72a18c1e65869e5fce28667ce2b9069f9c180f4af3437193a12566fa1aa9d1a1

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
exe/start.bat
Size 310B
Sample240408-wp9jksff47
SHA256 c42232e5ca4f7518c308aafa94b09800d903537039efcc8ffc65645153bf0732
MD5 af849a50c84ba0d92b3ad0dbbfbc230c
SHA1 b69734ec33ff107f93b12a422f8571f0c3d9eb56
SHA512 d8e9634256d925f52aabd278056956b7450f22142dbab200c5d0f180ca5fa01cd89e4daa8633e8ada3c8aa6b3fb4a90dc655566f9cd59c5a80ad6edced85c442
MD5 SHA1 SHA512

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\8iysYFBai.README.txt

Ransom Note

~~ LockBit 3.0 the world's fastest and most stable ransomware from 2019~~~ >>>>> Your data is stolen and encrypted. BLOG Tor Browser Links: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/ http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/ http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/ http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/ http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/ http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/ http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/ >>>>> What guarantee is there that we won't cheat you? We are the oldest ransomware affiliate program on the planet, nothing is more important than our reputation. We are not a politically motivated group and we want nothing more than money. If you pay, we will fulfill all the terms we agree on during the negotiation process. Treat this situation simply as a paid training session for your system administrators, because it was the misconfiguration of your corporate network that allowed us to attack you. Our pentesting services should be paid for the same way you pay your system administrators salaries. You can get more information about us on Ilon Musk's Twitter https://twitter.com/hashtag/lockbit?f=live >>>>> You need to contact us on TOR darknet sites with your personal ID Download and install Tor Browser https://www.torproject.org/ Write to the chat room and wait for an answer, we'll guarantee a response from us. If you need a unique ID for correspondence with us that no one will know about, ask it in the chat, we will generate a secret chat for you and give you his ID via private one-time memos service, no one can find out this ID but you. Sometimes you will have to wait some time for our reply, this is because we have a lot of work and we attack hundreds of companies around the world. Tor Browser personal link for CHAT available only to you (available during a ddos attack): http://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid.onion Tor Browser Links for CHAT (sometimes unavailable due to ddos attacks): http://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd.onion http://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd.onion http://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid.onion http://lockbit7a2g6ve7etbcy6iyizjnuleffz4szgmxaawcbfauluavi5jqd.onion http://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd.onion http://lockbitb42tkml3ipianjbs6e33vhcshb7oxm2stubfvdzn3y2yqgbad.onion http://lockbitcuo23q7qrymbk6dsp2sadltspjvjxgcyp4elbnbr6tcnwq7qd.onion >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >> Your personal Black ID: CBCA8AEF72D1436919CC39C7E9BD657D << >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Warning! Do not delete or modify encrypted files, it will lead to problems with decryption of files! >>>>> Don't go to the police or the FBI for help and don't tell anyone that we attacked you.

URLs

http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
https://twitter.com/hashtag/lockbit?f=live
http://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid.onion
http://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd.onion
http://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd.onion
http://lockbit7a2g6ve7etbcy6iyizjnuleffz4szgmxaawcbfauluavi5jqd.onion
http://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd.onion
http://lockbitb42tkml3ipianjbs6e33vhcshb7oxm2stubfvdzn3y2yqgbad.onion
http://lockbitcuo23q7qrymbk6dsp2sadltspjvjxgcyp4elbnbr6tcnwq7qd.onion

Extracted

Path

C:\Users\Admin\Pictures\8iysYFBai.README.txt

Ransom Note

~~ LockBit 3.0 the world's fastest and most stable ransomware from 2019~~~ >>>>> Your data is stolen and encrypted. BLOG Tor Browser Links: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/ http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/ http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/ http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/ http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/ http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/ http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/ >>>>> What guarantee is there that we won't cheat you? We are the oldest ransomware affiliate program on the planet, nothing is more important than our reputation. We are not a politically motivated group and we want nothing more than money. If you pay, we will fulfill all the terms we agree on during the negotiation process. Treat this situation simply as a paid training session for your system administrators, because it was the misconfiguration of your corporate network that allowed us to attack you. Our pentesting services should be paid for the same way you pay your system administrators salaries. You can get more information about us on Ilon Musk's Twitter https://twitter.com/hashtag/lockbit?f=live >>>>> You need to contact us on TOR darknet sites with your personal ID Download and install Tor Browser https://www.torproject.org/ Write to the chat room and wait for an answer, we'll guarantee a response from us. If you need a unique ID for correspondence with us that no one will know about, ask it in the chat, we will generate a secret chat for you and give you his ID via private one-time memos service, no one can find out this ID but you. Sometimes you will have to wait some time for our reply, this is because we have a lot of work and we attack hundreds of companies around the world. Tor Browser personal link for CHAT available only to you (available during a ddos attack): http://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd.onion Tor Browser Links for CHAT (sometimes unavailable due to ddos attacks): http://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd.onion http://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd.onion http://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid.onion http://lockbit7a2g6ve7etbcy6iyizjnuleffz4szgmxaawcbfauluavi5jqd.onion http://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd.onion http://lockbitb42tkml3ipianjbs6e33vhcshb7oxm2stubfvdzn3y2yqgbad.onion http://lockbitcuo23q7qrymbk6dsp2sadltspjvjxgcyp4elbnbr6tcnwq7qd.onion >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >> Your personal Black ID: CBCA8AEF72D14369B180EA18B8BD5A61 << >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Warning! Do not delete or modify encrypted files, it will lead to problems with decryption of files! >>>>> Don't go to the police or the FBI for help and don't tell anyone that we attacked you.

URLs

http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
https://twitter.com/hashtag/lockbit?f=live
http://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd.onion
http://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd.onion
http://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd.onion
http://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid.onion
http://lockbit7a2g6ve7etbcy6iyizjnuleffz4szgmxaawcbfauluavi5jqd.onion
http://lockbitb42tkml3ipianjbs6e33vhcshb7oxm2stubfvdzn3y2yqgbad.onion
http://lockbitcuo23q7qrymbk6dsp2sadltspjvjxgcyp4elbnbr6tcnwq7qd.onion

Signatures

Renames multiple (148) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1996	20AA.tmp
216	338E.tmp

Loads dropped DLL 2 IoCs

pid	Process
2108	unimed1.exe
1672	unimed2.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini	unimed1.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini	unimed1.exe

Sets desktop wallpaper using registry 2 TTPs 4 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\8iysYFBai.bmp"	unimed2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\8iysYFBai.bmp"	unimed2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\8iysYFBai.bmp"	unimed1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\8iysYFBai.bmp"	unimed1.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs

pid	Process
2108	unimed1.exe
2108	unimed1.exe
2108	unimed1.exe
2108	unimed1.exe
2108	unimed1.exe
2108	unimed1.exe
1672	unimed2.exe
1672	unimed2.exe
1672	unimed2.exe
1672	unimed2.exe
1672	unimed2.exe
1672	unimed2.exe
216	338E.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.8iysYFBai\ = "8iysYFBai"	unimed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\8iysYFBai\DefaultIcon	unimed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\8iysYFBai\DefaultIcon\ = "C:\\ProgramData\\8iysYFBai.ico"	unimed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.8iysYFBai	unimed2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.8iysYFBai\ = "8iysYFBai"	unimed2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\8iysYFBai\DefaultIcon	unimed2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.8iysYFBai	unimed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\8iysYFBai	unimed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\8iysYFBai\DefaultIcon\ = "C:\\ProgramData\\8iysYFBai.ico"	unimed2.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1668	NOTEPAD.EXE

Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs

pid	Process
2108	unimed1.exe
1672	unimed2.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2108	unimed1.exe
2108	unimed1.exe
2108	unimed1.exe
2108	unimed1.exe
2108	unimed1.exe
2108	unimed1.exe
2108	unimed1.exe
2108	unimed1.exe
2108	unimed1.exe
2108	unimed1.exe
1672	unimed2.exe
1672	unimed2.exe
1672	unimed2.exe
1672	unimed2.exe
1672	unimed2.exe
1672	unimed2.exe
1672	unimed2.exe
1672	unimed2.exe
1672	unimed2.exe
1672	unimed2.exe
1672	unimed2.exe
1672	unimed2.exe
1672	unimed2.exe
1672	unimed2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2664	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeDebugPrivilege	2108	unimed1.exe
Token: 36	2108	unimed1.exe
Token: SeImpersonatePrivilege	2108	unimed1.exe
Token: SeIncBasePriorityPrivilege	2108	unimed1.exe
Token: SeIncreaseQuotaPrivilege	2108	unimed1.exe
Token: 33	2108	unimed1.exe
Token: SeManageVolumePrivilege	2108	unimed1.exe
Token: SeProfSingleProcessPrivilege	2108	unimed1.exe
Token: SeRestorePrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeSystemProfilePrivilege	2108	unimed1.exe
Token: SeTakeOwnershipPrivilege	2108	unimed1.exe
Token: SeShutdownPrivilege	2108	unimed1.exe
Token: SeDebugPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	380	vssvc.exe
Token: SeRestorePrivilege	380	vssvc.exe
Token: SeAuditPrivilege	380	vssvc.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeSecurityPrivilege	2108	unimed1.exe
Token: SeBackupPrivilege	2108	unimed1.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 2108	1920	cmd.exe	29
PID 1920 wrote to memory of 2108	1920	cmd.exe	29
PID 1920 wrote to memory of 2108	1920	cmd.exe	29
PID 1920 wrote to memory of 2108	1920	cmd.exe	29
PID 2108 wrote to memory of 1996	2108	unimed1.exe	34
PID 2108 wrote to memory of 1996	2108	unimed1.exe	34
PID 2108 wrote to memory of 1996	2108	unimed1.exe	34
PID 2108 wrote to memory of 1996	2108	unimed1.exe	34
PID 2108 wrote to memory of 1996	2108	unimed1.exe	34
PID 1920 wrote to memory of 1672	1920	cmd.exe	35
PID 1920 wrote to memory of 1672	1920	cmd.exe	35
PID 1920 wrote to memory of 1672	1920	cmd.exe	35
PID 1920 wrote to memory of 1672	1920	cmd.exe	35
PID 1672 wrote to memory of 216	1672	unimed2.exe	36
PID 1672 wrote to memory of 216	1672	unimed2.exe	36
PID 1672 wrote to memory of 216	1672	unimed2.exe	36
PID 1672 wrote to memory of 216	1672	unimed2.exe	36
PID 1672 wrote to memory of 216	1672	unimed2.exe	36
PID 216 wrote to memory of 3036	216	338E.tmp	37
PID 216 wrote to memory of 3036	216	338E.tmp	37
PID 216 wrote to memory of 3036	216	338E.tmp	37
PID 216 wrote to memory of 3036	216	338E.tmp	37
PID 2664 wrote to memory of 1668	2664	rundll32.exe	53
PID 2664 wrote to memory of 1668	2664	rundll32.exe	53
PID 2664 wrote to memory of 1668	2664	rundll32.exe	53

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\exe\start.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Users\Admin\AppData\Local\Temp\exe\unimed1.exe
  unimed1.exe -pass 578a910096ddcfe92e7f3e593fcd7a0c
  2⤵
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Sets desktop wallpaper using registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies registry class
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\ProgramData\20AA.tmp
    "C:\ProgramData\20AA.tmp"
    3⤵
    - Executes dropped EXE
    PID:1996
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\20AA.tmp >> NUL
      4⤵
      PID:892
- C:\Users\Admin\AppData\Local\Temp\exe\unimed2.exe
  unimed2.exe -pass 437fdd5d964fa4aae89f67b5ac2bcbf3
  2⤵
  - Loads dropped DLL
  - Sets desktop wallpaper using registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies registry class
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\ProgramData\338E.tmp
    "C:\ProgramData\338E.tmp"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of WriteProcessMemory
    PID:216
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\338E.tmp >> NUL
      4⤵
      PID:3036

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:380

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2780

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" F:\A0EAFD22\8iysYFBai.README.txt
1⤵
PID:2916

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x148
1⤵
PID:1304

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\RenameWrite.avi.8iysYFBai
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RenameWrite.avi.8iysYFBai
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini

Path C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini
Size 129B
SHA256 cc1880fe000de366d915427aee9e2e482b71d37ee502c888a3b9172b7f648a78
MD5 eef25374bfbb7c73c12b933014a9fdeb
SHA1 85eccf9c413a82dd3c3ce6fe9f5ccfcb07c9c9b3
SHA512 9396f45f3cc1d7f13b35ae19c14dbc80f6f5f4ce5acbf601c62dfd74dafed5b7653a5bd5a9133b9a7f872a8b60bafdbb1cfedc209fbebcb5e3aabd8191e3e6ac
MD5 SHA1 SHA512

Submit Download

8iysYFBai.ico

Path C:\ProgramData\8iysYFBai.ico
Size 14KB
SHA256 95e059ef72686460884b9aea5c292c22917f75d56fe737d43be440f82034f438
MD5 88d9337c4c9cfe2d9aff8a2c718ec76b
SHA1 ce9f87183a1148816a1f777ba60a08ef5ca0d203
SHA512 abafea8ca4e85f47befb5aa3efee9eee699ea87786faff39ee712ae498438d19a06bb31289643b620cb8203555ea4e2b546ef2f10d3f0087733bc0ceaccbeafd
SSDEEP 192:jpBaAlHSa2vU9G/8MMBD7O1lXFMB8VMJP7:jpjmkMYD7IFMRx7
MD5 SHA1 SHA512 SSDEEP

Submit Download

8iysYFBai.README.txt

Path C:\Users\8iysYFBai.README.txt
Size 3KB
SHA256 a34b91375f2c49723567eb5fc5ccf0e5e1a60254960742fe33d2e3e6e90aa700
MD5 7c1d85ca0d52f28955b5cd3ad54908ae
SHA1 622f2bd195c5e41766b908c71d4b33df8e9d536e
SHA512 5cebbbd3a1d981142925b3829be6a78dc9d73305d473a0f8e96d150447702398262c657b545825d7188816e23a73cde54f601fd1d67a4ee2f7a0780f744b23b9
MD5 SHA1 SHA512

Submit Download

8iysYFBai.README.txt

Path C:\Users\Admin\Pictures\8iysYFBai.README.txt
Size 3KB
SHA256 5e9c4bbc25b5c2452d6a3626dd33ec6c052b93d812fa516587d4f007a5ead802
MD5 3cbbd2f4b502530aea06f8ed9ff56925
SHA1 aefefc0caaf47e2a11a5b28426ba3c339df83469
SHA512 33b55f4c0c4aba2975bb2088d773311dc6ef05fb8e7b0900fa8b5da724ccdaa88e786d39c49478dc4fc44314b6ccb7875ceff694cfd35942a016ad3cb6f245c5
MD5 SHA1 SHA512

Submit Download

ClearConvert.emz.8iysYFBai

Path C:\Users\Admin\Pictures\ClearConvert.emz.8iysYFBai
Size 764KB
SHA256 0b4df88366baccd004c831a0c2afdbce61af8671dababfe28ae6b7745f9bdc73
MD5 a6187dc1be29191487f383e811f21de1
SHA1 d021fe4276e2b081be588ac2e658ce9450e92d2f
SHA512 8624acd7e0c12c5d0d3e48e92750cd6ba192ca6324b9e42f985b013ab6a8b44f85bcd1e7aeb34add87c933dd8886497df7308ee9011f21d197253ce767cd8f3f
SSDEEP 12288:5bVWnPVE7+y90aZ5xd5+5z5sqWbPAN01kOJ+OVHKb4b6mgv725YwTjZJ/x:RkdPrCdY5z5s/ANKl+Eb6tqVPp
MD5 SHA1 SHA512 SSDEEP

Submit Download

ConnectMeasure.dib.8iysYFBai

Path C:\Users\Admin\Pictures\ConnectMeasure.dib.8iysYFBai
Size 827KB
SHA256 f89339e3e30bc56e25ed6ac888918a7eaabcfa7db660d675e983c21907d6e12a
MD5 56b5d9e23e48921585965c2829c668fc
SHA1 1fa8f1732ab9e7fa0f24fcdf8cc134ba1e5671fc
SHA512 de0735661282582b24a08d87a194b305d163617195643b5ccd9f272b2433dac05804eeda37c99e3ee54b4308ca317bd6fdc6dccfaf17d72346903f4d93ed029d
SSDEEP 24576:XZ46op/EABofOyNRgkVdxapiQCAkBjCDaAo:XZ4z9EABryYkV/gRTCtz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ConvertToSwitch.dxf.8iysYFBai

Path C:\Users\Admin\Pictures\ConvertToSwitch.dxf.8iysYFBai
Size 546KB
SHA256 83847f2b1ede586e21ee26724f357372b8376d00225626e6c5fecee1dc0e9c60
MD5 1dbee8e7d5e53b0081ef5015698ed89b
SHA1 1c7d3f773b52671452e1480757a7ba0e1e5e3477
SHA512 bf118bd165ea8605084314185d2ef26b7d1efd9624b56be44c394f054fea5706c5e489ba254fe756c91637d88afd74f3f85fea686fd56bdd58d91bf749a1915c
SSDEEP 12288:896o7gRdV9T8MRuaJgjVmTXxa6XKtZ4+zLQTBxYAHpIO:T9ZLJgj8jx3eZjLWHYAHp5
MD5 SHA1 SHA512 SSDEEP

Submit Download

DisableBackup.cr2.8iysYFBai

Path C:\Users\Admin\Pictures\DisableBackup.cr2.8iysYFBai
Size 452KB
SHA256 aa7946c0c508dee638332aa64cd15574513125c7cbd27e0baa14aea02554b5dd
MD5 5eb20c74f0f9153ac32dbd3ff60fcf15
SHA1 6664b22d42d94413daeefbb17bf7d65b248bc974
SHA512 bf9a442b244028571b2ed09bf2ad2f4084ced92584a705363a47fb36ab8c0d86092680884ed63002329118a8ebd3cf0826aceb9fd694b562b8c76d9151b83c83
SSDEEP 12288:C5U2R6wPQtb2whWioKmLe0La1CoqyGKBPChHJEZxnuSGeLiPZJ1bP:C5UZa8OrSxKhHmau0rl
MD5 SHA1 SHA512 SSDEEP

Submit Download

GrantCompare.svg.8iysYFBai

Path C:\Users\Admin\Pictures\GrantCompare.svg.8iysYFBai
Size 702KB
SHA256 dd51e03f2253892c09361847dd707cc0c72ab897bf37e9dbd3c413c284d4df08
MD5 a8edb552db5402492da890f02c8c71ac
SHA1 267a5a63703ef0cb6a2dc5ac9c79e43d6248b59d
SHA512 879909bac30920467b44bac277b87f007fd995fff28a8430c4b83181acd2671e6fdb732e140c1db46b9d623a7e08a8733b3d43f8d44cea66c8697d4e287a447c
SSDEEP 12288:vJihDF09qqjScPj95Gr5n+Jg02JBcSSkCNuo2Gd+XiHGIE:UF09RScPE5n+J2JBcSN+mIE
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallWait.jpg.8iysYFBai

Path C:\Users\Admin\Pictures\InstallWait.jpg.8iysYFBai
Size 296KB
SHA256 ed6956250d12b3c05a3e71e1f9c2acae854f04a403570dc7100ab5825e34d1a4
MD5 aca5aa5a7e3106d56b95ebbcf4d079db
SHA1 d56fc3110f3a6f23f31cde7ad5d83768fe2742cc
SHA512 35c11984857306e85f15d998e6f195ce5132821b8ea549013471c142e820537ff03e3a47ac5083be4268dee9c90562b143ba1110605f2e48be4b0799165a98e4
SSDEEP 6144:d+d8s7qFmCJ02z80F05GrU6UpwDEhdqZQTIZVyfEa/:odIoH2z7lw6ueUmwIC8a/
MD5 SHA1 SHA512 SSDEEP

Submit Download

JoinRevoke.svg.8iysYFBai

Path C:\Users\Admin\Pictures\JoinRevoke.svg.8iysYFBai
Size 421KB
SHA256 975583c7bd16ab096e628467cafb4982ce033ccfabb69b538a24bac5eae23d6f
MD5 6a1c30ac51d4ddeb4998de8464efef10
SHA1 b9bbcf0ea6e2d0c17fff31b0e4426bfed0afee3f
SHA512 0b735d9fd9481b2a75d9de2c7e7ee829568cf65a1671a9def08eed6770caa3d98566384d2390411983180345f3fc4ebbeaedfcab668bfa3eb06c7c59cf025c20
SSDEEP 12288:hNQcRt28Y65WI/MUg0G2dpcezRUinW/TUHBU4Gdd:hGqtg65W7Ug0G2vcgRUinW/T4UBd
MD5 SHA1 SHA512 SSDEEP

Submit Download

My Wallpaper.jpg.8iysYFBai

Path C:\Users\Admin\Pictures\My Wallpaper.jpg.8iysYFBai
Size 24KB
SHA256 f24acce51c04c9f8381fd85881fbdd466df214e9b6103dc1401fd758f329fcfe
MD5 f00b4f694253d88ab540e8b7fb215edf
SHA1 bd02d6145863a8109a6e4dd254254353b8ac32f1
SHA512 5fc37b7fe0db131f8b8baa9c3124af00cde3dc32d5b3dfdd95e58fb80b8551111885ee9a3e4f3c98d4c0fd5eb0aeff9353fcfe7e5fc31854d85b3855e93e43d9
SSDEEP 768:dsKM1VTNbirN1iVMviNJIHfQ6J58KK3xOATU95er:dsKMFbirjiV7IHfxJ5DKLTU9O
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReadNew.emf.8iysYFBai

Path C:\Users\Admin\Pictures\ReadNew.emf.8iysYFBai
Size 671KB
SHA256 126abf57138ce0159d9746872697c757a4b8edc2dde29bd99281a7ca204b81e3
MD5 2eb1cd0487821522bf06523adb7b829b
SHA1 5bfc1878d8b9cb55bcbbbb448fd08064a67b183a
SHA512 0b53d6788cc20b857df2805b26d610ea2a077fde3a3120dc9f8c4e4faa47e0fa42630fc174b75aa3378ea19ea764ec8014566ce516e128c0aa755dbb97b95158
SSDEEP 12288:sR2c/TEllNcRySwHs6l2MrPCERQEzSLT8U6N7/5IMKjXm5/LCaGShWi0uUi2Pp:sR268lCkJHrUg3e61BtiXm5eaGqWTuUV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Everywhere.search-ms.8iysYFBai

Path C:\Users\Admin\Searches\Everywhere.search-ms.8iysYFBai
Size 497B
SHA256 e99583b42002972ae60f35a8fb897ae793750117772666f6b471a8c0c5452c9a
MD5 f020a8c13e7ce24e055190163acd008a
SHA1 b8e03e6453e413ac7959235a71b9456cc7ac8056
SHA512 b1cb18551fbe5eef7e80a2c0590e5a16bf2ff3533e1be70506af93accf6a5a3bef1aedd5613ff21d51e3bd89510f6bc3bb0098e1dbe7ffc4f0f27074dbace240
MD5 SHA1 SHA512

Submit Download

Indexed Locations.search-ms.8iysYFBai

Path C:\Users\Admin\Searches\Indexed Locations.search-ms.8iysYFBai
Size 511B
SHA256 bb05ad45ea127a1c67d7834a9ce9426b33ca34826b148184b96df4b7095d6519
MD5 68c59bb778d69d5aa135026755f35646
SHA1 91945e7c8ac2c1c074b92e717a0fb9c6ff130e9d
SHA512 e2e924fc40b26596ed2d145cc4eba39685892677fdf0df84d7d6376aa87c51a2ff027107f06e3ea70310b0807119978522afc2d954c09e79773d4535e2c9f718
MD5 SHA1 SHA512

Submit Download

deployment.properties.8iysYFBai

Path C:\Users\Admin\deployment.properties.8iysYFBai
Size 1KB
SHA256 137d25ea9552837ae1aac3eac2c1bb4ba62da44eecf54f4282bfef1700ca8406
MD5 6d129f1fae835471dcd3a518025fdc34
SHA1 96ed1c5b878be5da44ce9539488e34b9a607e103
SHA512 be7abf6cacb146f2c06f7ef77086b7daac42fa83cc5c7717a1fc5bb13c7689bba21c3977dbd8bd74b3977a063f5141da13ae195f5533870e9976856fa8caa90a
MD5 SHA1 SHA512

Submit Download

vcredist2010_x64.log-MSI_vc_red.msi.txt.8iysYFBai

Path C:\vcredist2010_x64.log-MSI_vc_red.msi.txt.8iysYFBai
Size 363KB
SHA256 a9e52728416c4b329b618887aee6227558a8fb7f412a2a3ed94ea1d134572b95
MD5 8d3a693780798c079447cbcc15f6358b
SHA1 0f00fecc406e209cc197b887370708156e374098
SHA512 8871386b7b81e6dca5eff776aa0c0cd0f49a0c74d7b1055325f5e36610d48d4111f4778b10dd2876f1c87ffb3a41411763d270592407d8579f8e37549695b99f
SSDEEP 6144:DYtU8h6kwt1VDpUoq0KZdy9mtJ7oliLIr9pAB7lq9t5+FyROUT/xkSEC+hmiMmHm:cW8twTVDFqZtlo8I3AB7KDMUzx6hhm/D
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2010_x64.log.html.8iysYFBai

Path C:\vcredist2010_x64.log.html.8iysYFBai
Size 86KB
SHA256 6b7158d2d6072f3ded31f4684e339322c5c2f06aa52888fce5e3bac88673ba1a
MD5 544226d53ca6e080643a84883e70c6bd
SHA1 43aa19bdd850622310fc93b074927d9bf0d5d5be
SHA512 8824504d12825433f5b44959ad9ab69fea8a3779aa2d89917f2a51f7369489596fea6c852002b9ea2bec3d9c80f1c6063d324fbfce2903a3ad7a1d95bdbe7e4e
SSDEEP 1536:mPUjpznEgIqjZ4LwVcfx6n1a2/VS/w5fjLQrw8rsHjYoSZXVF5JQJzUroa13W:mPUdzjIwbaM7dvfPF8mYoSZXbQJz01m
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2010_x86.log-MSI_vc_red.msi.txt.8iysYFBai

Path C:\vcredist2010_x86.log-MSI_vc_red.msi.txt.8iysYFBai
Size 379KB
SHA256 24cf3f1fcce4391491f14d1bf61e584923a933d393052832ff9f49f740488905
MD5 8f6f9018130a1e751057b3b4bfbdd494
SHA1 86fb22634a29d22cfcba56a3504314794cd6cd43
SHA512 3798d8ed599b2a66f12ce19d16e1cf55435278471e215447c2f1d3316a0307a9fb248846bf3efa5df1b7d66dfdc5ed6e0d544a26aad9a2d4fc270cfda49abf99
SSDEEP 6144:8D742mcpnxaXSz3eh4NldOnMsZr7QNwfWPYOn98Xogj+GuLRbRKkQ9BuE2s:8DU2XpIXS6WNldkMsZr7KwfWPYOLg6n6
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2010_x86.log.html.8iysYFBai

Path C:\vcredist2010_x86.log.html.8iysYFBai
Size 82KB
SHA256 5ec724041c520d983d8f2e0cde78f4d342fa6f549a0d0a93812be6bcd76c4f3c
MD5 f150a467339ed8a72644ca2672c3f310
SHA1 b63a93f845b6184eeda1cb6e254dfe43855740d7
SHA512 d2091fff6d9f60afe06fdc04260cdd6491676c09ffd3805192c5717125f6ecaf3033ed6286cf71f1d8913d5468fbcfa98ead14d8da15a78d1bb74b1da4f8edd4
SSDEEP 1536:xbtl0nbk2frLlpNUVyU5vCorb/2TbH45j8ygWbEz5XBxqVjnwwpQSIKRN8Jz8x:x30nbPxqy6xsbejsgEz5XBmrwNswO
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2012_x64_0_vcRuntimeMinimum_x64.log.8iysYFBai

Path C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log.8iysYFBai
Size 165KB
SHA256 3f5e4147d9c0f6769e0e01619e17b78eb624f15c03496073280c3fca2563b6f0
MD5 6189764618c950f7eba3517ed1694190
SHA1 62a1f7522f93780dfb52a3e05b7256b12bb8ed7b
SHA512 eff1fadf82b1582ba92a9c3f286981926e421f6537f6ed2d1bbf7b6693f1db061e55fc4a9cd5d56e870415b419469ecf6a82dbf785593af48a695a1493258971
SSDEEP 3072:p4iVzEdMq1gWH/1CSgeT2Kassor4ScKR49WDr9D7VrLxNEv4T:p4GEbH/BPT2vJR2R4Urp7pbEy
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2012_x64_1_vcRuntimeAdditional_x64.log.8iysYFBai

Path C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log.8iysYFBai
Size 192KB
SHA256 4eb5b08576ef9d910ad99c4bd33f4ad72b809377140439e3a3b8345ae0e5cf5d
MD5 66d10cdca6539c2eadcedc1fe0ce5aef
SHA1 0636bacf8064e2792147bbb10ff1e188b15e159e
SHA512 f84edc3fab80d71e5b7a7b97c5b7927bedc0a9fe592503ec05845b1fc6602fe076e6e04a297936b0e20ae7654a06452316ba2fb7050e8ad453a8b05ce4151dbd
SSDEEP 3072:AYHmgYBFm/jJ6++PLB/Hsmeoi4SsJXTs2bHHP/stVFp3Q9tZJI1xI:AYG1BACPdsZoi4PJXTxHHgBgTDf
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2012_x86_0_vcRuntimeMinimum_x86.log.8iysYFBai

Path C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log.8iysYFBai
Size 168KB
SHA256 e136be5bdfbb32fb1a105ec40594ff809d19e7c137821a5f76bca60d5b727767
MD5 fb43e1885df19e6466f184aa94d03a18
SHA1 cf207ac13f62580bfdd227dedcf24d7d00dd49ad
SHA512 d9bef27694b12e3b91892f2957acd46b467f66afad46fecaf3af36ea02ab3968b7541b221971e525b5760fd760637ec50dbf77caee907b5028e9cf5bb6534ac6
SSDEEP 3072:oZ+xFI2aRRJYWpZfXaFC2NgeZaUTcV2MITvFhHnewnPujEM5GTHaXpgHslO/:oZuFI2aRR30iY0cv3XPXXT6XpgMq
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2012_x86_1_vcRuntimeAdditional_x86.log.8iysYFBai

Path C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log.8iysYFBai
Size 206KB
SHA256 8b485758629b93c11a4166313e0e5343e85e5df3a4b02f22890bdc09a47a02bb
MD5 79f44fb66169081ba53b00ae7fc8e5b0
SHA1 822ce36314216b05fae2ce75659aff39266469e0
SHA512 7f64ad37ed75daf614bd0f99c5e2aea80393019991f98f14e3834ca28b9ab0a583628c183a22fe66a517fb0c695cce2e763ba12890ae96cb597ac4f9281e06be
SSDEEP 6144:wcoL5n3R3OEuyVLsAIr+yDicTWlkqWj3Xk+E2uD9:ELrNuyVIDjWlA3jE7
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2013_x64_000_vcRuntimeMinimum_x64.log.8iysYFBai

Path C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log.8iysYFBai
Size 167KB
SHA256 5761caa878962caff0fb4d0c5a1b9dec44b89e73126d48b18954417825447178
MD5 40fab0130bc37abc735aa6b209fafcea
SHA1 93bd9034991780b751ce2ec48df1b4e924d82cbb
SHA512 fa0a2b5e91bca7d85d12e698c5fc1ce1e77e7094d28ca975ab604b91931aed1f3662be6b3940f8fa2d854e3e959a29349c86ff35a6f78cef1727a199b1b8b396
SSDEEP 3072:W8jVSz8zhpT1CjvcaOsyC0tEu9Q5AakGgdRDCDNViKsrmpysumTLUO57D1M6M61y:SehpTE0ttE5AaIKPumTLUO5/1MP6DrwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2013_x64_001_vcRuntimeAdditional_x64.log.8iysYFBai

Path C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log.8iysYFBai
Size 188KB
SHA256 edb92548ffb4612a7fc9c8f8637a1f6ba6fbb81e7d7cb9861959be80c3e37b15
MD5 33c18a3d9651d133558abcd6751709d0
SHA1 ce23d981eb156d5fafffa152597a7e35c417e2e7
SHA512 c6e349084b8882cee2b2a80f9e84db111750b8874ee8179ff15c15ac36eead220c57b34ed8bb1d38336c2f9369c3e42634e2932bd07cea24dc4c63628e5d9efa
SSDEEP 3072:nycAdgYTQeRZvhqjR9P9d+8/g75rG3e8yPYziPKDWneEX38/+DqFi4HHrL:nycAdgeQefwjRDo8sr6MWiPKDWtHtwnH
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2013_x86_000_vcRuntimeMinimum_x86.log.8iysYFBai

Path C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log.8iysYFBai
Size 168KB
SHA256 6b7547cba47b7a5366808278c46920e6a9a3aebd86c1810ddc09d2e2ad791462
MD5 cd767bf44c7a8e6f07bcba40d98f34c9
SHA1 4637b1ae32ea51a61447707ced76016c96cdbbec
SHA512 88d11bf7a936b2804c13ed155a8aaa8961691f65063bba728ad695ddaf49dd7486dadc0621e10a318005297a870ba92f9973104aa6f0d2fa65c70b322d4e7c1c
SSDEEP 3072:2Fc9o4cT9OTAsVfLAWGsKY+wwoC7up/td+2lMPzGVNE55z/aCif:h2OT1Vf0WGsv2oLtcr0w7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2013_x86_001_vcRuntimeAdditional_x86.log.8iysYFBai

Path C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log.8iysYFBai
Size 196KB
SHA256 74c0e5e6fff50bec193711a54fb024510cb52601992f545d2eb0dd018431c4e4
MD5 789fe5408c95d0f8ab7e425425c643bf
SHA1 36ce919031fa3f9efa8ba6ab38870bbe51a5a7be
SHA512 68b626ae2d8f9a8ea3251d1084d6d0ae74baa470352dd0fccdd22b42e832f049217afc2ccc33f9df004c6916db8645523ece066810c802875483eff975f18db4
SSDEEP 3072:GMvhvLzMty1Jh5bA5fham9HiFp27vxQiJdPjYgK17xIdMkR0ZDZNnDi/w:GW0tyh5b+fCFpExQIPU7n7kkNnf
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2022_x64_000_vcRuntimeMinimum_x64.log.8iysYFBai

Path C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log.8iysYFBai
Size 121KB
SHA256 9afce613ccae3e9c81333f450a8d2cdaa723911323f58acb4d79c7dd90f5df3c
MD5 9ecc9286f94615215826c48bf84241c6
SHA1 db9a388976f1b07dff341cc30af785cdfcea6e53
SHA512 087ae21ef5863b145cd9502579fbb8261042f440eac8e552767a1564c14fd4ff5642a94fcf5d3415565f248364438bddc27eec7d1c491c4bca41e5c22da4cff6
SSDEEP 3072:DZnY0n1jv1NNpqIG5XNrMOZ5dhyR8+PbllSrx3aqcDwU:DqQjvqMOZ5ORJZlSrx3aqcDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2022_x64_001_vcRuntimeAdditional_x64.log.8iysYFBai

Path C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log.8iysYFBai
Size 127KB
SHA256 8bf9f9566888077b9924b560178d7f123e272d7eacea1d1fc6a4950c094745f6
MD5 edf8ba550921d47e5a9136fde79bd20a
SHA1 3c1293746724a323f64010c56f8557b3256a046f
SHA512 a528d88471d3a4020731dff730d068cde73b74d18e9d99f10056101ae2d7d7afc63d008421e42c1d1163663e8af52ce8650264f531a6525d185ae16924c03e9b
SSDEEP 3072:Q8Hc2y0sbWqzW9iOLINSvlO1nm8vKJC2L5SMjzuzwT:hHJSzm8NSvlO1bvaC2L5JL
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2022_x86_001_vcRuntimeMinimum_x86.log.8iysYFBai

Path C:\vcredist2022_x86_001_vcRuntimeMinimum_x86.log.8iysYFBai
Size 121KB
SHA256 a79ded9d3f91df3e3fb67a8f3c37ad3146345df6ff9aa5695ff232ac90b9c436
MD5 47df9db7c82cb4964d8b74d8413aac13
SHA1 9693cf7d0ea36674f4802a9a19d41605e4464ec4
SHA512 e83a5ad4d932bf40c9404b589727eb6d4d8388781364d74a5457974840bca9c71161732694de7519190341fd7814788ed1708698b27b56833aee89f266d6a445
SSDEEP 3072:nm0Lh8IjrYAc8NES9Ff4B7tn8ML21/r9y:nB9NEAtNMBd891/5y
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2022_x86_002_vcRuntimeAdditional_x86.log.8iysYFBai

Path C:\vcredist2022_x86_002_vcRuntimeAdditional_x86.log.8iysYFBai
Size 133KB
SHA256 6ab2cc54e6d0d764b677990cc715c55dafc4908dfe705805d1e24c464d9ada75
MD5 1986bfd8bc499f9ab9b1491e7c14174f
SHA1 9f1f0dbd0a0c6daaad2e7211fe51da518a39873e
SHA512 c59f2f42c3c6d2dcab90fb5dcc3bf9aa4e79f3a3b9321139f28faf672223abb66d899d58c95899953efe6ba523dee43debef5e8b2be6d0205c4855be60091c51
SSDEEP 3072:01EG03vr9IaxWqd7Vjgd/XWD61Lo0DlS7b/zS8vLKEo:xuaxWqd7ad/b1XSH7S8mEo
MD5 SHA1 SHA512 SSDEEP

Submit Download

DDDDDDDDDDD

Path F:\$RECYCLE.BIN\S-1-5-21-2248906074-2862704502-246302768-1000\DDDDDDDDDDD
Size 129B
SHA256 338b84aea14a28d284b4499ae41470f035b755aee41dff0a55cd46a56234bc80
MD5 5e98ee701a68eef64c549d26f970ec70
SHA1 fd10d1f375c0e624c6bb95c0fbc7326307384a3e
SHA512 96a55471751acea0423917e26592745368fe0984d12a36ec7fcedb60ef083ea61f1966fd2d03bf62829adaef331a7bf1d9e789e3d5f23c4330c33d2f5fd955fd
MD5 SHA1 SHA512

Submit Download

20AA.tmp

Path \ProgramData\20AA.tmp
Size 14KB
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/216-366-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Download

memory/216-367-0x0000000000380000-0x00000000003C0000-memory.dmp

Download

memory/216-375-0x0000000000380000-0x00000000003C0000-memory.dmp

Download

memory/1672-280-0x0000000000930000-0x0000000000970000-memory.dmp

Download

memory/1996-278-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/1996-372-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/1996-400-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2108-0-0x0000000000D30000-0x0000000000D70000-memory.dmp

Download