033b4950a8f249b20eb86ec6f8f2ea0a1567bb164289d1aa7fb0ba51f9bbe46c

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2023 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64CO.exe
Size

1.2MB
MD5

a80b79de02d6881d5e54afcefa38298a
SHA1

e0d3e2612a757ff5be818b114028a0e4bb562bc5
SHA256

033b4950a8f249b20eb86ec6f8f2ea0a1567bb164289d1aa7fb0ba51f9bbe46c
SHA512

1fbe52a0086a33a98e48f501c669f3a9e82b5795550702eb61ccc281c77ba29fe217a5897b6caf55582ca1c16d062a2d3219a596d4372c70782bc49499e0ed4f
SSDEEP

24576:FCLKd8jHzb9904e43wa2SZ6Es9S+Nm0m:4K099ReumEwS+

Score

9^/10

evasion persistence ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

4444 bcdedit.exe
4876 bcdedit.exe
Renames multiple (629) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes System State backups 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exewbadmin.exe

pid process

4360 wbadmin.exe
740 wbadmin.exe

pid	process
4444	bcdedit.exe
4876	bcdedit.exe

pid	process
4360	wbadmin.exe
740	wbadmin.exe

Drops file in Drivers directory 12 IoCs

Processes:

64CO.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	64CO.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts.inprocess	64CO.exe
File opened for modification	C:\Windows\System32\drivers\etc\networks	64CO.exe
File opened for modification	C:\Windows\System32\drivers\etc\networks.keversen	64CO.exe
File opened for modification	C:\Windows\System32\drivers\etc\protocol	64CO.exe
File opened for modification	C:\Windows\System32\drivers\etc\protocol.keversen	64CO.exe
File opened for modification	C:\Windows\System32\drivers\etc\services.keversen	64CO.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts.keversen	64CO.exe
File opened for modification	C:\Windows\System32\drivers\etc\networks.inprocess	64CO.exe
File opened for modification	C:\Windows\System32\drivers\etc\protocol.inprocess	64CO.exe
File opened for modification	C:\Windows\System32\drivers\etc\services	64CO.exe
File opened for modification	C:\Windows\System32\drivers\etc\services.inprocess	64CO.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

64CO.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\Control Panel\International\Geo\Nation 64CO.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\Control Panel\International\Geo\Nation	64CO.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

64CO.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSFEEditor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\64CO.exe\" e"	64CO.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

64CO.exe

description ioc process

File opened for modification \??\E:\$RECYCLE.BIN\S-1-5-21-3455265224-196869244-2056873367-1000\desktop.ini 64CO.exe

description	ioc	process
File opened for modification	\??\E:\$RECYCLE.BIN\S-1-5-21-3455265224-196869244-2056873367-1000\desktop.ini	64CO.exe

Enumerates connected drives 3 TTPs 39 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

64CO.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	ioc	process
File opened (read-only)	\??\P:	64CO.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\H:	64CO.exe
File opened (read-only)	\??\K:	64CO.exe
File opened (read-only)	\??\L:	64CO.exe
File opened (read-only)	\??\N:	64CO.exe
File opened (read-only)	\??\Y:	64CO.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\F:	64CO.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\J:	64CO.exe
File opened (read-only)	\??\M:	64CO.exe
File opened (read-only)	\??\D:	64CO.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\U:	64CO.exe
File opened (read-only)	\??\X:	64CO.exe
File opened (read-only)	\??\Z:	64CO.exe
File opened (read-only)	\??\A:	64CO.exe
File opened (read-only)	\??\B:	64CO.exe
File opened (read-only)	\??\G:	64CO.exe
File opened (read-only)	\??\I:	64CO.exe
File opened (read-only)	\??\W:	64CO.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\O:	64CO.exe
File opened (read-only)	\??\R:	64CO.exe
File opened (read-only)	\??\S:	64CO.exe
File opened (read-only)	\??\V:	64CO.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\T:	64CO.exe
File opened (read-only)	\??\E:	64CO.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\Q:	64CO.exe

Drops file in System32 directory 64 IoCs

Processes:

64CO.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\config\BBI	64CO.exe
File created	C:\Windows\system32\CatRoot2\edbtmp.log	svchost.exe
File opened for modification	C:\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb.jfm	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Report policies.inprocess	64CO.exe
File opened for modification	C:\Windows\System32\ResPriImageListLowCost	64CO.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.keversen	64CO.exe
File opened for modification	C:\Windows\System32\config\DRIVERS.inprocess	64CO.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor.inprocess	64CO.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.inprocess	64CO.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\System32\config\SYSTEM	64CO.exe
File opened for modification	C:\Windows\system32\CatRoot2\edb.log	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work	64CO.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749	64CO.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	64CO.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task	64CO.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A.inprocess	64CO.exe
File opened for modification	C:\Windows\System32\config\SECURITY	64CO.exe
File opened for modification	C:\Windows\system32\CatRoot2\edbtmp.log	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead.inprocess	64CO.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776.keversen	64CO.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506.keversen	64CO.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A.inprocess	64CO.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749.inprocess	64CO.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.inprocess	64CO.exe
File opened for modification	C:\Windows\System32\config\ELAM	64CO.exe
File created	C:\Windows\system32\CatRoot2\edbres00002.jrs	svchost.exe
File opened for modification	C:\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb.jfm	svchost.exe
File created	C:\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb	svchost.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\16843576-125f-43ea-90ea-a83e2e54d435.keversen	64CO.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred.keversen	64CO.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776.inprocess	64CO.exe
File created	C:\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb.jfm	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work.inprocess	64CO.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	64CO.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187.keversen	64CO.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	64CO.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04.inprocess	64CO.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749.inprocess	64CO.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan.inprocess	64CO.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\UpdateModelTask	64CO.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	64CO.exe
File opened for modification	C:\Windows\System32\ResPriHMImageList	64CO.exe
File opened for modification	C:\Windows\System32\config\BCD-Template.keversen	64CO.exe
File opened for modification	C:\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb	svchost.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\654bd96f-ff2e-4668-9fcb-e8d873679815	64CO.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D.keversen	64CO.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04.keversen	64CO.exe
File opened for modification	C:\Windows\System32\config\ELAM.inprocess	64CO.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04.inprocess	64CO.exe
File opened for modification	C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb.inprocess	64CO.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\16843576-125f-43ea-90ea-a83e2e54d435	64CO.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\654bd96f-ff2e-4668-9fcb-e8d873679815.keversen	64CO.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\87d379a3-e6c5-484a-9ef9-9428568c9b8d	64CO.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred	64CO.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	64CO.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	64CO.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Report policies	64CO.exe
File opened for modification	C:\Windows\System32\config\COMPONENTS.inprocess	64CO.exe
File opened for modification	C:\Windows\System32\config\COMPONENTS.keversen	64CO.exe
File opened for modification	C:\Windows\system32\CatRoot2\edb.jcp	svchost.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred.inprocess	64CO.exe
File created	C:\Windows\system32\CatRoot2\edbres00001.jrs	svchost.exe

Drops file in Program Files directory 52 IoCs

Processes:

64CO.exe

description	ioc	process
File opened for modification	C:\Program Files\Mozilla Firefox\removed-files	64CO.exe
File opened for modification	C:\Program Files\Mozilla Firefox\removed-files.inprocess	64CO.exe
File opened for modification	C:\Program Files\Mozilla Firefox\postSigningData.inprocess	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.inprocess	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.inprocess	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.inprocess	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.keversen	64CO.exe
File opened for modification	C:\Program Files\Mozilla Firefox\precomplete.keversen	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.inprocess	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.keversen	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.inprocess	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.keversen	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.inprocess	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.keversen	64CO.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\master_preferences.inprocess	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.keversen	64CO.exe
File opened for modification	C:\Program Files\Mozilla Firefox\postSigningData.keversen	64CO.exe
File opened for modification	C:\Program Files\Mozilla Firefox\removed-files.keversen	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.inprocess	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.keversen	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.inprocess	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.inprocess	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.keversen	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.inprocess	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.inprocess	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.inprocess	64CO.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H	64CO.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\master_preferences	64CO.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\master_preferences.keversen	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.inprocess	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.keversen	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.keversen	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.keversen	64CO.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V	64CO.exe
File opened for modification	C:\Program Files\Mozilla Firefox\precomplete.inprocess	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003	64CO.exe
File opened for modification	C:\Program Files\Mozilla Firefox\postSigningData	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile	64CO.exe
File opened for modification	C:\Program Files\Mozilla Firefox\precomplete	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.keversen	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.keversen	64CO.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050	64CO.exe

Drops file in Windows directory 64 IoCs

Processes:

64CO.exewbadmin.exewbadmin.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\SourceHash{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}.keversen	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.inprocess	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}.keversen	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{AE86D888-1404-47CC-A7BB-8D86C0503E58}.keversen	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{76DEEAB3-122F-4231-83C7-0C35363D02F9}.inprocess	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{7DAD0258-515C-3DD4-8964-BD714199E0F7}	64CO.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\SharedFileCache\e1ea7b2e20a22fbee6e9dd5d883e9f3cc75fdee790ea383a755da4381088ec52	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{3A706840-2882-423C-90EB-B31545E2BC7A}.keversen	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{76DEEAB3-122F-4231-83C7-0C35363D02F9}.keversen	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}.keversen	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}.inprocess	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.keversen	64CO.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\SharedFileCache\ffb218cb78a2ca5b027e463f2a6bbb9c7036730212098e4fb7c330c70dcdfda4.keversen	64CO.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Installer\SourceHash{4A03706F-666A-4037-7777-5F2748764D10}	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{9BE518E6-ECC6-35A9-88E4-87755C07200F}	64CO.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D.inprocess	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{7DAD0258-515C-3DD4-8964-BD714199E0F7}.inprocess	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{90160000-008C-0000-1000-0000000FF1CE}.inprocess	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{90160000-008C-0409-1000-0000000FF1CE}.keversen	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{3A706840-2882-423C-90EB-B31545E2BC7A}	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{3544B2EE-E62F-4D11-B79C-3DDEACE94DA5}.inprocess	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}	64CO.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\SharedFileCache\e1ea7b2e20a22fbee6e9dd5d883e9f3cc75fdee790ea383a755da4381088ec52.keversen	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}.inprocess	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}	64CO.exe
File opened for modification	C:\Windows\Boot\DVD\PCAT\BCD	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{7DAD0258-515C-3DD4-8964-BD714199E0F7}.keversen	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{9BE518E6-ECC6-35A9-88E4-87755C07200F}.inprocess	64CO.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_63cc4225-b733-40b3-b5f9-0991cac33c4b.inprocess	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}.inprocess	64CO.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D.keversen	64CO.exe
File opened for modification	C:\Windows\AppReadiness\S-1-5-21-3455265224-196869244-2056873367-1000	64CO.exe
File opened for modification	C:\Windows\AppReadiness\S-1-5-21-3455265224-196869244-2056873367-1000.inprocess	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{CB0836EC-B072-368D-82B2-D3470BF95707}	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{77924AE4-039E-4CA4-87B4-2F64180381F0}.inprocess	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{B175520C-86A2-35A7-8619-86DC379688B9}.keversen	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{D44822A8-FC28-42FC-8B1D-21A78579FC79}	64CO.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\SharedFileCache\ffb218cb78a2ca5b027e463f2a6bbb9c7036730212098e4fb7c330c70dcdfda4	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{64A3A4F4-B792-11D6-A78A-00B0D0180381}.keversen	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{662A0088-6FCD-45DD-9EA7-68674058AED5}.inprocess	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}.inprocess	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{90160000-007E-0000-1000-0000000FF1CE}.inprocess	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{C7141A99-592B-4226-A4E9-B767C1D0FBAF}	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{C7141A99-592B-4226-A4E9-B767C1D0FBAF}.keversen	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}.inprocess	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{662A0088-6FCD-45DD-9EA7-68674058AED5}.keversen	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}.keversen	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{90160000-008C-0000-1000-0000000FF1CE}	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{AC76BA86-7AD7-1033-7B44-AC0F074E4100}.inprocess	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{D44822A8-FC28-42FC-8B1D-21A78579FC79}.inprocess	64CO.exe
File opened for modification	C:\Windows\Boot\PCAT\bootmgr	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{113C0ADC-B9BD-4F95-9653-4F5BC540ED03}	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.inprocess	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{662A0088-6FCD-45DD-9EA7-68674058AED5}	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{90160000-007E-0000-1000-0000000FF1CE}.keversen	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{90160000-008C-0409-1000-0000000FF1CE}.inprocess	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{BF08E976-B92E-4336-B56F-2171179476C4}.inprocess	64CO.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead.inprocess	64CO.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Panther\setupinfo.inprocess	64CO.exe
File opened for modification	C:\Windows\Installer\SourceHash{90160000-007E-0000-1000-0000000FF1CE}	64CO.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 13 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	process
4164	vssadmin.exe
2832	vssadmin.exe
2360	vssadmin.exe
2932	vssadmin.exe
2024	vssadmin.exe
900	vssadmin.exe
1760	vssadmin.exe
3384	vssadmin.exe
3564	vssadmin.exe
4156	vssadmin.exe
1908	vssadmin.exe
4064	vssadmin.exe
3824	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

64CO.exe

pid	process
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe
4880	64CO.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

vssvc.exewmic.exe

description	pid	process
Token: SeBackupPrivilege	3696	vssvc.exe
Token: SeRestorePrivilege	3696	vssvc.exe
Token: SeAuditPrivilege	3696	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2284	wmic.exe
Token: SeSecurityPrivilege	2284	wmic.exe
Token: SeTakeOwnershipPrivilege	2284	wmic.exe
Token: SeLoadDriverPrivilege	2284	wmic.exe
Token: SeSystemProfilePrivilege	2284	wmic.exe
Token: SeSystemtimePrivilege	2284	wmic.exe
Token: SeProfSingleProcessPrivilege	2284	wmic.exe
Token: SeIncBasePriorityPrivilege	2284	wmic.exe
Token: SeCreatePagefilePrivilege	2284	wmic.exe
Token: SeBackupPrivilege	2284	wmic.exe
Token: SeRestorePrivilege	2284	wmic.exe
Token: SeShutdownPrivilege	2284	wmic.exe
Token: SeDebugPrivilege	2284	wmic.exe
Token: SeSystemEnvironmentPrivilege	2284	wmic.exe
Token: SeRemoteShutdownPrivilege	2284	wmic.exe
Token: SeUndockPrivilege	2284	wmic.exe
Token: SeManageVolumePrivilege	2284	wmic.exe
Token: 33	2284	wmic.exe
Token: 34	2284	wmic.exe
Token: 35	2284	wmic.exe
Token: 36	2284	wmic.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

64CO.exe

description	pid	process	target process
PID 4880 wrote to memory of 3564	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 3564	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 2024	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 2024	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 4156	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 4156	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 2832	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 2832	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 2360	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 2360	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 900	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 900	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 1760	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 1760	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 1908	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 1908	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 4064	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 4064	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 3824	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 3824	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 4164	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 4164	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 2932	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 2932	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 3384	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 3384	4880	64CO.exe	vssadmin.exe
PID 4880 wrote to memory of 4444	4880	64CO.exe	bcdedit.exe
PID 4880 wrote to memory of 4444	4880	64CO.exe	bcdedit.exe
PID 4880 wrote to memory of 4876	4880	64CO.exe	bcdedit.exe
PID 4880 wrote to memory of 4876	4880	64CO.exe	bcdedit.exe
PID 4880 wrote to memory of 4360	4880	64CO.exe	wbadmin.exe
PID 4880 wrote to memory of 4360	4880	64CO.exe	wbadmin.exe
PID 4880 wrote to memory of 740	4880	64CO.exe	wbadmin.exe
PID 4880 wrote to memory of 740	4880	64CO.exe	wbadmin.exe
PID 4880 wrote to memory of 2284	4880	64CO.exe	wmic.exe
PID 4880 wrote to memory of 2284	4880	64CO.exe	wmic.exe
PID 4880 wrote to memory of 4404	4880	64CO.exe	cmd.exe
PID 4880 wrote to memory of 4404	4880	64CO.exe	cmd.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

64CO.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	64CO.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\64CO.exe
"C:\Users\Admin\AppData\Local\Temp\64CO.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4880
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=401MB
  2⤵
  - Interacts with shadow copies
  PID:3564
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:2024
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:4156
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:2832
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:2360
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:900
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1760
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1908
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:4064
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:3824
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:4164
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:2932
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Interacts with shadow copies
  PID:3384
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit.exe /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4444
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4876
- C:\Windows\SYSTEM32\wbadmin.exe
  wbadmin DELETE SYSTEMSTATEBACKUP
  2⤵
  - Deletes System State backups
  - Drops file in Windows directory
  PID:4360
- C:\Windows\SYSTEM32\wbadmin.exe
  wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
  2⤵
  - Deletes System State backups
  - Drops file in Windows directory
  PID:740
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2284
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\64CO.exe >> NUL
  2⤵
  PID:4404

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:64

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\398EE64D66758B5715368AA94044B13A.keversen

Filesize
710B

MD5
31c5920536e892041123cc3552756b95

SHA1
3537449938f8fb73a9e37e79ed973270586ddaf3

SHA256
ccc671deb21fdf5ee401574f6573990509b11a1c1d3dda6aa61e8f85be7816be

SHA512
97deba22755862befdb5c53dee4fe0674421eae74f7608c2b394bbc4970c300cafe02e0e897b7efe27b3bb5945ff299c8fa361e9f4568242c152ba0b076609cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.keversen

Filesize
850B

MD5
0eb6e1875269be11df9201496aff5a83

SHA1
878dd586c9b45c1dca1a52f9df96f4466e995048

SHA256
e3f71c19d7a60e2030c57e3d77183da83e7ac3e51707785d67c4a1636e25e748

SHA512
1b327bbec6adc3b4c91e9d2d265888110f966597605e82247d3bfb121188343ed4c4c6f154a47246d0074f157c13e8ac31583f0908511f694faad252bb3085bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506.keversen

Filesize
842B

MD5
e5ec6c3c57a2b3872912a4a8eb1e1004

SHA1
538204c8b668e4980477a4adefb999b108ef4f13

SHA256
e4799dc078e016952719338909f339b3ac38019a0a05206ce2e16393b0f5e6fc

SHA512
c3727fad1484fe53edfcd47ecf5024f9e08b42c7c03019ace72e24515ecd860774e77cea34f53e421676a9dd47b9560c5b429b390686c911b09f10290c74bc39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C86BD7751D53F10F65AAAD66BBDF33C7.keversen

Filesize
770B

MD5
c0ec87ea5071471b443ece8bf23e86b7

SHA1
72600953fb557732c8d2710b0ca4d10ffb038452

SHA256
e5369e24eb34a96813bd9daa62fb63464640ff67cc605a4173a4a38b72709e2b

SHA512
10f04a0d8f41c4e11fbd886eb585e4e2ea1dab3e2663cbfdc1ba345072a14696670ad8032eda78851bcd46c128f294808add9551f976b5191eeaf751a39ea505

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749.keversen

Filesize
842B

MD5
b00998e7184e9d4d4c79747441b2b3bb

SHA1
e42f1d6ce9c43ed673bcb46e5282ddbfc3ed540e

SHA256
0871cc581cd8610812795430819cbf48a081a7be7876674a5b7af0ea327247d8

SHA512
c7b3fa71a90cc649eee9f7bcf052f59c82ba170f5aef07df59683e4c04020cef92ab0539d6d47b7a7b306e635656fe065898a001c05920c9ceb8caa28eb0ee92

Download Submit
C:\Windows\System32\catroot2\dberr.txt

Filesize
149KB

MD5
23c80d155e245ba8a6ceeec50b15746f

SHA1
144ddad37dc61843d8fe01a112d50382649fb554

SHA256
4f129e2ab632a5d65ac76389303df9de0e5df39ad187b49b9bdc59a985cd3dad

SHA512
66e956fcdd5dbce6a71a35f160cc4a0023997159ca95e5e496aa72f52790f048c67c92254997443b7902835098a3971059cad56438e55d7e25fb7d1ef3d083ca

Download Submit
C:\Windows\System32\catroot2\edb.log

Filesize
2.0MB

MD5
7ee5c1f681b959b8eff0c3e54f46976d

SHA1
8c7e2f9ee17db5a80bbc0603baef87583a343901

SHA256
f1e74880a14afba83a83e5274bfc8d18d3a84f441976dcf781a9ef86de147f5d

SHA512
a017e55a70e7167313dcfb17d8e435d2e0b6556d8874bb4ce55c38bd19c182aa4f4f34afb7081d6abfa25456e6adf5fc9d854c5b8c0269e3c4ce8a53335d3e1f

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
814B

MD5
7f34ae4b60b3da7ababa8b129cc35fa6

SHA1
28e763c23fbdd863b41ca8ec9ee9460fb99fbfd6

SHA256
598e6c630e279f3dd1ee4fcfd77bdfce374a839fdbf5941b2ebece5c337f286f

SHA512
4917502265c4057e9888ef6d2f9a8cc2afb94be37f98fafd699ddcb619dd5170772129bc9d920f704098e5101789d4a11da04cdc24f338017e31f24cd0de71a1

Download Submit
memory/64-813-0x000001FE3C330000-0x000001FE3C331000-memory.dmp

Filesize
4KB

Download
memory/64-850-0x000001FE3EC70000-0x000001FE3EC71000-memory.dmp

Filesize
4KB

Download
memory/64-784-0x000001FE3B060000-0x000001FE3B061000-memory.dmp

Filesize
4KB

Download
memory/64-785-0x000001FE3B190000-0x000001FE3B191000-memory.dmp

Filesize
4KB

Download
memory/64-786-0x000001FE3B1B0000-0x000001FE3B1B1000-memory.dmp

Filesize
4KB

Download
memory/64-779-0x000001FE3AF80000-0x000001FE3AF81000-memory.dmp

Filesize
4KB

Download
memory/64-789-0x000001FE3B2E0000-0x000001FE3B2E1000-memory.dmp

Filesize
4KB

Download
memory/64-790-0x000001FE3BF70000-0x000001FE3BF71000-memory.dmp

Filesize
4KB

Download
memory/64-794-0x000001FE3C850000-0x000001FE3C851000-memory.dmp

Filesize
4KB

Download
memory/64-801-0x000001FE3C850000-0x000001FE3C851000-memory.dmp

Filesize
4KB

Download
memory/64-803-0x000001FE3CEF0000-0x000001FE3CEF1000-memory.dmp

Filesize
4KB

Download
memory/64-804-0x000001FE3DBD0000-0x000001FE3DBD1000-memory.dmp

Filesize
4KB

Download
memory/64-805-0x000001FE3DBD0000-0x000001FE3DBD1000-memory.dmp

Filesize
4KB

Download
memory/64-807-0x000001FE3B6B0000-0x000001FE3B6B1000-memory.dmp

Filesize
4KB

Download
memory/64-811-0x000001FE3E490000-0x000001FE3E491000-memory.dmp

Filesize
4KB

Download
memory/64-812-0x000001FE3E490000-0x000001FE3E491000-memory.dmp

Filesize
4KB

Download
memory/64-729-0x000001FE363A0000-0x000001FE363B0000-memory.dmp

Filesize
64KB

Download
memory/64-815-0x000001FE3E960000-0x000001FE3E961000-memory.dmp

Filesize
4KB

Download
memory/64-843-0x000001FE3EC70000-0x000001FE3EC71000-memory.dmp

Filesize
4KB

Download
memory/64-782-0x000001FE3B060000-0x000001FE3B061000-memory.dmp

Filesize
4KB

Download
memory/64-858-0x000001FE3F650000-0x000001FE3F651000-memory.dmp

Filesize
4KB

Download
memory/64-868-0x000001FE3BA70000-0x000001FE3BA71000-memory.dmp

Filesize
4KB

Download
memory/64-875-0x000001FE3BA70000-0x000001FE3BA71000-memory.dmp

Filesize
4KB

Download
memory/64-1015-0x000001FE40660000-0x000001FE40661000-memory.dmp

Filesize
4KB

Download
memory/64-1016-0x000001FE410B0000-0x000001FE410B1000-memory.dmp

Filesize
4KB

Download
memory/64-1017-0x000001FE410B0000-0x000001FE410B1000-memory.dmp

Filesize
4KB

Download
memory/64-1019-0x000001FE415A0000-0x000001FE415A1000-memory.dmp

Filesize
4KB

Download
memory/64-1020-0x000001FE42610000-0x000001FE42611000-memory.dmp

Filesize
4KB

Download
memory/64-1021-0x000001FE40970000-0x000001FE40971000-memory.dmp

Filesize
4KB

Download
memory/64-1023-0x000001FE42650000-0x000001FE42651000-memory.dmp

Filesize
4KB

Download
memory/64-1033-0x000001FE43010000-0x000001FE43011000-memory.dmp

Filesize
4KB

Download
memory/64-1037-0x000001FE42030000-0x000001FE42031000-memory.dmp

Filesize
4KB

Download
memory/64-1038-0x000001FE42030000-0x000001FE42031000-memory.dmp

Filesize
4KB

Download
memory/64-1040-0x000001FE443F0000-0x000001FE443F1000-memory.dmp

Filesize
4KB

Download
memory/64-778-0x000001FE3AF60000-0x000001FE3AF61000-memory.dmp

Filesize
4KB

Download
memory/64-777-0x000001FE3AE20000-0x000001FE3AE21000-memory.dmp

Filesize
4KB

Download
memory/64-775-0x000001FE3AE20000-0x000001FE3AE21000-memory.dmp

Filesize
4KB

Download
memory/64-753-0x000001FE3AA40000-0x000001FE3AA41000-memory.dmp

Filesize
4KB

Download
memory/64-745-0x000001FE3AD80000-0x000001FE3AD81000-memory.dmp

Filesize
4KB

Download
memory/64-735-0x000001FE36950000-0x000001FE36960000-memory.dmp

Filesize
64KB

Download