:\Users\Admin\Desktop\info.hta

Filesize
5KB

MD5
38b7d293145a86018f6f2b40077ddd28

SHA1
0d948706a00a7863368dfcfaadfd90de9ac41f61

SHA256
c35f671ad7c2be8c64097ba44f2e5b5d8bbf1d00064a1612fd113c1f50944d9d

SHA512
72e47c2603b6ae954aff9ea18b53b183a7f50a03cfd2769de0c2e48374f6a40f3cad6df532a18d7506026b038998e04c8ac0f00ca8fbac473ccf9b8561d31e04

Download Submit
C:\info.hta

Filesize
5KB

MD5
38b7d293145a86018f6f2b40077ddd28

SHA1
0d948706a00a7863368dfcfaadfd90de9ac41f61

SHA256
c35f671ad7c2be8c64097ba44f2e5b5d8bbf1d00064a1612fd113c1f50944d9d

SHA512
72e47c2603b6ae954aff9ea18b53b183a7f50a03cfd2769de0c2e48374f6a40f3cad6df532a18d7506026b038998e04c8ac0f00ca8fbac473ccf9b8561d31e04

Download Submit
C:\info.hta

Filesize
5KB

MD5
38b7d293145a86018f6f2b40077ddd28

SHA1
0d948706a00a7863368dfcfaadfd90de9ac41f61

SHA256
c35f671ad7c2be8c64097ba44f2e5b5d8bbf1d00064a1612fd113c1f50944d9d

SHA512
72e47c2603b6ae954aff9ea18b53b183a7f50a03cfd2769de0c2e48374f6a40f3cad6df532a18d7506026b038998e04c8ac0f00ca8fbac473ccf9b8561d31e04

Download Submit
C:\users\public\desktop\info.hta

Filesize
5KB

MD5
38b7d293145a86018f6f2b40077ddd28

SHA1
0d948706a00a7863368dfcfaadfd90de9ac41f61

SHA256
c35f671ad7c2be8c64097ba44f2e5b5d8bbf1d00064a1612fd113c1f50944d9d

SHA512
72e47c2603b6ae954aff9ea18b53b183a7f50a03cfd2769de0c2e48374f6a40f3cad6df532a18d7506026b038998e04c8ac0f00ca8fbac473ccf9b8561d31e04

Download Submit
F:\info.hta

Filesize
5KB

MD5
38b7d293145a86018f6f2b40077ddd28

SHA1
0d948706a00a7863368dfcfaadfd90de9ac41f61

SHA256
c35f671ad7c2be8c64097ba44f2e5b5d8bbf1d00064a1612fd113c1f50944d9d

SHA512
72e47c2603b6ae954aff9ea18b53b183a7f50a03cfd2769de0c2e48374f6a40f3cad6df532a18d7506026b038998e04c8ac0f00ca8fbac473ccf9b8561d31e04

Download Submit
memory/64-260-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/380-267-0x00000000001E0000-0x00000000001E9000-memory.dmp

Filesize
36KB

Download
memory/380-2470-0x00000000001E0000-0x00000000001E9000-memory.dmp

Filesize
36KB

Download
memory/380-268-0x0000000000A80000-0x0000000000A8B000-memory.dmp

Filesize
44KB

Download
memory/380-266-0x0000000000A80000-0x0000000000A8B000-memory.dmp

Filesize
44KB

Download
memory/436-264-0x0000000000AC0000-0x0000000000ACB000-memory.dmp

Filesize
44KB

Download
memory/436-265-0x0000000000AC0000-0x0000000000ACB000-memory.dmp

Filesize
44KB

Download
memory/536-1195-0x0000000001280000-0x0000000001289000-memory.dmp

Filesize
36KB

Download
memory/536-1125-0x0000000001280000-0x0000000001289000-memory.dmp

Filesize
36KB

Download
memory/620-1992-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/620-1944-0x0000000000940000-0x0000000000967000-memory.dmp

Filesize
156KB

Download
memory/620-1940-0x0000000000940000-0x0000000000967000-memory.dmp

Filesize
156KB

Download
memory/828-2278-0x0000000001B70000-0x0000000001B75000-memory.dmp

Filesize
20KB

Download
memory/828-262-0x0000000001B70000-0x0000000001B75000-memory.dmp

Filesize
20KB

Download
memory/828-261-0x00000000001E0000-0x00000000001E9000-memory.dmp

Filesize
36KB

Download
memory/828-263-0x00000000001E0000-0x00000000001E9000-memory.dmp

Filesize
36KB

Download
memory/948-10786-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/948-1820-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/948-8291-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/948-6223-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/948-235-0x0000000000710000-0x000000000071F000-memory.dmp

Filesize
60KB

Download
memory/948-2663-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/948-4718-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/948-12213-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/972-2096-0x0000000000940000-0x0000000000967000-memory.dmp

Filesize
156KB

Download
memory/972-2097-0x0000000000AC0000-0x0000000000AC9000-memory.dmp

Filesize
36KB

Download
memory/972-2029-0x0000000000AC0000-0x0000000000AC9000-memory.dmp

Filesize
36KB

Download
memory/1224-2339-0x00000000012A0000-0x00000000012AB000-memory.dmp

Filesize
44KB

Download
memory/1224-2425-0x00000000010A0000-0x00000000010AD000-memory.dmp

Filesize
52KB

Download
memory/1224-2427-0x00000000012A0000-0x00000000012AB000-memory.dmp

Filesize
44KB

Download
memory/1472-159-0x0000000007000000-0x000000000701A000-memory.dmp

Filesize
104KB

Download
memory/1472-155-0x0000000006210000-0x0000000006254000-memory.dmp

Filesize
272KB

Download
memory/1472-160-0x00000000024B0000-0x00000000024C0000-memory.dmp

Filesize
64KB

Download
memory/1472-169-0x00000000024B0000-0x00000000024C0000-memory.dmp

Filesize
64KB

Download
memory/1472-168-0x00000000024B0000-0x00000000024C0000-memory.dmp

Filesize
64KB

Download
memory/1472-158-0x0000000007660000-0x0000000007CDA000-memory.dmp

Filesize
6.5MB

Download
memory/1472-170-0x00000000024B0000-0x00000000024C0000-memory.dmp

Filesize
64KB

Download
memory/1472-171-0x00000000024B0000-0x00000000024C0000-memory.dmp

Filesize
64KB

Download
memory/1472-157-0x0000000006F60000-0x0000000006FD6000-memory.dmp

Filesize
472KB

Download
memory/1472-156-0x00000000024B0000-0x00000000024C0000-memory.dmp

Filesize
64KB

Download
memory/1472-161-0x0000000007D50000-0x0000000007D72000-memory.dmp

Filesize
136KB

Download
memory/1472-154-0x0000000005C50000-0x0000000005C6E000-memory.dmp

Filesize
120KB

Download
memory/1472-150-0x00000000024B0000-0x00000000024C0000-memory.dmp

Filesize
64KB

Download
memory/1472-149-0x00000000024B0000-0x00000000024C0000-memory.dmp

Filesize
64KB

Download
memory/1472-139-0x0000000002340000-0x0000000002376000-memory.dmp

Filesize
216KB

Download
memory/1472-140-0x0000000004E90000-0x00000000054B8000-memory.dmp

Filesize
6.2MB

Download
memory/1472-141-0x0000000004D70000-0x0000000004DD6000-memory.dmp

Filesize
408KB

Download
memory/1472-142-0x0000000004DE0000-0x0000000004E46000-memory.dmp

Filesize
408KB

Download
memory/1564-2125-0x00000000009A0000-0x00000000009AB000-memory.dmp

Filesize
44KB

Download
memory/1564-2098-0x00000000009A0000-0x00000000009AB000-memory.dmp

Filesize
44KB

Download
memory/1800-854-0x0000000000FE0000-0x0000000000FEC000-memory.dmp

Filesize
48KB

Download
memory/1800-842-0x0000000000FE0000-0x0000000000FEC000-memory.dmp

Filesize
48KB

Download
memory/1980-2284-0x00000000010A0000-0x00000000010AD000-memory.dmp

Filesize
52KB

Download
memory/1980-2282-0x00000000009A0000-0x00000000009AB000-memory.dmp

Filesize
44KB

Download
memory/1980-2161-0x00000000010A0000-0x00000000010AD000-memory.dmp

Filesize
52KB

Download
memory/2384-137-0x0000000005460000-0x0000000005470000-memory.dmp

Filesize
64KB

Download
memory/2384-138-0x0000000005400000-0x000000000540A000-memory.dmp

Filesize
40KB

Download
memory/2384-133-0x0000000000800000-0x0000000000858000-memory.dmp

Filesize
352KB

Download
memory/2384-136-0x00000000051C0000-0x00000000051E2000-memory.dmp

Filesize
136KB

Download
memory/2384-135-0x0000000005210000-0x00000000052A2000-memory.dmp

Filesize
584KB

Download
memory/2384-167-0x0000000005460000-0x0000000005470000-memory.dmp

Filesize
64KB

Download
memory/2384-134-0x00000000057C0000-0x0000000005D64000-memory.dmp

Filesize
5.6MB

Download
memory/2508-164-0x00000000182F0000-0x00000000183FA000-memory.dmp

Filesize
1.0MB

Download
memory/2508-173-0x000000001AA90000-0x000000001AFBC000-memory.dmp

Filesize
5.2MB

Download
memory/2508-163-0x0000000018800000-0x0000000018E18000-memory.dmp

Filesize
6.1MB

Download
memory/2508-162-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2508-165-0x0000000017AC0000-0x0000000017AD2000-memory.dmp

Filesize
72KB

Download
memory/2508-166-0x0000000018220000-0x000000001825C000-memory.dmp

Filesize
240KB

Download
memory/2508-172-0x0000000019560000-0x0000000019722000-memory.dmp

Filesize
1.8MB

Download
memory/2508-175-0x0000000019830000-0x0000000019880000-memory.dmp

Filesize
320KB

Download
memory/2568-209-0x0000000003570000-0x0000000003586000-memory.dmp

Filesize
88KB

Download
memory/2964-214-0x0000000000400000-0x0000000001B38000-memory.dmp

Filesize
23.2MB

Download
memory/2964-206-0x0000000001B70000-0x0000000001B75000-memory.dmp

Filesize
20KB

Download
memory/3356-204-0x0000000001C80000-0x0000000001C89000-memory.dmp

Filesize
36KB

Download
memory/3864-233-0x0000000001280000-0x00000000012EB000-memory.dmp

Filesize
428KB

Download
memory/3864-237-0x00000000012F0000-0x0000000001370000-memory.dmp

Filesize
512KB

Download
memory/3864-238-0x0000000001280000-0x00000000012EB000-memory.dmp

Filesize
428KB

Download
memory/3864-259-0x0000000001280000-0x00000000012EB000-memory.dmp

Filesize
428KB

Download
memory/4244-1955-0x0000000000400000-0x0000000001B38000-memory.dmp

Filesize
23.2MB

Download
memory/4244-11404-0x0000000000400000-0x0000000001B38000-memory.dmp

Filesize
23.2MB

Download
memory/4624-257-0x0000000000FA0000-0x0000000000FAC000-memory.dmp

Filesize
48KB

Download
memory/4624-258-0x0000000000FA0000-0x0000000000FAC000-memory.dmp

Filesize
48KB

Download
memory/4632-314-0x0000000000BE0000-0x0000000000BEF000-memory.dmp

Filesize
60KB

Download
memory/4632-473-0x0000000000A80000-0x0000000000A8B000-memory.dmp

Filesize
44KB

Download
memory/4632-475-0x0000000000BE0000-0x0000000000BEF000-memory.dmp

Filesize
60KB

Download
memory/4632-2472-0x0000000000A80000-0x0000000000A8B000-memory.dmp

Filesize
44KB

Download
memory/4856-207-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4856-202-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4856-210-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4928-1696-0x00000000003C0000-0x00000000003C9000-memory.dmp

Filesize
36KB

Download
memory/4928-1864-0x0000000001280000-0x0000000001289000-memory.dmp

Filesize
36KB

Download
memory/4928-1872-0x00000000003C0000-0x00000000003C9000-memory.dmp

Filesize
36KB

Download
memory/5052-844-0x0000000000A50000-0x0000000000A59000-memory.dmp

Filesize
36KB

Download
memory/5052-821-0x0000000000BE0000-0x0000000000BEF000-memory.dmp

Filesize
60KB

Download
memory/5052-512-0x0000000000A50000-0x0000000000A59000-memory.dmp

Filesize
36KB

Download