ammyyadmin | ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16-09-2023 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6f506f57365deb1b24b84eafbd9271f.exe
Size

468KB
MD5

e6f506f57365deb1b24b84eafbd9271f
SHA1

d120720527f6d02f2c6e058bc95cc18d8c23f269
SHA256

ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6
SHA512

3273f5720d13ae0c77eb9e35ef52368f187b4acfe1e40471629c6e51e0f7c442f420bd0cbbe1f5e21918760fdd260cb86b7086eb93d92e28d00b502cd3e066e9
SSDEEP

12288:zPmdD7nWjmGR5iErreKOOkLsxhDzfrroATRwJJ:7mN7u5iEKOKalroATRwX

Score

10^/10

ammyyadmin flawedammyy phobos rhadamanthys smokeloader backdoor bootkit collection evasion persistence ransomware rat spyware stealer trojan

Malware Config

Extracted

Path

C:\info.hta

Ransom Note

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'> <html> <head> <meta charset='windows-1251'> <title>cartilage</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language='JScript'> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type='text/css'> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background: #C6B5C4; } img { display:inline-block; } .bold { font-weight: bold; } .mark { background: #B5CC8E; padding: 2px 5px; } .header { text-align: center; font-size: 30px; line-height: 50px; font-weight: bold; margin-bottom:20px; } .info { background: #e6ecf2; border-left: 10px solid #B58CB2; } .alert { background: #FFE4E4; border-left: 10px solid #FFA07A; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } .footer { position:fixed; bottom:0; right:0; text-align: right; } </style> </head> <body> <div class='header'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='> <div>All your files have been encrypted!</div> </div> <div class='bold'>All your files have been encrypted due to a security problem with your PC.</div> <div class='bold'>If you want to restore them, write us to the e-mail <span class='mark'>[email protected]</span></div> <div class='bold'>Or write us to the Tox: <span class='mark'>78E21CFF7AA85F713C1530AEF2E74E62830BEE77238F4B0A73E5E3251EAD56427BF9F7A1A074</span></div> <div class='bold'>Write this ID in the title of your message <span class='mark'>DA3F870A-3483</span></div> <div> You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. </div> <div class='note info'> <div class='title'>Free decryption as guarantee</div> <ul>Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul> </div> <div class='note info'> <div class='title'>How to obtain Bitcoins</div> <ul> The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. <br><a href='https://localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a> <br> Also you can find other places to buy Bitcoins and beginners guide here: <br><a href='http://www.coindesk.com/information/how-can-i-buy-bitcoins/'>http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a> </ul> </div> <div class='note alert'> <div class='title'>Attention!</div> <ul> <li>Do not rename encrypted files.</li> <li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li> <li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li> </ul> </div> </body> </html>

Emails

class='mark'>[email protected]</span></div>

URLs

http://www.w3.org/TR/html4/strict.dtd'>

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 5 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\782C.tmp\svchost.exe	family_ammyyadmin
C:\Users\Admin\AppData\Local\Temp\782C.tmp\svchost.exe	family_ammyyadmin
\Users\Admin\AppData\Local\Temp\782C.tmp\svchost.exe	family_ammyyadmin
\Users\Admin\AppData\Local\Temp\782C.tmp\svchost.exe	family_ammyyadmin
C:\Users\Admin\AppData\Local\Temp\782C.tmp\svchost.exe	family_ammyyadmin

Detect rhadamanthys stealer shellcode 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/620-22-0x0000000001EE0000-0x00000000022E0000-memory.dmp	family_rhadamanthys
behavioral1/memory/620-23-0x0000000001EE0000-0x00000000022E0000-memory.dmp	family_rhadamanthys
behavioral1/memory/620-24-0x0000000001EE0000-0x00000000022E0000-memory.dmp	family_rhadamanthys
behavioral1/memory/620-25-0x0000000001EE0000-0x00000000022E0000-memory.dmp	family_rhadamanthys
behavioral1/memory/620-36-0x0000000001EE0000-0x00000000022E0000-memory.dmp	family_rhadamanthys
behavioral1/memory/620-38-0x0000000001EE0000-0x00000000022E0000-memory.dmp	family_rhadamanthys

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy
Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

e6f506f57365deb1b24b84eafbd9271f.exe

description pid process target process

PID 620 created 1212 620 e6f506f57365deb1b24b84eafbd9271f.exe Explorer.EXE
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exebcdedit.exe

pid process

2240 bcdedit.exe
1984 bcdedit.exe
3044 bcdedit.exe
2128 bcdedit.exe
Renames multiple (319) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

30 1000 rundll32.exe
Deletes backup catalog 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exewbadmin.exe

pid process

768 wbadmin.exe
2868 wbadmin.exe
Downloads MZ/PE file
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exe

pid process

2088 netsh.exe
1796 netsh.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

svchost.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Control Panel\International\Geo\Nation svchost.exe
Deletes itself 1 IoCs

Processes:

certreq.exe

pid process

3016 certreq.exe

description	pid	process	target process
PID 620 created 1212	620	e6f506f57365deb1b24b84eafbd9271f.exe	Explorer.EXE

pid	process
2240	bcdedit.exe
1984	bcdedit.exe
3044	bcdedit.exe
2128	bcdedit.exe

flow	pid	process
30	1000	rundll32.exe

pid	process
768	wbadmin.exe
2868	wbadmin.exe

pid	process
2088	netsh.exe
1796	netsh.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Control Panel\International\Geo\Nation	svchost.exe

pid	process
3016	certreq.exe

Drops startup file 3 IoCs

Processes:

72hP3UdbB.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\72hP3UdbB.exe	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	72hP3UdbB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe

Executes dropped EXE 12 IoCs

Processes:

72hP3UdbB.exe8A4[G35.exe72hP3UdbB.exe8A4[G35.exefL(.exe72hP3UdbB.exe72hP3UdbB.exe3543.exe38AE.exe3543.exesvchost.exe38AE.exe

pid	process
900	72hP3UdbB.exe
2716	8A4[G35.exe
2960	72hP3UdbB.exe
2800	8A4[G35.exe
576	fL(.exe
268	72hP3UdbB.exe
2900	72hP3UdbB.exe
1300	3543.exe
1692	38AE.exe
312	3543.exe
1072	svchost.exe
1308	38AE.exe

Loads dropped DLL 9 IoCs

Processes:

3543.exe38AE.exeexplorer.exerundll32.exe

pid process

2832
1300 3543.exe
1692 38AE.exe
1700 explorer.exe
1700 explorer.exe
1000 rundll32.exe
1000 rundll32.exe
1000 rundll32.exe
1000 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2832
1300	3543.exe
1692	38AE.exe
1700	explorer.exe
1700	explorer.exe
1000	rundll32.exe
1000	rundll32.exe
1000	rundll32.exe
1000	rundll32.exe

Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs

collection

Email Collection

T1114

Processes:

explorer.execertreq.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook	certreq.exe
Key opened	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	certreq.exe
Key opened	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	certreq.exe
Key opened	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook	certreq.exe
Key opened	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook	certreq.exe
Key opened	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	certreq.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

72hP3UdbB.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\72hP3UdbB = "C:\\Users\\Admin\\AppData\\Local\\72hP3UdbB.exe"	72hP3UdbB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\72hP3UdbB = "C:\\Users\\Admin\\AppData\\Local\\72hP3UdbB.exe"	72hP3UdbB.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

72hP3UdbB.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Program Files\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	72hP3UdbB.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FUN41565\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	72hP3UdbB.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-686452656-3203474025-4140627569-1000\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	72hP3UdbB.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\7HDNK2PI\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\BJFN2KPS\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\SWQN37B6\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HTIQ6ZY2\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	72hP3UdbB.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-686452656-3203474025-4140627569-1000\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	72hP3UdbB.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Public\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0LEZ0RLT\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	72hP3UdbB.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

svchost.exe

description ioc process

File opened for modification \??\PhysicalDrive0 svchost.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	svchost.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

e6f506f57365deb1b24b84eafbd9271f.exe72hP3UdbB.exe8A4[G35.exe72hP3UdbB.exe3543.exe38AE.exe

description	pid	process	target process
PID 1032 set thread context of 620	1032	e6f506f57365deb1b24b84eafbd9271f.exe	e6f506f57365deb1b24b84eafbd9271f.exe
PID 900 set thread context of 2960	900	72hP3UdbB.exe	72hP3UdbB.exe
PID 2716 set thread context of 2800	2716	8A4[G35.exe	8A4[G35.exe
PID 268 set thread context of 2900	268	72hP3UdbB.exe	72hP3UdbB.exe
PID 1300 set thread context of 312	1300	3543.exe	3543.exe
PID 1692 set thread context of 1308	1692	38AE.exe	38AE.exe

Drops file in Program Files directory 64 IoCs

Processes:

72hP3UdbB.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\ku.txt.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yakutsk	72hP3UdbB.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\librtpvideo_plugin.dll	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierUpArrow.jpg	72hP3UdbB.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\TAB_OFF.GIF.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup.xml.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF	72hP3UdbB.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18219_.WMF.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14831_.GIF	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\CASHREG.WAV	72hP3UdbB.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\sandbox.luac.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File opened for modification	C:\Program Files\Windows Journal\de-DE\jnwmon.dll.mui	72hP3UdbB.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_02.MID.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02285_.WMF	72hP3UdbB.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME09.CSS.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\MENUS.JS.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\UserControl.zip.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.zh_CN_5.5.0.165303.jar	72hP3UdbB.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Speech.resources.dll	72hP3UdbB.exe
File opened for modification	C:\Program Files\Windows Sidebar\ja-JP\sbdrop.dll.mui	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Paper.eftx	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR37F.GIF	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\IPDESIGN.DLL.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_right.png	72hP3UdbB.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe	72hP3UdbB.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_ja.jar.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-11	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107528.WMF.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BRCHUR11.POC	72hP3UdbB.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105244.WMF.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382926.JPG	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\BUTTON.GIF	72hP3UdbB.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoCanary.png.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Budapest	72hP3UdbB.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libaribcam_plugin.dll	72hP3UdbB.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00234_.WMF.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0177806.JPG	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287643.JPG	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSOUC_K_COL.HXK	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_foggy.png	72hP3UdbB.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Dawson.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\logo.png	72hP3UdbB.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_rest.png	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200611.WMF	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21548_.GIF	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Visualizer.zip	72hP3UdbB.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00090_.WMF.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153093.WMF	72hP3UdbB.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv	72hP3UdbB.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dili	72hP3UdbB.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.properties	72hP3UdbB.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-options.xml	72hP3UdbB.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo	72hP3UdbB.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\library.js	72hP3UdbB.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Sts2.css.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif	72hP3UdbB.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185780.WMF.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0213243.WMF.id[DA3F870A-3483].[[email protected]].8base	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Perspective.eftx	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.XLS	72hP3UdbB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR25F.GIF	72hP3UdbB.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

8A4[G35.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	8A4[G35.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	8A4[G35.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	8A4[G35.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

certreq.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	certreq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	certreq.exe

Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

2308 vssadmin.exe
2512 vssadmin.exe

pid	process
2308	vssadmin.exe
2512	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

mshta.exemshta.exemshta.exemshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e6f506f57365deb1b24b84eafbd9271f.exee6f506f57365deb1b24b84eafbd9271f.execertreq.exe8A4[G35.exeExplorer.EXE72hP3UdbB.exefL(.exe

pid	process
1032	e6f506f57365deb1b24b84eafbd9271f.exe
1032	e6f506f57365deb1b24b84eafbd9271f.exe
620	e6f506f57365deb1b24b84eafbd9271f.exe
620	e6f506f57365deb1b24b84eafbd9271f.exe
620	e6f506f57365deb1b24b84eafbd9271f.exe
620	e6f506f57365deb1b24b84eafbd9271f.exe
3016	certreq.exe
3016	certreq.exe
3016	certreq.exe
3016	certreq.exe
2800	8A4[G35.exe
2800	8A4[G35.exe
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
2960	72hP3UdbB.exe
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
576	fL(.exe
1212	Explorer.EXE
2960	72hP3UdbB.exe
1212	Explorer.EXE
1212	Explorer.EXE
576	fL(.exe
576	fL(.exe
576	fL(.exe
576	fL(.exe
576	fL(.exe
576	fL(.exe
1212	Explorer.EXE
1212	Explorer.EXE
2960	72hP3UdbB.exe
1212	Explorer.EXE
576	fL(.exe
576	fL(.exe
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
2960	72hP3UdbB.exe
1212	Explorer.EXE
576	fL(.exe
576	fL(.exe
576	fL(.exe
576	fL(.exe
576	fL(.exe
576	fL(.exe
576	fL(.exe
576	fL(.exe
576	fL(.exe
576	fL(.exe
576	fL(.exe
576	fL(.exe
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
2960	72hP3UdbB.exe
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1212 Explorer.EXE

Suspicious behavior: MapViewOfSection 33 IoCs

Processes:

8A4[G35.exeExplorer.EXEexplorer.exe

pid	process
2800	8A4[G35.exe
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1700	explorer.exe
1700	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e6f506f57365deb1b24b84eafbd9271f.exe72hP3UdbB.exe8A4[G35.exe72hP3UdbB.exefL(.exe72hP3UdbB.exevssvc.exeWMIC.exewbengine.exe3543.exe38AE.exeExplorer.EXEWMIC.exe

description	pid	process
Token: SeDebugPrivilege	1032	e6f506f57365deb1b24b84eafbd9271f.exe
Token: SeDebugPrivilege	900	72hP3UdbB.exe
Token: SeDebugPrivilege	2716	8A4[G35.exe
Token: SeDebugPrivilege	268	72hP3UdbB.exe
Token: SeDebugPrivilege	576	fL(.exe
Token: SeDebugPrivilege	2960	72hP3UdbB.exe
Token: SeBackupPrivilege	1932	vssvc.exe
Token: SeRestorePrivilege	1932	vssvc.exe
Token: SeAuditPrivilege	1932	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1596	WMIC.exe
Token: SeSecurityPrivilege	1596	WMIC.exe
Token: SeTakeOwnershipPrivilege	1596	WMIC.exe
Token: SeLoadDriverPrivilege	1596	WMIC.exe
Token: SeSystemProfilePrivilege	1596	WMIC.exe
Token: SeSystemtimePrivilege	1596	WMIC.exe
Token: SeProfSingleProcessPrivilege	1596	WMIC.exe
Token: SeIncBasePriorityPrivilege	1596	WMIC.exe
Token: SeCreatePagefilePrivilege	1596	WMIC.exe
Token: SeBackupPrivilege	1596	WMIC.exe
Token: SeRestorePrivilege	1596	WMIC.exe
Token: SeShutdownPrivilege	1596	WMIC.exe
Token: SeDebugPrivilege	1596	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1596	WMIC.exe
Token: SeRemoteShutdownPrivilege	1596	WMIC.exe
Token: SeUndockPrivilege	1596	WMIC.exe
Token: SeManageVolumePrivilege	1596	WMIC.exe
Token: 33	1596	WMIC.exe
Token: 34	1596	WMIC.exe
Token: 35	1596	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1596	WMIC.exe
Token: SeSecurityPrivilege	1596	WMIC.exe
Token: SeTakeOwnershipPrivilege	1596	WMIC.exe
Token: SeLoadDriverPrivilege	1596	WMIC.exe
Token: SeSystemProfilePrivilege	1596	WMIC.exe
Token: SeSystemtimePrivilege	1596	WMIC.exe
Token: SeProfSingleProcessPrivilege	1596	WMIC.exe
Token: SeIncBasePriorityPrivilege	1596	WMIC.exe
Token: SeCreatePagefilePrivilege	1596	WMIC.exe
Token: SeBackupPrivilege	1596	WMIC.exe
Token: SeRestorePrivilege	1596	WMIC.exe
Token: SeShutdownPrivilege	1596	WMIC.exe
Token: SeDebugPrivilege	1596	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1596	WMIC.exe
Token: SeRemoteShutdownPrivilege	1596	WMIC.exe
Token: SeUndockPrivilege	1596	WMIC.exe
Token: SeManageVolumePrivilege	1596	WMIC.exe
Token: 33	1596	WMIC.exe
Token: 34	1596	WMIC.exe
Token: 35	1596	WMIC.exe
Token: SeBackupPrivilege	2352	wbengine.exe
Token: SeRestorePrivilege	2352	wbengine.exe
Token: SeSecurityPrivilege	2352	wbengine.exe
Token: SeDebugPrivilege	1300	3543.exe
Token: SeDebugPrivilege	1692	38AE.exe
Token: SeShutdownPrivilege	1212	Explorer.EXE
Token: SeShutdownPrivilege	1212	Explorer.EXE
Token: SeShutdownPrivilege	1212	Explorer.EXE
Token: SeShutdownPrivilege	1212	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	700	WMIC.exe
Token: SeSecurityPrivilege	700	WMIC.exe
Token: SeTakeOwnershipPrivilege	700	WMIC.exe
Token: SeLoadDriverPrivilege	700	WMIC.exe
Token: SeSystemProfilePrivilege	700	WMIC.exe
Token: SeSystemtimePrivilege	700	WMIC.exe

Suspicious use of FindShellTrayWindow 10 IoCs

Processes:

svchost.exeExplorer.EXE

pid	process
1072	svchost.exe
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

Explorer.EXE

pid	process
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e6f506f57365deb1b24b84eafbd9271f.exee6f506f57365deb1b24b84eafbd9271f.exe72hP3UdbB.exe8A4[G35.exe72hP3UdbB.exe72hP3UdbB.execmd.execmd.exe

description	pid	process	target process
PID 1032 wrote to memory of 1452	1032	e6f506f57365deb1b24b84eafbd9271f.exe	e6f506f57365deb1b24b84eafbd9271f.exe
PID 1032 wrote to memory of 1452	1032	e6f506f57365deb1b24b84eafbd9271f.exe	e6f506f57365deb1b24b84eafbd9271f.exe
PID 1032 wrote to memory of 1452	1032	e6f506f57365deb1b24b84eafbd9271f.exe	e6f506f57365deb1b24b84eafbd9271f.exe
PID 1032 wrote to memory of 1452	1032	e6f506f57365deb1b24b84eafbd9271f.exe	e6f506f57365deb1b24b84eafbd9271f.exe
PID 1032 wrote to memory of 632	1032	e6f506f57365deb1b24b84eafbd9271f.exe	e6f506f57365deb1b24b84eafbd9271f.exe
PID 1032 wrote to memory of 632	1032	e6f506f57365deb1b24b84eafbd9271f.exe	e6f506f57365deb1b24b84eafbd9271f.exe
PID 1032 wrote to memory of 632	1032	e6f506f57365deb1b24b84eafbd9271f.exe	e6f506f57365deb1b24b84eafbd9271f.exe
PID 1032 wrote to memory of 632	1032	e6f506f57365deb1b24b84eafbd9271f.exe	e6f506f57365deb1b24b84eafbd9271f.exe
PID 1032 wrote to memory of 620	1032	e6f506f57365deb1b24b84eafbd9271f.exe	e6f506f57365deb1b24b84eafbd9271f.exe
PID 1032 wrote to memory of 620	1032	e6f506f57365deb1b24b84eafbd9271f.exe	e6f506f57365deb1b24b84eafbd9271f.exe
PID 1032 wrote to memory of 620	1032	e6f506f57365deb1b24b84eafbd9271f.exe	e6f506f57365deb1b24b84eafbd9271f.exe
PID 1032 wrote to memory of 620	1032	e6f506f57365deb1b24b84eafbd9271f.exe	e6f506f57365deb1b24b84eafbd9271f.exe
PID 1032 wrote to memory of 620	1032	e6f506f57365deb1b24b84eafbd9271f.exe	e6f506f57365deb1b24b84eafbd9271f.exe
PID 1032 wrote to memory of 620	1032	e6f506f57365deb1b24b84eafbd9271f.exe	e6f506f57365deb1b24b84eafbd9271f.exe
PID 1032 wrote to memory of 620	1032	e6f506f57365deb1b24b84eafbd9271f.exe	e6f506f57365deb1b24b84eafbd9271f.exe
PID 1032 wrote to memory of 620	1032	e6f506f57365deb1b24b84eafbd9271f.exe	e6f506f57365deb1b24b84eafbd9271f.exe
PID 1032 wrote to memory of 620	1032	e6f506f57365deb1b24b84eafbd9271f.exe	e6f506f57365deb1b24b84eafbd9271f.exe
PID 620 wrote to memory of 3016	620	e6f506f57365deb1b24b84eafbd9271f.exe	certreq.exe
PID 620 wrote to memory of 3016	620	e6f506f57365deb1b24b84eafbd9271f.exe	certreq.exe
PID 620 wrote to memory of 3016	620	e6f506f57365deb1b24b84eafbd9271f.exe	certreq.exe
PID 620 wrote to memory of 3016	620	e6f506f57365deb1b24b84eafbd9271f.exe	certreq.exe
PID 620 wrote to memory of 3016	620	e6f506f57365deb1b24b84eafbd9271f.exe	certreq.exe
PID 620 wrote to memory of 3016	620	e6f506f57365deb1b24b84eafbd9271f.exe	certreq.exe
PID 900 wrote to memory of 2960	900	72hP3UdbB.exe	72hP3UdbB.exe
PID 900 wrote to memory of 2960	900	72hP3UdbB.exe	72hP3UdbB.exe
PID 900 wrote to memory of 2960	900	72hP3UdbB.exe	72hP3UdbB.exe
PID 900 wrote to memory of 2960	900	72hP3UdbB.exe	72hP3UdbB.exe
PID 900 wrote to memory of 2960	900	72hP3UdbB.exe	72hP3UdbB.exe
PID 900 wrote to memory of 2960	900	72hP3UdbB.exe	72hP3UdbB.exe
PID 900 wrote to memory of 2960	900	72hP3UdbB.exe	72hP3UdbB.exe
PID 900 wrote to memory of 2960	900	72hP3UdbB.exe	72hP3UdbB.exe
PID 900 wrote to memory of 2960	900	72hP3UdbB.exe	72hP3UdbB.exe
PID 900 wrote to memory of 2960	900	72hP3UdbB.exe	72hP3UdbB.exe
PID 2716 wrote to memory of 2800	2716	8A4[G35.exe	8A4[G35.exe
PID 2716 wrote to memory of 2800	2716	8A4[G35.exe	8A4[G35.exe
PID 2716 wrote to memory of 2800	2716	8A4[G35.exe	8A4[G35.exe
PID 2716 wrote to memory of 2800	2716	8A4[G35.exe	8A4[G35.exe
PID 2716 wrote to memory of 2800	2716	8A4[G35.exe	8A4[G35.exe
PID 900 wrote to memory of 2960	900	72hP3UdbB.exe	72hP3UdbB.exe
PID 2716 wrote to memory of 2800	2716	8A4[G35.exe	8A4[G35.exe
PID 2716 wrote to memory of 2800	2716	8A4[G35.exe	8A4[G35.exe
PID 268 wrote to memory of 2900	268	72hP3UdbB.exe	72hP3UdbB.exe
PID 268 wrote to memory of 2900	268	72hP3UdbB.exe	72hP3UdbB.exe
PID 268 wrote to memory of 2900	268	72hP3UdbB.exe	72hP3UdbB.exe
PID 268 wrote to memory of 2900	268	72hP3UdbB.exe	72hP3UdbB.exe
PID 268 wrote to memory of 2900	268	72hP3UdbB.exe	72hP3UdbB.exe
PID 268 wrote to memory of 2900	268	72hP3UdbB.exe	72hP3UdbB.exe
PID 268 wrote to memory of 2900	268	72hP3UdbB.exe	72hP3UdbB.exe
PID 268 wrote to memory of 2900	268	72hP3UdbB.exe	72hP3UdbB.exe
PID 268 wrote to memory of 2900	268	72hP3UdbB.exe	72hP3UdbB.exe
PID 268 wrote to memory of 2900	268	72hP3UdbB.exe	72hP3UdbB.exe
PID 268 wrote to memory of 2900	268	72hP3UdbB.exe	72hP3UdbB.exe
PID 2960 wrote to memory of 1248	2960	72hP3UdbB.exe	cmd.exe
PID 2960 wrote to memory of 1248	2960	72hP3UdbB.exe	cmd.exe
PID 2960 wrote to memory of 1248	2960	72hP3UdbB.exe	cmd.exe
PID 2960 wrote to memory of 1248	2960	72hP3UdbB.exe	cmd.exe
PID 2960 wrote to memory of 1868	2960	72hP3UdbB.exe	cmd.exe
PID 2960 wrote to memory of 1868	2960	72hP3UdbB.exe	cmd.exe
PID 2960 wrote to memory of 1868	2960	72hP3UdbB.exe	cmd.exe
PID 2960 wrote to memory of 1868	2960	72hP3UdbB.exe	cmd.exe
PID 1248 wrote to memory of 2088	1248	cmd.exe	netsh.exe
PID 1248 wrote to memory of 2088	1248	cmd.exe	netsh.exe
PID 1248 wrote to memory of 2088	1248	cmd.exe	netsh.exe
PID 1868 wrote to memory of 2308	1868	cmd.exe	vssadmin.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1212

C:\Users\Admin\AppData\Local\Temp\e6f506f57365deb1b24b84eafbd9271f.exe
"C:\Users\Admin\AppData\Local\Temp\e6f506f57365deb1b24b84eafbd9271f.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1032

C:\Users\Admin\AppData\Local\Temp\e6f506f57365deb1b24b84eafbd9271f.exe
C:\Users\Admin\AppData\Local\Temp\e6f506f57365deb1b24b84eafbd9271f.exe
3⤵
PID:1452

C:\Users\Admin\AppData\Local\Temp\e6f506f57365deb1b24b84eafbd9271f.exe
C:\Users\Admin\AppData\Local\Temp\e6f506f57365deb1b24b84eafbd9271f.exe
3⤵
PID:632

C:\Users\Admin\AppData\Local\Temp\e6f506f57365deb1b24b84eafbd9271f.exe
C:\Users\Admin\AppData\Local\Temp\e6f506f57365deb1b24b84eafbd9271f.exe
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:620

C:\Windows\system32\certreq.exe
"C:\Windows\system32\certreq.exe"
2⤵
- Deletes itself
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3016

C:\Users\Admin\AppData\Local\Temp\3543.exe
C:\Users\Admin\AppData\Local\Temp\3543.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1300

C:\Users\Admin\AppData\Local\Temp\3543.exe
C:\Users\Admin\AppData\Local\Temp\3543.exe
3⤵
- Executes dropped EXE
PID:312

C:\Users\Admin\AppData\Local\Temp\38AE.exe
C:\Users\Admin\AppData\Local\Temp\38AE.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1692

C:\Users\Admin\AppData\Local\Temp\38AE.exe
"C:\Users\Admin\AppData\Local\Temp\38AE.exe"
3⤵
- Executes dropped EXE
PID:1308

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:1072

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:2280

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:1496

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:1992

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:1832

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:1716

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:224

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:1296

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:2424

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:2240

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:2320

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:2688

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:2596

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:1992

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
PID:1700

C:\Users\Admin\AppData\Local\Temp\782C.tmp\svchost.exe
C:\Users\Admin\AppData\Local\Temp\782C.tmp\svchost.exe -debug
3⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
PID:1072

C:\Windows\SysWOW64\ctfmon.exe
ctfmon.exe
4⤵
PID:2312

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\782C.tmp\aa_nts.dll",run
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1000

C:\Users\Admin\AppData\Local\Microsoft\72hP3UdbB.exe
"C:\Users\Admin\AppData\Local\Microsoft\72hP3UdbB.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900

C:\Users\Admin\AppData\Local\Microsoft\72hP3UdbB.exe
C:\Users\Admin\AppData\Local\Microsoft\72hP3UdbB.exe
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960

C:\Users\Admin\AppData\Local\Microsoft\72hP3UdbB.exe
"C:\Users\Admin\AppData\Local\Microsoft\72hP3UdbB.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:268

C:\Users\Admin\AppData\Local\Microsoft\72hP3UdbB.exe
C:\Users\Admin\AppData\Local\Microsoft\72hP3UdbB.exe
4⤵
- Executes dropped EXE
PID:2900

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1248

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
4⤵
- Modifies Windows Firewall
PID:2088

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
4⤵
- Modifies Windows Firewall
PID:1796

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1868

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:2308

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:2240

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:1984

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
4⤵
- Deletes backup catalog
PID:768

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"
3⤵
- Modifies Internet Explorer settings
PID:596

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"
3⤵
- Modifies Internet Explorer settings
PID:156

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"
3⤵
- Modifies Internet Explorer settings
PID:2664

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"
3⤵
- Modifies Internet Explorer settings
PID:1380

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:2148

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:2512

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:700

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:3044

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:2128

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
4⤵
- Deletes backup catalog
PID:2868

C:\Users\Admin\AppData\Local\Microsoft\8A4[G35.exe
"C:\Users\Admin\AppData\Local\Microsoft\8A4[G35.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716

C:\Users\Admin\AppData\Local\Microsoft\8A4[G35.exe
C:\Users\Admin\AppData\Local\Microsoft\8A4[G35.exe
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2800

C:\Users\Admin\AppData\Local\Microsoft\fL(.exe
"C:\Users\Admin\AppData\Local\Microsoft\fL(.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:576

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
2⤵
PID:1344

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
2⤵
PID:1880

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
2⤵
PID:1884

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
2⤵
PID:2496

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
2⤵
PID:2172

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
2⤵
PID:1992

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
2⤵
PID:1280

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
2⤵
PID:2056

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
2⤵
PID:2160

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
2⤵
PID:2336

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1932

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2352

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:856

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[DA3F870A-3483].[[email protected]].8base

Filesize
143.1MB

MD5
932e821b5044a342e9a9a7ede044a74f

SHA1
42eb91b0b86d05818a10fd359d780c6b5ce9048e

SHA256
b11a0ca3cd21d5e1382cfab5a16f5500329aa6f91585a462ecadb69ef88044e8

SHA512
63837cbfb78e332d9f12dbaa62f4e7a809117d9c950c7bb21eda94c2ebac51bd0a016ca5c8b6456c2920585c081ba4df6a3ad53906c832fc6246b5e95454143a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
60fe01df86be2e5331b0cdbe86165686

SHA1
2a79f9713c3f192862ff80508062e64e8e0b29bd

SHA256
c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8

SHA512
ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5037AC1E573F140500110A0B67548B5E

Filesize
503B

MD5
2caa2e94af0029c7cc694b252754af1b

SHA1
13af78fda889180fa6241855562d6d014f83ab0e

SHA256
0ce6fbb51c0077d0c38d2c3b4d54a8ea7237676723b1112781f8378f229582f3

SHA512
3e3c3a48ddb94fa845a7acd22af1ea3e68025bc812880ddc86dcafcb6737b59a7d2c3bee54e6d91ab137891a0c37fd63a177ba1776001fdc4ee17301eac6f786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
86798cae495510b9f04541e1823e9bb9

SHA1
1716c0c3ab35537201f0d3cad3b77843ca2563e9

SHA256
1ade557e48ee311617c0e3e9d5aa84f6e5d675c8fea33035c94d1dae21b1c901

SHA512
2384d9a8c6f9c14f48e971288971c02504bfd4d179457b98a8adb08fa8826bef7f4020b6ef0bb9f5991e2da54ae585897bb48cb9984d51e0a88a6ac2124b52c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5037AC1E573F140500110A0B67548B5E

Filesize
556B

MD5
7396a3677417f7dc8b50a52130c39827

SHA1
6a7d22ba4b9e667bcefc89ec01b68ac4cbca151a

SHA256
bb58edde8aa8085b6473705d9aed7c26abee92e84a5608d6f9bada762531570d

SHA512
6b6479205796430c8332d3f488e08cd7a85e4ba470ad91f990a654ccc0ce75c32bd10cfdb773527010e2b869a0f18b9c8c783bb82bea8071ecb36be5ed182a70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ea3a0eef7df57416f4c9661a1455138

SHA1
1900cd4a28054810e3f5f8b7a09196a53302745b

SHA256
83075b72a6c0c03bff9668d29bd9c8df85a2551e43d3723e9cda3b8008a8b079

SHA512
b0c3c97932a45528e1419730dd0368a9233827c5824ccade5062bdc0e0a3640904ea6201e4eeca49c43e745748ad2853c72acb2878af7ff8c6461a4df1bae13a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd92d024fa0a5ffad20147d4be35334c

SHA1
8076c806e7285e09cf9af46bd015c6d5401ed8e6

SHA256
94041d30c7ec483766058d004ac027095399b0f7a6a667460c3019f76bde11da

SHA512
254c3f951d3c32b77331a9d5ae1959c86a7ddfb63a7c2a875ac8a0037e1c7cd2daf30e0209bd5431b15e5c25c7ee2d59f74dd6791d7b12b4d57ca861dd3d3e51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
252B

MD5
065bcf68250b9d626effae6344e61f8c

SHA1
9ec0c2ed8ec88023cf457a26287a57ad989990b0

SHA256
2858a4c2de49c027ef98698ada6b2749130cf45fd9ddde190a290e282846b1e0

SHA512
ac1b1b2468d25c7f19ba2c1b5fbf7a659d346c51e711c05e887578c43aa00bf916efbc1e924d74b472a5521cb2fac72122ac8f12401d338226d47e71e00f4baf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\72hP3UdbB.exe

Filesize
266KB

MD5
bca4f45fd63e9b7a8fb82ca92de246a2

SHA1
73819e4af3dc2200ae5eac87df6bda9c2d502134

SHA256
f5d99d4548470b4699b215453e9be29e48aa20616d45f704c335bd3bbe3e0a4f

SHA512
6ad12488a43b28e97bb43cab7250ebd5b2f5a6437850a6c023f7a15ae5538905132f25a929c2efd240f113af2d038554e562ca5eb92835063ffd83b3f5b1c704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\72hP3UdbB.exe

Filesize
266KB

MD5
bca4f45fd63e9b7a8fb82ca92de246a2

SHA1
73819e4af3dc2200ae5eac87df6bda9c2d502134

SHA256
f5d99d4548470b4699b215453e9be29e48aa20616d45f704c335bd3bbe3e0a4f

SHA512
6ad12488a43b28e97bb43cab7250ebd5b2f5a6437850a6c023f7a15ae5538905132f25a929c2efd240f113af2d038554e562ca5eb92835063ffd83b3f5b1c704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\72hP3UdbB.exe

Filesize
266KB

MD5
bca4f45fd63e9b7a8fb82ca92de246a2

SHA1
73819e4af3dc2200ae5eac87df6bda9c2d502134

SHA256
f5d99d4548470b4699b215453e9be29e48aa20616d45f704c335bd3bbe3e0a4f

SHA512
6ad12488a43b28e97bb43cab7250ebd5b2f5a6437850a6c023f7a15ae5538905132f25a929c2efd240f113af2d038554e562ca5eb92835063ffd83b3f5b1c704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\72hP3UdbB.exe

Filesize
266KB

MD5
bca4f45fd63e9b7a8fb82ca92de246a2

SHA1
73819e4af3dc2200ae5eac87df6bda9c2d502134

SHA256
f5d99d4548470b4699b215453e9be29e48aa20616d45f704c335bd3bbe3e0a4f

SHA512
6ad12488a43b28e97bb43cab7250ebd5b2f5a6437850a6c023f7a15ae5538905132f25a929c2efd240f113af2d038554e562ca5eb92835063ffd83b3f5b1c704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\72hP3UdbB.exe

Filesize
266KB

MD5
bca4f45fd63e9b7a8fb82ca92de246a2

SHA1
73819e4af3dc2200ae5eac87df6bda9c2d502134

SHA256
f5d99d4548470b4699b215453e9be29e48aa20616d45f704c335bd3bbe3e0a4f

SHA512
6ad12488a43b28e97bb43cab7250ebd5b2f5a6437850a6c023f7a15ae5538905132f25a929c2efd240f113af2d038554e562ca5eb92835063ffd83b3f5b1c704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\8A4[G35.exe

Filesize
254KB

MD5
fbc9ef363866fd3cff2615aebc2c8f6d

SHA1
7da7f54de775050eb6eb1410e24abf36c4d0c45c

SHA256
84365b5b998124dd5206ccdda3fb0f808ef4b4a6aebebcbd135e8d9193e197f9

SHA512
9ec578237e7857e8015b981b0c2842494ee0766a8ce605ed0b06b55f0036d46145b61d8b71c3843f94b92dc4aa20617b07d8d6dc7c38d83099533567da46692e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\8A4[G35.exe

Filesize
254KB

MD5
fbc9ef363866fd3cff2615aebc2c8f6d

SHA1
7da7f54de775050eb6eb1410e24abf36c4d0c45c

SHA256
84365b5b998124dd5206ccdda3fb0f808ef4b4a6aebebcbd135e8d9193e197f9

SHA512
9ec578237e7857e8015b981b0c2842494ee0766a8ce605ed0b06b55f0036d46145b61d8b71c3843f94b92dc4aa20617b07d8d6dc7c38d83099533567da46692e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\8A4[G35.exe

Filesize
254KB

MD5
fbc9ef363866fd3cff2615aebc2c8f6d

SHA1
7da7f54de775050eb6eb1410e24abf36c4d0c45c

SHA256
84365b5b998124dd5206ccdda3fb0f808ef4b4a6aebebcbd135e8d9193e197f9

SHA512
9ec578237e7857e8015b981b0c2842494ee0766a8ce605ed0b06b55f0036d46145b61d8b71c3843f94b92dc4aa20617b07d8d6dc7c38d83099533567da46692e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\fL(.exe

Filesize
896KB

MD5
7b4f90ff07d0fa2e763fd680b1e963c9

SHA1
47f1d9453dd31b2467f3f11580fba975ed69246d

SHA256
5228ff83506f82456b550462d53e68f7bc82b793d99c167b6674d853aa6b68b0

SHA512
5385fb7df409be3214a1de1b565694ed6e3491ff0f066709084673cc2975560895ab473dfc8a35ec25be999ea32abbc21c7732b99fa51792103f1e05f1e1ea9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\fL(.exe

Filesize
896KB

MD5
7b4f90ff07d0fa2e763fd680b1e963c9

SHA1
47f1d9453dd31b2467f3f11580fba975ed69246d

SHA256
5228ff83506f82456b550462d53e68f7bc82b793d99c167b6674d853aa6b68b0

SHA512
5385fb7df409be3214a1de1b565694ed6e3491ff0f066709084673cc2975560895ab473dfc8a35ec25be999ea32abbc21c7732b99fa51792103f1e05f1e1ea9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\3543.exe

Filesize
266KB

MD5
bca4f45fd63e9b7a8fb82ca92de246a2

SHA1
73819e4af3dc2200ae5eac87df6bda9c2d502134

SHA256
f5d99d4548470b4699b215453e9be29e48aa20616d45f704c335bd3bbe3e0a4f

SHA512
6ad12488a43b28e97bb43cab7250ebd5b2f5a6437850a6c023f7a15ae5538905132f25a929c2efd240f113af2d038554e562ca5eb92835063ffd83b3f5b1c704

Download Submit
C:\Users\Admin\AppData\Local\Temp\3543.exe

Filesize
266KB

MD5
bca4f45fd63e9b7a8fb82ca92de246a2

SHA1
73819e4af3dc2200ae5eac87df6bda9c2d502134

SHA256
f5d99d4548470b4699b215453e9be29e48aa20616d45f704c335bd3bbe3e0a4f

SHA512
6ad12488a43b28e97bb43cab7250ebd5b2f5a6437850a6c023f7a15ae5538905132f25a929c2efd240f113af2d038554e562ca5eb92835063ffd83b3f5b1c704

Download Submit
C:\Users\Admin\AppData\Local\Temp\3543.exe

Filesize
266KB

MD5
bca4f45fd63e9b7a8fb82ca92de246a2

SHA1
73819e4af3dc2200ae5eac87df6bda9c2d502134

SHA256
f5d99d4548470b4699b215453e9be29e48aa20616d45f704c335bd3bbe3e0a4f

SHA512
6ad12488a43b28e97bb43cab7250ebd5b2f5a6437850a6c023f7a15ae5538905132f25a929c2efd240f113af2d038554e562ca5eb92835063ffd83b3f5b1c704

Download Submit
C:\Users\Admin\AppData\Local\Temp\3543.exe

Filesize
266KB

MD5
bca4f45fd63e9b7a8fb82ca92de246a2

SHA1
73819e4af3dc2200ae5eac87df6bda9c2d502134

SHA256
f5d99d4548470b4699b215453e9be29e48aa20616d45f704c335bd3bbe3e0a4f

SHA512
6ad12488a43b28e97bb43cab7250ebd5b2f5a6437850a6c023f7a15ae5538905132f25a929c2efd240f113af2d038554e562ca5eb92835063ffd83b3f5b1c704

Download Submit
C:\Users\Admin\AppData\Local\Temp\38AE.exe

Filesize
335KB

MD5
b767d6220ad7a3aaf39761a415c927af

SHA1
297c8a96997998f547a3eadce7e7fe04096492f1

SHA256
cd0ea12bd2eb7aac8fae5cd9fb2ae2857aecdc4a0de6c3179cec29221292df42

SHA512
2e24f5e5d00b9c423218996264df83756a18b89ea2d68629c788edb32178119f971c33bdfc9fd1b9151faace2a6de4bed24d418c46ffab984e0aa318f2fb4b5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\38AE.exe

Filesize
335KB

MD5
b767d6220ad7a3aaf39761a415c927af

SHA1
297c8a96997998f547a3eadce7e7fe04096492f1

SHA256
cd0ea12bd2eb7aac8fae5cd9fb2ae2857aecdc4a0de6c3179cec29221292df42

SHA512
2e24f5e5d00b9c423218996264df83756a18b89ea2d68629c788edb32178119f971c33bdfc9fd1b9151faace2a6de4bed24d418c46ffab984e0aa318f2fb4b5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\38AE.exe

Filesize
335KB

MD5
b767d6220ad7a3aaf39761a415c927af

SHA1
297c8a96997998f547a3eadce7e7fe04096492f1

SHA256
cd0ea12bd2eb7aac8fae5cd9fb2ae2857aecdc4a0de6c3179cec29221292df42

SHA512
2e24f5e5d00b9c423218996264df83756a18b89ea2d68629c788edb32178119f971c33bdfc9fd1b9151faace2a6de4bed24d418c46ffab984e0aa318f2fb4b5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\782C.tmp\aa_nts.dll

Filesize
902KB

MD5
480a66902e6e7cdafaa6711e8697ff8c

SHA1
6ac730962e7c1dba9e2ecc5733a506544f3c8d11

SHA256
7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5

SHA512
7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

Download Submit
C:\Users\Admin\AppData\Local\Temp\782C.tmp\aa_nts.log

Filesize
121B

MD5
04e2d70a87f1a09caf35655be6d5b182

SHA1
757d0d0dd7bf15eb7b3615e32249dbcd9216961d

SHA256
a4a858fc5ab23fdbfdf3375922ec61a6453115dd836853ba42e8e728bedfc2d1

SHA512
878d36bc4f7794ac5fcbad62fd5f48b86bc76586dcc35db62ff1cd82dfea0f156c62c91c59339e5d56d7f875ec2f5b7d78bf534133695342dc1de9efde325a15

Download Submit
C:\Users\Admin\AppData\Local\Temp\782C.tmp\aa_nts.msg

Filesize
46B

MD5
3f05819f995b4dafa1b5d55ce8d1f411

SHA1
404449b79a16bfc4f64f2fd55cd73d5d27a85d71

SHA256
7e0bf0cbd06a087500a9c3b50254df3a8a2c2980921ab6a62ab1121941c80fc0

SHA512
34abb7df8b3a68e1649ff0d2762576a4d4e65da548e74b1aa65c2b82c1b89f90d053ecddac67c614ca6084dc5b2cb552949250fb70f49b536f1bcb0057717026

Download Submit
C:\Users\Admin\AppData\Local\Temp\782C.tmp\hr3

Filesize
68B

MD5
bdd4acaa3afab6cf82edbddb8fe6e1f8

SHA1
4b324a9b9ee89c716156cb2e7ea64fd2f65d2d9a

SHA256
ef414b9088e677dea0c8ab65db00c652f5008e44c1c9d67e6dae4023bd406e14

SHA512
843d54f4ddf56d87b8ca50c999c7caf98fad0895cb24c675aa65eac9636d11755db725fa6fdcc2266b24122e70a078cb1f8f76157169f073dbe85027566e8703

Download Submit
C:\Users\Admin\AppData\Local\Temp\782C.tmp\settings3.bin

Filesize
327B

MD5
4acfadd5e8b1829ed820b3afe23f8b38

SHA1
53042e29be2860c014a25ad526c882326c9b7652

SHA256
76e2dd75fc411de1432d91df221edaaeb82eb1c3892edff4a43cdb6b0fb3e6bd

SHA512
054f12bf681a31dfcffaaebe74ae2e07b686847bc585611bb78f7514818a19524cabf79e5b98f689ebafd9c5c4dd7fc074dc1b00e85607f7df660352f93a0791

Download Submit
C:\Users\Admin\AppData\Local\Temp\782C.tmp\svchost.exe

Filesize
798KB

MD5
90aadf2247149996ae443e2c82af3730

SHA1
050b7eba825412b24e3f02d76d7da5ae97e10502

SHA256
ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a

SHA512
eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

Download Submit
C:\Users\Admin\AppData\Local\Temp\782C.tmp\svchost.exe

Filesize
798KB

MD5
90aadf2247149996ae443e2c82af3730

SHA1
050b7eba825412b24e3f02d76d7da5ae97e10502

SHA256
ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a

SHA512
eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

Download Submit
C:\Users\Admin\AppData\Local\Temp\782C.tmp\svchost.exe

Filesize
798KB

MD5
90aadf2247149996ae443e2c82af3730

SHA1
050b7eba825412b24e3f02d76d7da5ae97e10502

SHA256
ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a

SHA512
eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab874B.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar879C.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y91isig8.default-release\cookies.sqlite.id[DA3F870A-3483].[[email protected]].8base

Filesize
96KB

MD5
9a147041aaa82a7240db49b4bb20517c

SHA1
a2ea1d6ae51a16d42ead4629cb75b72df9446909

SHA256
1110852450ad3d6a05e35ed37e2f0207262e8e105605b2c1b83e40b6fad17b90

SHA512
767333aab8ca6df5c247f2516b9cb8a2d34f099bc2a15658a55d2aa8814f8a8186481dc1af81e201d91c2899601b989ad4f22da90622b59fcae39bbc035e2eaa

Download Submit
C:\Users\Admin\AppData\Roaming\vvurdwi

Filesize
254KB

MD5
fbc9ef363866fd3cff2615aebc2c8f6d

SHA1
7da7f54de775050eb6eb1410e24abf36c4d0c45c

SHA256
84365b5b998124dd5206ccdda3fb0f808ef4b4a6aebebcbd135e8d9193e197f9

SHA512
9ec578237e7857e8015b981b0c2842494ee0766a8ce605ed0b06b55f0036d46145b61d8b71c3843f94b92dc4aa20617b07d8d6dc7c38d83099533567da46692e

Download Submit
C:\Users\Admin\AppData\Roaming\wcbfhrb

Filesize
438KB

MD5
9e52ffd9606f1c809e67081ad6ab718b

SHA1
664c455b010d1192d535216b6ead74a60420dbfb

SHA256
44bf86ebbdbb7d0614fe3cd1d3c6f5dcee314627eae3f46b41c50ba2afe55224

SHA512
7c597ff968dd1a9e331b47e33bb953967b7c59f466053c521a1ee356ba230d03577cd54b7c1197c2c402845bb55f13d7dc3dfdff1277db15e0f0307f40878c82

Download Submit
C:\Users\Admin\Desktop\CompareExport.rar.id[DA3F870A-3483].[[email protected]].8base

Filesize
556KB

MD5
af68471e445ee6bdda35b3f7fd21039a

SHA1
57984d788a43a3fafce11b60bd7f632fc818d021

SHA256
b34192a6bc09584f820eb85584d2e040db6b0d8aa1c6267df3767c899293f9c5

SHA512
e3e4cc7800441c0a00d1317505c7f032189730b8801ac028234252b92d078242bec994b37068fa7d29ef0a6fc8f0939082db73651ffb8b56f3690052244ed1e6

Download Submit
C:\Users\Admin\Desktop\ConvertPop.vsx.id[DA3F870A-3483].[[email protected]].8base

Filesize
248KB

MD5
5319ac0c09d40024614280cb9a311b11

SHA1
5b8374a194931e7e1e8dec52f116ddb66cc892d2

SHA256
44a13b7edca8b3c318aeaad56e12f9fa4270f44eb65f7ad158e4a8811bdbb518

SHA512
deeb18db0c102e8a4351cf05c51500b888945de20e1199812757cb95483930b6b5b0913c1592d6974febad47d5fe15fd9a02b6d97471f49fec45f6dbe66ae35c

Download Submit
C:\Users\Admin\Desktop\HideExpand.vdx.id[DA3F870A-3483].[[email protected]].8base

Filesize
381KB

MD5
0f28f61dafed91fdacf9209ca2fcc8f1

SHA1
b2f3bcab517402d3827da6cc6e9966d138c583ac

SHA256
f98b7618cbeb4f3beaa1c587ebf2037d4e39e4b70731eaf4fbb998d7d16dfeb6

SHA512
301c2e31de087df9e2fad67d2ebe7431fe6002fa95e88bf5915e2bb89622305a1b3acf93e8e7d7fb7e3540a686659d92f17897e4f39b30c74be2088c00edc8eb

Download Submit
C:\Users\Admin\Desktop\JoinMerge.rtf.id[DA3F870A-3483].[[email protected]].8base

Filesize
301KB

MD5
a7bbaa67bdecafd91443f482b87b7e29

SHA1
6dff0a7b6e0e207cf648683e4d159e8538e8f14c

SHA256
4c74fbcd6ef12029a459f8509a4413f35587d1fcefb70714c45bfad2fe67b367

SHA512
82856bf0a4a91c11fbe9737d240d6fcccc52651db42f1134b2f046a5965d22448f1f138e9d3677067e31ad6d67d5d2ad77b0b35f40e4581977dd3521efd85d3d

Download Submit
C:\Users\Admin\Desktop\LimitApprove.ttc.id[DA3F870A-3483].[[email protected]].8base

Filesize
207KB

MD5
1b0099189baad10eb1d0a8a858e44a13

SHA1
942f1218b77957847efcf6601ee37db87458375e

SHA256
3e634fb2bd1a9b6a0f730d874ccc4f202b52478356bc07efd60094074369e245

SHA512
459a3abf6f3008c177f14b5c747e5c9faa06df7bd5682786d6d9e70867d4d9462760d6aab19e0dc466be327609a5b2de6e0e2d7f92e33b7524fbca1b32164a92

Download Submit
C:\Users\Admin\Desktop\LockUse.png.id[DA3F870A-3483].[[email protected]].8base

Filesize
355KB

MD5
de569dfc9d0a7f86950a33d65bdd7446

SHA1
6b9391e2a5e5a9abfdc23c2f2f63f36a422c2bac

SHA256
fd3efbdf4b62dc9be9632c1079e2d6a934654bbaea8e4b5a8e410de9e07e9405

SHA512
260adefa1f52b562baf5e172e594dad63d873deeb99a1844fc11a9c893d9ad5fa9f7cdb26170d7be520f21a823c9220a846b37d28571f482c2f5720c32d29bb5

Download Submit
C:\Users\Admin\Desktop\MeasureWait.ttf.id[DA3F870A-3483].[[email protected]].8base

Filesize
529KB

MD5
460b51b053d3babf68ce6422b003c199

SHA1
cefd77073188d58adbc98f9aacf6735e6bb21ffe

SHA256
11d93bf3686180b3bec630a8a2992f2c323d70f3cf68c7064dcd4fe69ff8b747

SHA512
39ae009e5973803b6783dc3f23fb48d10ed7eef0888c5b30f5337f345cdd492b60471c21ffd03bee96d1d56a4e21e2ff5d78043b84f34c344ddc936222677fc5

Download Submit
C:\Users\Admin\Desktop\MergeApprove.cmd.id[DA3F870A-3483].[[email protected]].8base

Filesize
395KB

MD5
1853fc539fb97c8115048d706b5f1e0b

SHA1
fbf3832782611dd39ca741ddfb713c363e22cfef

SHA256
fa23c4e6a8af4b7633020c0c9857b9b83b5ec488207cf7bc1a99796fa54344ba

SHA512
8dbbcbd71ae7c00f9eeb3a6a38c9a5a6363c0591cd259c23ce1547b8617cb67f7d6007444571eb550e2f9d67652c743d87ea9b94a2bed6057b6478092cdbf206

Download Submit
C:\Users\Admin\Desktop\MountRead.pot.id[DA3F870A-3483].[[email protected]].8base

Filesize
274KB

MD5
ed5de7063398a1164a2bfdc5d6ac4ab0

SHA1
a3e54d8170425e99de08a3c3f27f25223cc3f0ec

SHA256
ab8fd61ff3b2eafca54e422a4be83572af8e94bb6bfe6b1bb52c6f4a830a728f

SHA512
5520c003ef6f4ce73c9ac609d9ecec6656721baac6ae68ab51f33af9fe1d030356da0da583307b7221c2c55414d8d23a85bcb08ec3a05e5051954c90f56842b3

Download Submit
C:\Users\Admin\Desktop\MoveSave.DVR.id[DA3F870A-3483].[[email protected]].8base

Filesize
448KB

MD5
f8228f06417b5c5ba390edf929da8cf9

SHA1
6a99c9031de478407220138dd1a512a9188d49a0

SHA256
b520836f434a19a9f99c001a06b3d4225c87959eb8893993792703064b69c14f

SHA512
8574ab9b78e6f3015f520c3f14026f4392d834992a2ce53a4259bced3f9f460adcebc3b9e71aaa1748fae301c087225058bffbdefd57956816937574253312c3

Download Submit
C:\Users\Admin\Desktop\NewReceive.mpa.id[DA3F870A-3483].[[email protected]].8base

Filesize
422KB

MD5
76584fc5a40ad1a38995f80d00c860b5

SHA1
77da3aed320bc411bbab5bb41d648a4440c6598a

SHA256
1f62f574472505cc674573453b61ed3895584a3e3f824ee9910365f0982ceeb0

SHA512
a3dcf2b330331b3c340b6e367cef6741db66db660668888b394e50b36b5533863620e182db679a3fa946156462eed62484db8ca9d1cabc1b26c6f7694dc11c45

Download Submit
C:\Users\Admin\Desktop\OpenMount.cab.id[DA3F870A-3483].[[email protected]].8base

Filesize
328KB

MD5
123521756d6be48e943c0d7fa471d1e1

SHA1
cc51ab558324c869b75057b6f388a475e04c914a

SHA256
78b5ea3ddef3230bf9166844796a76a7c55337bb0e63b8a0ae1ccbf3ca7dbaa3

SHA512
5180e008377f87a44428328a5e329cbc0837fb52de6ce9500ca5286a202e6fbb61a0ff02cf42f2347278271e6e9580a7ed37a57b7c4c785dc82cb2201e5c7c03

Download Submit
C:\Users\Admin\Desktop\OutAssert.3gp2.id[DA3F870A-3483].[[email protected]].8base

Filesize
515KB

MD5
726c3fa40192ec1df9c82801ce84485e

SHA1
4ec6e87a93322eae29d7ff3cfab2cb2e0d780ab4

SHA256
dccb881843fce124b1b3f059b2bce7c4a1b852afb5e472ad336e4daf46455d22

SHA512
7f2680f640bbe062fb414bcedeca38bb752f59b8a8a0082d4c7a00e0186d70bf770e88781da6752609aba5b8e8a1638fde8a60393ad5d4ec7be7864b5e8db409

Download Submit
C:\Users\Admin\Desktop\PopConnect.eps.id[DA3F870A-3483].[[email protected]].8base

Filesize
542KB

MD5
1366c465406cbbe15253d9ffff1d2a89

SHA1
03dce9770e63994f88f873f08e33993d3900e82d

SHA256
4c0b42fedd18353b5b07dba3f6c144c3da0dec17c1e8264f80d7fd2c5608d80d

SHA512
e6ddf1c24b604644bbc4159f450e1a418ce80252a214f021e8734357b2d08ba0759d602bcc25984ecc141cf73cb66683448c5f02f6869af6c933cd4d3840cf7e

Download Submit
C:\Users\Admin\Desktop\RepairRead.ppt.id[DA3F870A-3483].[[email protected]].8base

Filesize
502KB

MD5
6e4a0cf52516af3abea7f21c446deb41

SHA1
3f801b4daa440502a76641d27de93e5044e3a321

SHA256
8744694ca4983930e3eca9db288fe91fb877b5061d9e25d58679d7defabc1bd2

SHA512
95035838040d8304edfb2ec96bb4fa2a86c0639ece24446376425a39e9cf96654ba5b874dec94d0adeb05148bf49e5924c9a1e554029b1eeb876e802147fd058

Download Submit
C:\Users\Admin\Desktop\ResolveFormat.php.id[DA3F870A-3483].[[email protected]].8base

Filesize
221KB

MD5
ee037a706409901305103c99e55d7218

SHA1
1e9316742efbdd20f7ab1748468ff72205bd497e

SHA256
9f36c3f18bfa9b837eb075c6c1ddd8a1053ff27123e6033142f25b15f359f706

SHA512
68680298bb096f44b0d6f460b83f5b12bd8d7f52a087c1d5b18245fee30b14d39afd3d4d6f97a22a6a99f8ac3515c25838c1991606ca9b02ee26c84af6422b04

Download Submit
C:\Users\Admin\Desktop\RestoreInitialize.cab.id[DA3F870A-3483].[[email protected]].8base

Filesize
475KB

MD5
25bb40bab741d87d16611a22534eae1c

SHA1
af69d484dc6181999d206be9aca2e35b40c73644

SHA256
0216612a617ae66cc96596768f75ec79faa3a093134ea225ded926678994369d

SHA512
51a19755c626ef7f84caf90396d4bbeadb687da9258fac94dc9db4f360c129351430ec311c6b5542a987aa204519ac14bcd785aefd61d401d235c59c221fe8c2

Download Submit
C:\Users\Admin\Desktop\SplitDebug.3gpp.id[DA3F870A-3483].[[email protected]].8base

Filesize
435KB

MD5
dc311ff988f66b229c752c8730ddd88a

SHA1
f77d4b71f053d9075a59804e53408f17a4f73150

SHA256
5c988a268afb2b24b8dbc2f455f61b3b2781e3f79980f091fe30cb41f0fd967f

SHA512
18ef003cbaa39b9e2f47a5788ba55189a6eecfa4c4d09caecbb776157ad956106b2459e325fd3f55bdc2a2f0e66e045b39ea4347a71ac53e9de6eac53e183cb3

Download Submit
C:\Users\Admin\Desktop\StopConvert.mpv2.id[DA3F870A-3483].[[email protected]].8base

Filesize
489KB

MD5
9745c0a5497ac414771f09a787dd0559

SHA1
20d1706f9327ca3c7309f10edbc247641a8af2c3

SHA256
df4767f82b17008965eef768c3b45220142f887538e65a95a4883e06ea9fa44a

SHA512
d1663c6cf4ed5316690c35b584eb2df2a4b3685582dd82fb83513e17916c08c0e0b29ee6b906c0cf2c2fd6f99507cb088321efabe04ae923542a543f7b7ff680

Download Submit
C:\Users\Admin\Desktop\UnregisterInstall.m1v.id[DA3F870A-3483].[[email protected]].8base

Filesize
288KB

MD5
12993896b0ac0f429361962b2974541a

SHA1
a212320cf8a88f999094700a03170cdc17cb4220

SHA256
b6bfe6a7ed061650a5364d5c5c6d3a97db7927f20c0d9bff0feb9875976d67a2

SHA512
f7183a752426ee1a6b93e80aec4c2518310911db8d4a65acfa6f8ec019e134bd303b1621c0a14d227d99d8094807d2be46b4317c80b4a3c312d2336417396228

Download Submit
C:\Users\Admin\Desktop\UseExport.ps1xml.id[DA3F870A-3483].[[email protected]].8base

Filesize
341KB

MD5
7cce2e21d5a7996fe22754b806d15ea9

SHA1
d7317b119becda08683c1b4ebdb2597a536d4103

SHA256
751eebca3a90c691b50b5caaeb3e32924e45704d326cbdf258728d0e092d9809

SHA512
b778001fe15507e196ff0cd31a60f6dfaa2170cfaf89d2ca08661d9b2f26bb5de818eb064aa5e92d833c22fbe4a2938895a33fb5aa9739404bb18ea3b0a3486b

Download Submit
C:\Users\Admin\Desktop\WatchStop.bat.id[DA3F870A-3483].[[email protected]].8base

Filesize
462KB

MD5
3bc5efa1893828fe9e56c7ff96760672

SHA1
d2b2cdb99c88bf687d89d4beb9e053602a9c43ab

SHA256
b2703979e875f8c153e90bbe4f371e684ce97694f8643e750d627cf07d1f5394

SHA512
a110937756a661375364f64819b61bddcf6606b3b7980f8cdc472ac1d776b5ddd02e03c2d458797655faea4663cf6c5190f4df6831377b4b3a530a432a2f7b81

Download Submit
C:\Users\Admin\Desktop\WriteGet.mpa.id[DA3F870A-3483].[[email protected]].8base

Filesize
261KB

MD5
13b46750a6d074cb2a02e4d6dd07d626

SHA1
e9207b3e1c1857c9c423d077fd6e99fa55dab2ca

SHA256
8265f28232c96f0e64123b145752d917dd16d034060a92e5d8a93b8de4b1dc64

SHA512
c065f668b279cdd632235d5794403c80c6bf9bd7ec4c38850406e1f76ae5441bc5631728d06d9e8725b6ab851018baa0aab3dfa19b188d3162d9bcd418e9d1f7

Download Submit
C:\info.hta

Filesize
5KB

MD5
3e9e85d1e6f52db9feb6efdf9cd7c2ce

SHA1
e92d549065478af844967c8ec9e8b038c20a8f19

SHA256
2418fdaa537a088c9d57a5d05f9399b98b9be42c500ed570f0ae88303df3f3a5

SHA512
7392f9c139d007e81c4b5ca25d1324a52e82c27835499a46c0c5402ce73c1ae3424efcebda397487ad8bf162e1d075081c25b100278d58a24274e1aa1a685dd4

Download Submit
\Users\Admin\AppData\Local\Microsoft\fL(.exe

Filesize
896KB

MD5
7b4f90ff07d0fa2e763fd680b1e963c9

SHA1
47f1d9453dd31b2467f3f11580fba975ed69246d

SHA256
5228ff83506f82456b550462d53e68f7bc82b793d99c167b6674d853aa6b68b0

SHA512
5385fb7df409be3214a1de1b565694ed6e3491ff0f066709084673cc2975560895ab473dfc8a35ec25be999ea32abbc21c7732b99fa51792103f1e05f1e1ea9b

Download Submit
\Users\Admin\AppData\Local\Temp\3543.exe

Filesize
266KB

MD5
bca4f45fd63e9b7a8fb82ca92de246a2

SHA1
73819e4af3dc2200ae5eac87df6bda9c2d502134

SHA256
f5d99d4548470b4699b215453e9be29e48aa20616d45f704c335bd3bbe3e0a4f

SHA512
6ad12488a43b28e97bb43cab7250ebd5b2f5a6437850a6c023f7a15ae5538905132f25a929c2efd240f113af2d038554e562ca5eb92835063ffd83b3f5b1c704

Download Submit
\Users\Admin\AppData\Local\Temp\38AE.exe

Filesize
335KB

MD5
b767d6220ad7a3aaf39761a415c927af

SHA1
297c8a96997998f547a3eadce7e7fe04096492f1

SHA256
cd0ea12bd2eb7aac8fae5cd9fb2ae2857aecdc4a0de6c3179cec29221292df42

SHA512
2e24f5e5d00b9c423218996264df83756a18b89ea2d68629c788edb32178119f971c33bdfc9fd1b9151faace2a6de4bed24d418c46ffab984e0aa318f2fb4b5c

Download Submit
\Users\Admin\AppData\Local\Temp\782C.tmp\aa_nts.dll

Filesize
902KB

MD5
480a66902e6e7cdafaa6711e8697ff8c

SHA1
6ac730962e7c1dba9e2ecc5733a506544f3c8d11

SHA256
7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5

SHA512
7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

Download Submit
\Users\Admin\AppData\Local\Temp\782C.tmp\aa_nts.dll

Filesize
902KB

MD5
480a66902e6e7cdafaa6711e8697ff8c

SHA1
6ac730962e7c1dba9e2ecc5733a506544f3c8d11

SHA256
7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5

SHA512
7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

Download Submit
\Users\Admin\AppData\Local\Temp\782C.tmp\aa_nts.dll

Filesize
902KB

MD5
480a66902e6e7cdafaa6711e8697ff8c

SHA1
6ac730962e7c1dba9e2ecc5733a506544f3c8d11

SHA256
7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5

SHA512
7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

Download Submit
\Users\Admin\AppData\Local\Temp\782C.tmp\aa_nts.dll

Filesize
902KB

MD5
480a66902e6e7cdafaa6711e8697ff8c

SHA1
6ac730962e7c1dba9e2ecc5733a506544f3c8d11

SHA256
7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5

SHA512
7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

Download Submit
\Users\Admin\AppData\Local\Temp\782C.tmp\svchost.exe

Filesize
798KB

MD5
90aadf2247149996ae443e2c82af3730

SHA1
050b7eba825412b24e3f02d76d7da5ae97e10502

SHA256
ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a

SHA512
eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

Download Submit
\Users\Admin\AppData\Local\Temp\782C.tmp\svchost.exe

Filesize
798KB

MD5
90aadf2247149996ae443e2c82af3730

SHA1
050b7eba825412b24e3f02d76d7da5ae97e10502

SHA256
ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a

SHA512
eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

Download Submit
memory/268-118-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/268-104-0x0000000002290000-0x00000000022D0000-memory.dmp

Filesize
256KB

Download
memory/268-103-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/312-1196-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/576-143-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Filesize
9.9MB

Download
memory/576-119-0x0000000001150000-0x0000000001236000-memory.dmp

Filesize
920KB

Download
memory/576-124-0x000000001B860000-0x000000001B930000-memory.dmp

Filesize
832KB

Download
memory/576-123-0x00000000005D0000-0x0000000000650000-memory.dmp

Filesize
512KB

Download
memory/576-122-0x000000001B780000-0x000000001B862000-memory.dmp

Filesize
904KB

Download
memory/576-121-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Filesize
9.9MB

Download
memory/620-28-0x00000000003A0000-0x00000000003D6000-memory.dmp

Filesize
216KB

Download
memory/620-22-0x0000000001EE0000-0x00000000022E0000-memory.dmp

Filesize
4.0MB

Download
memory/620-6-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/620-16-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/620-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/620-12-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/620-10-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/620-8-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/620-38-0x0000000001EE0000-0x00000000022E0000-memory.dmp

Filesize
4.0MB

Download
memory/620-36-0x0000000001EE0000-0x00000000022E0000-memory.dmp

Filesize
4.0MB

Download
memory/620-20-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/620-25-0x0000000001EE0000-0x00000000022E0000-memory.dmp

Filesize
4.0MB

Download
memory/620-24-0x0000000001EE0000-0x00000000022E0000-memory.dmp

Filesize
4.0MB

Download
memory/620-21-0x0000000000090000-0x0000000000097000-memory.dmp

Filesize
28KB

Download
memory/620-35-0x00000000003A0000-0x00000000003D6000-memory.dmp

Filesize
216KB

Download
memory/620-37-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/620-29-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/620-23-0x0000000001EE0000-0x00000000022E0000-memory.dmp

Filesize
4.0MB

Download
memory/620-19-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/900-64-0x0000000000480000-0x00000000004C6000-memory.dmp

Filesize
280KB

Download
memory/900-66-0x0000000004BD0000-0x0000000004C10000-memory.dmp

Filesize
256KB

Download
memory/900-63-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/900-97-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/900-65-0x0000000000560000-0x0000000000594000-memory.dmp

Filesize
208KB

Download
memory/900-60-0x0000000000BC0000-0x0000000000C08000-memory.dmp

Filesize
288KB

Download
memory/1032-5-0x00000000004F0000-0x000000000053C000-memory.dmp

Filesize
304KB

Download
memory/1032-1-0x0000000074A30000-0x000000007511E000-memory.dmp

Filesize
6.9MB

Download
memory/1032-0-0x0000000000160000-0x00000000001DC000-memory.dmp

Filesize
496KB

Download
memory/1032-18-0x0000000074A30000-0x000000007511E000-memory.dmp

Filesize
6.9MB

Download
memory/1032-2-0x00000000007D0000-0x0000000000848000-memory.dmp

Filesize
480KB

Download
memory/1032-3-0x0000000004930000-0x0000000004970000-memory.dmp

Filesize
256KB

Download
memory/1032-4-0x0000000004210000-0x0000000004278000-memory.dmp

Filesize
416KB

Download
memory/1072-1255-0x0000000000130000-0x00000000001A5000-memory.dmp

Filesize
468KB

Download
memory/1072-1476-0x0000000000080000-0x00000000000EB000-memory.dmp

Filesize
428KB

Download
memory/1072-1258-0x0000000000080000-0x00000000000EB000-memory.dmp

Filesize
428KB

Download
memory/1300-978-0x0000000000380000-0x00000000003C6000-memory.dmp

Filesize
280KB

Download
memory/1300-806-0x0000000000210000-0x0000000000258000-memory.dmp

Filesize
288KB

Download
memory/1300-980-0x0000000004A50000-0x0000000004A90000-memory.dmp

Filesize
256KB

Download
memory/1300-979-0x0000000073710000-0x0000000073DFE000-memory.dmp

Filesize
6.9MB

Download
memory/1300-1189-0x0000000073710000-0x0000000073DFE000-memory.dmp

Filesize
6.9MB

Download
memory/1496-1396-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1496-1361-0x0000000000090000-0x0000000000094000-memory.dmp

Filesize
16KB

Download
memory/1692-1150-0x0000000004BB0000-0x0000000004BF0000-memory.dmp

Filesize
256KB

Download
memory/1692-1059-0x0000000000B20000-0x0000000000B7A000-memory.dmp

Filesize
360KB

Download
memory/1692-1080-0x0000000073710000-0x0000000073DFE000-memory.dmp

Filesize
6.9MB

Download
memory/1992-1588-0x0000000000090000-0x000000000009A000-memory.dmp

Filesize
40KB

Download
memory/1992-1589-0x0000000000080000-0x000000000008B000-memory.dmp

Filesize
44KB

Download
memory/2280-1254-0x0000000000060000-0x000000000006C000-memory.dmp

Filesize
48KB

Download
memory/2716-80-0x0000000000560000-0x0000000000592000-memory.dmp

Filesize
200KB

Download
memory/2716-72-0x00000000009F0000-0x0000000000A36000-memory.dmp

Filesize
280KB

Download
memory/2716-77-0x00000000004D0000-0x0000000000514000-memory.dmp

Filesize
272KB

Download
memory/2716-82-0x00000000047A0000-0x00000000047E0000-memory.dmp

Filesize
256KB

Download
memory/2716-108-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/2716-76-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/2800-98-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2800-86-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2800-126-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2800-90-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2800-88-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2800-94-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2900-120-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2960-144-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2960-81-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2960-67-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2960-87-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2960-73-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2960-75-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2960-92-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2960-78-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2960-96-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2960-84-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2960-83-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3016-141-0x0000000077810000-0x00000000779B9000-memory.dmp

Filesize
1.7MB

Download
memory/3016-43-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

Filesize
1.2MB

Download
memory/3016-27-0x0000000000060000-0x0000000000063000-memory.dmp

Filesize
12KB

Download
memory/3016-140-0x0000000000120000-0x0000000000122000-memory.dmp

Filesize
8KB

Download
memory/3016-41-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

Filesize
1.2MB

Download
memory/3016-45-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

Filesize
1.2MB

Download
memory/3016-71-0x0000000077810000-0x00000000779B9000-memory.dmp

Filesize
1.7MB

Download
memory/3016-26-0x0000000000060000-0x0000000000063000-memory.dmp

Filesize
12KB

Download
memory/3016-40-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/3016-51-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

Filesize
1.2MB

Download
memory/3016-42-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

Filesize
1.2MB

Download
memory/3016-61-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

Filesize
1.2MB

Download
memory/3016-44-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

Filesize
1.2MB

Download
memory/3016-48-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

Filesize
1.2MB

Download
memory/3016-56-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

Filesize
1.2MB

Download
memory/3016-55-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

Filesize
1.2MB

Download
memory/3016-54-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

Filesize
1.2MB

Download
memory/3016-53-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

Filesize
1.2MB

Download
memory/3016-52-0x0000000077810000-0x00000000779B9000-memory.dmp

Filesize
1.7MB

Download
memory/3016-50-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

Filesize
1.2MB

Download