cerber | 55a918aafeb2407c5d589ede0ff7a4d51d7503703a4d6fd6c236e675cff60c1a

Analysis

max time kernel
150s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe
Size

205KB
MD5

aeec04636219ce2624bbd934fa27ee06
SHA1

d4ce719cd75629a18d7d83d28e1d9627ae18d5db
SHA256

91aa1c3663df7271a7e9d5f5bc8330e85b525d2f78391e98a80b47971259882c
SHA512

17b3164f97c98f9a3fe58f0d3a401144d25f73a6f07f0503f788b167d4b65035aa736db0a6b2c4285f2e05a4cea66e50bf06397847c29404e694be03533f6258
SSDEEP

6144:3g1KQjoSSya+LkSP+x3SZ714hZuOY9shjyg:5SSypLP+NSZOhZunYug

Score

10^/10

cerber defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Music\# DECRYPT MY FILES #.txt

Family

cerber

Ransom Note

C E R B E R R A N S O M W A R E ######################################################################### Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great!!! You have turned to be a part of a big community #Cerber_Ransomware. ######################################################################### !!! If you are reading this message it means the software !!! "Cerber Ransomware" has been removed from your computer. ######################################################################### What is encryption? ------------------- Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. ######################################################################### Everything is clear for me but what should I do? ------------------------------------------------ The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !!! Any attempts to get back your files with the third-party tools can !!! be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. ######################################################################### !!! There are several plain steps to restore your files but if you do !!! not follow them we will not be able to help you, and we will not try !!! since you have read this warning already. ######################################################################### For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: 1. decrypt all your files; 2. work with your documents; 3. view your photos and other media; 4. continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. ######################################################################### There is a list of temporary addresses to go on your personal page below: _______________________________________________________________________ | | 1. http://cerberhhyed5frqa.xmfir0.win/74CD-BBFC-F62E-006F-58F5 | | 2. http://cerberhhyed5frqa.gkfit9.win/74CD-BBFC-F62E-006F-58F5 | | 3. http://cerberhhyed5frqa.305iot.win/74CD-BBFC-F62E-006F-58F5 | | 4. http://cerberhhyed5frqa.dkrti5.win/74CD-BBFC-F62E-006F-58F5 | | 5. http://cerberhhyed5frqa.cneo59.win/74CD-BBFC-F62E-006F-58F5 |_______________________________________________________________________ ######################################################################### What should you do with these addresses? ---------------------------------------- If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): 1. take a look at the first address (in this case it is http://cerberhhyed5frqa.xmfir0.win/74CD-BBFC-F62E-006F-58F5); 2. select it with the mouse cursor holding the left mouse button and moving the cursor to the right; 3. release the left mouse button and press the right one; 4. select "Copy" in the appeared menu; 5. run your Internet browser (if you do not know what it is run the Internet Explorer); 6. move the mouse cursor to the address bar of the browser (this is the place where the site address is written); 7. click the right mouse button in the field where the site address is written; 8. select the button "Insert" in the appeared menu; 9. then you will see the address http://cerberhhyed5frqa.xmfir0.win/74CD-BBFC-F62E-006F-58F5 appeared there; 10. press ENTER; 11. the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: 1. click the left mouse button on the first address (in this case it is http://cerberhhyed5frqa.xmfir0.win/74CD-BBFC-F62E-006F-58F5); 2. in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. ######################################################################### Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: 1. run your Internet browser (if you do not know what it is run the Internet Explorer); 2. enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; 3. wait for the site loading; 4. on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; 5. run Tor Browser; 6. connect with the button "Connect" (if you use the English version); 7. a normal Internet browser window will be opened after the initialization; 8. type or copy the address ________________________________________________________ | | | http://cerberhhyed5frqa.onion/74CD-BBFC-F62E-006F-58F5 | |________________________________________________________| in this browser address bar; 9. press ENTER; 10. the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. ######################################################################### Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. ######################################################################### Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. ######################################################################### If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. ######################################################################### Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.

URLs

http://cerberhhyed5frqa.xmfir0.win/74CD-BBFC-F62E-006F-58F5

http://cerberhhyed5frqa.gkfit9.win/74CD-BBFC-F62E-006F-58F5

http://cerberhhyed5frqa.305iot.win/74CD-BBFC-F62E-006F-58F5

http://cerberhhyed5frqa.dkrti5.win/74CD-BBFC-F62E-006F-58F5

http://cerberhhyed5frqa.cneo59.win/74CD-BBFC-F62E-006F-58F5

http://cerberhhyed5frqa.onion/74CD-BBFC-F62E-006F-58F5

Extracted

Path

C:\Users\Admin\Music\# DECRYPT MY FILES #.html

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Cerber Ransomware</title> <style> a { color: #47c; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #333; font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; } hr { background-color: #e7e7e7; border: 0 none; border-bottom: 1px solid #c7c7c7; height: 5px; margin: 30px 0; } li { padding: 0 0 7px 7px; } ol { padding-left: 3em; } .container { background-color: #fff; border: 1px solid #c7c7c7; margin: 40px; padding: 40px 40px 20px 40px; } .info, .tor { background-color: #efe; border: 1px solid #bda; display: block; padding: 0px 20px; } .logo { font-size: 12px; font-weight: bold; line-height: 1; margin: 0; } .tor { padding: 10px 0; text-align: center; } .warning { background-color: #f5e7e7; border: 1px solid #ebccd1; color: #a44; display: block; padding: 15px 10px; text-align: center; } </style> </head> <body> <div class="container"> <h3>C E R B E R   R A N S O M W A R E</h3> <hr> Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great!!! You have turned to be a part of a big community #Cerber_Ransomware. <hr> If you are reading this message it means the software "Cerber Ransomware" has been removed from your computer. <hr> <h3>What is encryption?</h3> Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. <hr> <h3>Everything is clear for me but what should I do?</h3> The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. Any attempts to get back your files with the third-party tools can be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. <hr> There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already. <hr> For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: <ol> <li>decrypt all your files;</li> <li>work with your documents;</li> <li>view your photos and other media;</li> <li>continue your usual and comfortable work at the computer.</li> </ol> If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. <hr> <div class="info"> There is a list of temporary addresses to go on your personal page below: <ol> <li><a href="http://cerberhhyed5frqa.xmfir0.win/74CD-BBFC-F62E-006F-58F5" target="_blank">http://cerberhhyed5frqa.xmfir0.win/74CD-BBFC-F62E-006F-58F5</a></li> <li><a href="http://cerberhhyed5frqa.gkfit9.win/74CD-BBFC-F62E-006F-58F5" target="_blank">http://cerberhhyed5frqa.gkfit9.win/74CD-BBFC-F62E-006F-58F5</a></li> <li><a href="http://cerberhhyed5frqa.305iot.win/74CD-BBFC-F62E-006F-58F5" target="_blank">http://cerberhhyed5frqa.305iot.win/74CD-BBFC-F62E-006F-58F5</a></li> <li><a href="http://cerberhhyed5frqa.dkrti5.win/74CD-BBFC-F62E-006F-58F5" target="_blank">http://cerberhhyed5frqa.dkrti5.win/74CD-BBFC-F62E-006F-58F5</a></li> <li><a href="http://cerberhhyed5frqa.cneo59.win/74CD-BBFC-F62E-006F-58F5" target="_blank">http://cerberhhyed5frqa.cneo59.win/74CD-BBFC-F62E-006F-58F5</a></li> </ol> </div> <hr> <h3>What should you do with these addresses?</h3> If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): <ol> <li>take a look at the first address (in this case it is <a href="http://cerberhhyed5frqa.xmfir0.win/74CD-BBFC-F62E-006F-58F5" target="_blank">http://cerberhhyed5frqa.xmfir0.win/74CD-BBFC-F62E-006F-58F5</a>);</li> <li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li> <li>release the left mouse button and press the right one;</li> <li>select "Copy" in the appeared menu;</li> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li> <li>click the right mouse button in the field where the site address is written;</li> <li>select the button "Insert" in the appeared menu;</li> <li>then you will see the address <a href="http://cerberhhyed5frqa.xmfir0.win/74CD-BBFC-F62E-006F-58F5" target="_blank">http://cerberhhyed5frqa.xmfir0.win/74CD-BBFC-F62E-006F-58F5</a> appeared there;</li> <li>press ENTER;</li> <li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: <ol> <li>click the left mouse button on the first address (in this case it is <a href="http://cerberhhyed5frqa.xmfir0.win/74CD-BBFC-F62E-006F-58F5" target="_blank">http://cerberhhyed5frqa.xmfir0.win/74CD-BBFC-F62E-006F-58F5</a>);</li> <li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet. <hr> Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address http://cerberhhyed5frqa.onion/74CD-BBFC-F62E-006F-58F5 in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. <hr> <h3>Additional information:</h3> You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. <hr> Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. <hr> If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. <hr> Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files. </div> </body> </html>

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Contacts a large (16386) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{5B76921C-F710-0C00-7C90-036FED3C4413}\\typeperf.exe\""	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{5B76921C-F710-0C00-7C90-036FED3C4413}\\typeperf.exe\""	typeperf.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	typeperf.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\typeperf.lnk	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\typeperf.lnk	typeperf.exe

Executes dropped EXE 2 IoCs

pid	Process
4184	typeperf.exe
408	typeperf.exe

Loads dropped DLL 6 IoCs

pid	Process
2824	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe
2824	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe
2824	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe
4184	typeperf.exe
4184	typeperf.exe
4184	typeperf.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\typeperf = "\"C:\\Users\\Admin\\AppData\\Roaming\\{5B76921C-F710-0C00-7C90-036FED3C4413}\\typeperf.exe\""	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\typeperf = "\"C:\\Users\\Admin\\AppData\\Roaming\\{5B76921C-F710-0C00-7C90-036FED3C4413}\\typeperf.exe\""	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\typeperf = "\"C:\\Users\\Admin\\AppData\\Roaming\\{5B76921C-F710-0C00-7C90-036FED3C4413}\\typeperf.exe\""	typeperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\typeperf = "\"C:\\Users\\Admin\\AppData\\Roaming\\{5B76921C-F710-0C00-7C90-036FED3C4413}\\typeperf.exe\""	typeperf.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	ipinfo.io

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp7E6.bmp"	typeperf.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2824 set thread context of 1292	2824	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe	86
PID 4184 set thread context of 408	4184	typeperf.exe	93

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe
File opened for modification	C:\Windows\	typeperf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000023436-54.dat	nsis_installer_1
behavioral2/files/0x0007000000023436-54.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3124	vssadmin.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
4016	taskkill.exe
1436	taskkill.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{5B76921C-F710-0C00-7C90-036FED3C4413}\\typeperf.exe\""	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop	typeperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{5B76921C-F710-0C00-7C90-036FED3C4413}\\typeperf.exe\""	typeperf.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	typeperf.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1028	PING.EXE
4576	PING.EXE

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
408	typeperf.exe
4916	msedge.exe
4916	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
3964	identity_helper.exe
3964	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeDebugPrivilege	1292	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe
Token: SeDebugPrivilege	4016	taskkill.exe
Token: SeDebugPrivilege	408	typeperf.exe
Token: SeBackupPrivilege	2688	vssvc.exe
Token: SeRestorePrivilege	2688	vssvc.exe
Token: SeAuditPrivilege	2688	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4596	wmic.exe
Token: SeSecurityPrivilege	4596	wmic.exe
Token: SeTakeOwnershipPrivilege	4596	wmic.exe
Token: SeLoadDriverPrivilege	4596	wmic.exe
Token: SeSystemProfilePrivilege	4596	wmic.exe
Token: SeSystemtimePrivilege	4596	wmic.exe
Token: SeProfSingleProcessPrivilege	4596	wmic.exe
Token: SeIncBasePriorityPrivilege	4596	wmic.exe
Token: SeCreatePagefilePrivilege	4596	wmic.exe
Token: SeBackupPrivilege	4596	wmic.exe
Token: SeRestorePrivilege	4596	wmic.exe
Token: SeShutdownPrivilege	4596	wmic.exe
Token: SeDebugPrivilege	4596	wmic.exe
Token: SeSystemEnvironmentPrivilege	4596	wmic.exe
Token: SeRemoteShutdownPrivilege	4596	wmic.exe
Token: SeUndockPrivilege	4596	wmic.exe
Token: SeManageVolumePrivilege	4596	wmic.exe
Token: 33	4596	wmic.exe
Token: 34	4596	wmic.exe
Token: 35	4596	wmic.exe
Token: 36	4596	wmic.exe
Token: SeIncreaseQuotaPrivilege	4596	wmic.exe
Token: SeSecurityPrivilege	4596	wmic.exe
Token: SeTakeOwnershipPrivilege	4596	wmic.exe
Token: SeLoadDriverPrivilege	4596	wmic.exe
Token: SeSystemProfilePrivilege	4596	wmic.exe
Token: SeSystemtimePrivilege	4596	wmic.exe
Token: SeProfSingleProcessPrivilege	4596	wmic.exe
Token: SeIncBasePriorityPrivilege	4596	wmic.exe
Token: SeCreatePagefilePrivilege	4596	wmic.exe
Token: SeBackupPrivilege	4596	wmic.exe
Token: SeRestorePrivilege	4596	wmic.exe
Token: SeShutdownPrivilege	4596	wmic.exe
Token: SeDebugPrivilege	4596	wmic.exe
Token: SeSystemEnvironmentPrivilege	4596	wmic.exe
Token: SeRemoteShutdownPrivilege	4596	wmic.exe
Token: SeUndockPrivilege	4596	wmic.exe
Token: SeManageVolumePrivilege	4596	wmic.exe
Token: 33	4596	wmic.exe
Token: 34	4596	wmic.exe
Token: 35	4596	wmic.exe
Token: 36	4596	wmic.exe
Token: 33	2536	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2536	AUDIODG.EXE
Token: SeDebugPrivilege	1436	taskkill.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 1292	2824	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe	86
PID 2824 wrote to memory of 1292	2824	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe	86
PID 2824 wrote to memory of 1292	2824	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe	86
PID 2824 wrote to memory of 1292	2824	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe	86
PID 2824 wrote to memory of 1292	2824	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe	86
PID 2824 wrote to memory of 1292	2824	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe	86
PID 2824 wrote to memory of 1292	2824	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe	86
PID 2824 wrote to memory of 1292	2824	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe	86
PID 2824 wrote to memory of 1292	2824	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe	86
PID 1292 wrote to memory of 4184	1292	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe	87
PID 1292 wrote to memory of 4184	1292	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe	87
PID 1292 wrote to memory of 4184	1292	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe	87
PID 1292 wrote to memory of 1348	1292	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe	88
PID 1292 wrote to memory of 1348	1292	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe	88
PID 1292 wrote to memory of 1348	1292	Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe	88
PID 1348 wrote to memory of 4016	1348	cmd.exe	90
PID 1348 wrote to memory of 4016	1348	cmd.exe	90
PID 1348 wrote to memory of 4016	1348	cmd.exe	90
PID 1348 wrote to memory of 1028	1348	cmd.exe	92
PID 1348 wrote to memory of 1028	1348	cmd.exe	92
PID 1348 wrote to memory of 1028	1348	cmd.exe	92
PID 4184 wrote to memory of 408	4184	typeperf.exe	93
PID 4184 wrote to memory of 408	4184	typeperf.exe	93
PID 4184 wrote to memory of 408	4184	typeperf.exe	93
PID 4184 wrote to memory of 408	4184	typeperf.exe	93
PID 4184 wrote to memory of 408	4184	typeperf.exe	93
PID 4184 wrote to memory of 408	4184	typeperf.exe	93
PID 4184 wrote to memory of 408	4184	typeperf.exe	93
PID 4184 wrote to memory of 408	4184	typeperf.exe	93
PID 4184 wrote to memory of 408	4184	typeperf.exe	93
PID 408 wrote to memory of 3124	408	typeperf.exe	94
PID 408 wrote to memory of 3124	408	typeperf.exe	94
PID 408 wrote to memory of 4596	408	typeperf.exe	98
PID 408 wrote to memory of 4596	408	typeperf.exe	98
PID 408 wrote to memory of 4284	408	typeperf.exe	106
PID 408 wrote to memory of 4284	408	typeperf.exe	106
PID 4284 wrote to memory of 4860	4284	msedge.exe	107
PID 4284 wrote to memory of 4860	4284	msedge.exe	107
PID 408 wrote to memory of 2232	408	typeperf.exe	108
PID 408 wrote to memory of 2232	408	typeperf.exe	108
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109
PID 4284 wrote to memory of 4472	4284	msedge.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe
"C:\Users\Admin\AppData\Local\Temp\Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Users\Admin\AppData\Local\Temp\Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe
  "C:\Users\Admin\AppData\Local\Temp\Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe"
  2⤵
  - Adds policy Run key to start application
  - Drops startup file
  - Adds Run key to start application
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Users\Admin\AppData\Roaming\{5B76921C-F710-0C00-7C90-036FED3C4413}\typeperf.exe
    "C:\Users\Admin\AppData\Roaming\{5B76921C-F710-0C00-7C90-036FED3C4413}\typeperf.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4184
  - - C:\Users\Admin\AppData\Roaming\{5B76921C-F710-0C00-7C90-036FED3C4413}\typeperf.exe
      "C:\Users\Admin\AppData\Roaming\{5B76921C-F710-0C00-7C90-036FED3C4413}\typeperf.exe"
      4⤵
      Adds policy Run key to start application
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Sets desktop wallpaper using registry
      Modifies Control Panel
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:408
    - - C:\Windows\system32\vssadmin.exe
        
        "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:3124
    - - C:\Windows\system32\wbem\wmic.exe
        
        "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4284
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e43546f8,0x7ff8e4354708,0x7ff8e4354718
        6⤵
        
        PID:4860
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,12221037428083736103,8146753274684714589,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
        6⤵
        
        PID:4472
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,12221037428083736103,8146753274684714589,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4916
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,12221037428083736103,8146753274684714589,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
        6⤵
        
        PID:364
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12221037428083736103,8146753274684714589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
        6⤵
        
        PID:2804
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12221037428083736103,8146753274684714589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
        6⤵
        
        PID:4660
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12221037428083736103,8146753274684714589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
        6⤵
        
        PID:4108
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,12221037428083736103,8146753274684714589,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:8
        6⤵
        
        PID:5072
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,12221037428083736103,8146753274684714589,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3964
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12221037428083736103,8146753274684714589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
        6⤵
        
        PID:708
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12221037428083736103,8146753274684714589,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
        6⤵
        
        PID:3000
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12221037428083736103,8146753274684714589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
        6⤵
        
        PID:4976
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12221037428083736103,8146753274684714589,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
        6⤵
        
        PID:2892
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12221037428083736103,8146753274684714589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4320 /prefetch:1
        6⤵
        
        PID:640
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12221037428083736103,8146753274684714589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
        6⤵
        
        PID:4560
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12221037428083736103,8146753274684714589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
        6⤵
        
        PID:2424
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
        5⤵
        
        PID:2232
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cerberhhyed5frqa.xmfir0.win/74CD-BBFC-F62E-006F-58F5
        5⤵
        
        PID:4460
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e43546f8,0x7ff8e4354708,0x7ff8e4354718
        6⤵
        
        PID:288
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
        5⤵
        
        PID:1164
    - - C:\Windows\system32\cmd.exe
        
        /d /c taskkill /t /f /im "typeperf.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{5B76921C-F710-0C00-7C90-036FED3C4413}\typeperf.exe" > NUL
        5⤵
        
        PID:2708
      - C:\Windows\system32\taskkill.exe
        
        taskkill /t /f /im "typeperf.exe"
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1436
      - C:\Windows\system32\PING.EXE
        
        ping -n 1 127.0.0.1
        6⤵
        Runs ping.exe
        
        PID:4576
- - C:\Windows\SysWOW64\cmd.exe
    /d /c taskkill /t /f /im "Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe" > NUL
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1348
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /t /f /im "Amelia_Lily_09.06.2016_our_go-go_party-photos__only_for-you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4016
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1028

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2712

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x524 0x4f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4770b557b5356043d3155be4737bdcc1

SHA1
e3549c50a645e0097f5c21168a722f93c33b4d32

SHA256
21fc1b00fa608a735aac591d7d22ea9973555fbe925bb154989f2ecbb31b9848

SHA512
2dcfc89864b61961c7a1df02845b8cd0508af91c47eee90295e7991b9597097191b853208b415ab80593df9f895c8c9ccc1d112df710c7cd815dab1df9279c95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e722ac49011cb582c7093cfe257c03d2

SHA1
02f511b2e46421bc12f2f8a19393fdbc0fca047b

SHA256
fa8f7d1b01bbc3167d89fbafdf9886f8a1e99a089a802312814ee71f0bb2d40c

SHA512
c46296726cc7d63b5f0c846f3a85a599ecb4e29a90ec5ef724d8564d173e46ab203750c780b7772b7c44c3b5d707d7c2ef4f189d72368c4ca8a8ea63e8e214f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
5167dc482213197f8e482c310a4bd20f

SHA1
d673948a3a343eafbb699d482d9a55b34962b113

SHA256
6bee82edee42a22bdce46f5f682233b5dde25e86a9fc2ca4f994d97a74413eaf

SHA512
7f78ce1bed14f9e3e2d5410fa42bb3f0574cda4d5ea025ddf1178b3d3349401bf62d7ae45a0af130771c5238222f6cff24076bf144787458a5dff207b7fcf954

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg49DB.tmp\System.dll

Filesize
11KB

MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b

SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785

SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

Download Submit
C:\Users\Admin\AppData\Roaming\3BSYBS1_DDVW_ErrLog.txt

Filesize
621B

MD5
407e5794f68312fbda6a01650564e639

SHA1
9ee6003d97ef08c720dc595f6f91535c2e0c355d

SHA256
745a963cffc0c4af906083ac72407e3560c78d76bf0f946ff98e7a05812b16dc

SHA512
a786e81f170e9ab4e067be4053e046d049f502853e227207e8e6688a928bded4432c65f3f991981e45169fba72c551bfcfb209ec9a5fdeae4b6a80c17d18c918

Download Submit
C:\Users\Admin\AppData\Roaming\3BSYBS1_DDVW_ErrLog.txt

Filesize
213B

MD5
05e08ba0c877e3ea6fc448287ef15c2a

SHA1
f6a35bb39e7d722f8e810abe3af69bdf36b0ac39

SHA256
39480726bf17fc68a78df4aab500815a249eba9756709bb8cb98807b9c115911

SHA512
8ca6211d206bcc48c3b79a684eeb110bcc05981fbd0fd11dd17277d8fa9eb34ddd56b6116c7d0701810a3c2eed38eb61bc33da7219cf720c5d1ca2b71c761dad

Download Submit
C:\Users\Admin\AppData\Roaming\401-2.htm

Filesize
1KB

MD5
b15a2a53249dd89c355042688fca2f0a

SHA1
7fb9ee35b128ec49babc26929e5706318fb5b961

SHA256
c79b8c6820105329bb3d20695aa040cfcf413ac3e4ddc3186cc915f4c67fd6b9

SHA512
690e92d7a9ef378172fd092ae320642bbd51e76007ae20e364765527fbd69b27b7fc7e6c3783fa276f5f6343281559051a96766ca8001aab24208910d2a1268c

Download Submit
C:\Users\Admin\AppData\Roaming\404-4.htm

Filesize
1KB

MD5
47b31ceaa4ee437bcb996584938f55ca

SHA1
00a04f6b1d3a6efcd1c2e24898d08e20c5ceee64

SHA256
c24863f16c118fba14e5cff2beaad3f9bd0017d3f55800837398d5518534207a

SHA512
2add86690e8aff4e905d4c09816fdb1b084c3d69bbdb5a0da347de625c55f11dc12e719c841d6aabbb7e0350170077a628b577aa1aa569b39b4764143cd0627e

Download Submit
C:\Users\Admin\AppData\Roaming\BMY red 2.ADO

Filesize
524B

MD5
35f62b8eb95ec116179704744ce39969

SHA1
e6c37b72f68529a45747d2d1eb9a1510871aa427

SHA256
367ac0c297b01eadc7331944b53d8af5dd30af6bbc448b94dea521c79fe25b40

SHA512
adca617c7a17b02c879ed13e1a276949e62c026d2519316417aba416a82d78eec9defd91a9316967f11a7cb9c3ff1569da42def9d5a0da6642f455b2b95e420a

Download Submit
C:\Users\Admin\AppData\Roaming\BMY sepia 4.ADO

Filesize
524B

MD5
b7d52af4e4d97f2b910016cacd3b88a2

SHA1
889654a50507687696ace74156e127552fc859ca

SHA256
dc88014d374621b92719bb8bdfd58694626a9dee05ebb19d0ca5549498f81852

SHA512
20e9c9091b28e5b8ba1f087b44259c90e4520100bdaf5d3fa19830e4d2e23afe8d7bbe02e445c9c21a441cb3fbe2e2f676ff328780606e59f929c5e39b6ecc0a

Download Submit
C:\Users\Admin\AppData\Roaming\Beirut

Filesize
1KB

MD5
5e95a02599846d5ff04ed92d4e58c754

SHA1
a177f2fc7a49a503c460a9d676e64d3bf1f24f00

SHA256
0166b2d6305b1584f54a9935581500a7d8b7ce800fad83d757b05c27f3f2cf29

SHA512
c2b941bc9d1b8160ab8c2cbc545f459ba64c9461cf7904b5dc7d0ac6f38b209fc8ec100e8cd9635985167c3ad042c213132a31ab608a554604f9b6e22d11aca8

Download Submit
C:\Users\Admin\AppData\Roaming\Ceuta

Filesize
1KB

MD5
ffcdcb20bd0798d3a424d11cb66cb889

SHA1
dc6a7ab6705b3dc39ac17f789b618fcf778fc33e

SHA256
d46d741412eedb69a13f292affbfb9b6cd1c5d18cee9bae789f5198cc766800b

SHA512
89d18ed4f271db9d9e42c7138e668fbca50f98b9b83865a5293882195f2289aeadd4c09dc64b01f1d794aa25a27d46674e6d349df4aabdfe264e982346425e59

Download Submit
C:\Users\Admin\AppData\Roaming\CommandCenter.exe.config

Filesize
4KB

MD5
ae3bb346a1a75db1285e245c08f7d8c5

SHA1
946b30b8ce5fa38cd566001da20ec500f70201b4

SHA256
dcd46f1564efdbdaf490247629a22acc5761d60965682b7132735e42959f6f8a

SHA512
eafdb6832ca09aa0e2e46bf927706aca1b13a14ae70e6e366e5df0a8c25fd8a5594c2bfa3b34f3ff1455308826142d88f48d898805d6861e7e1ccd075099a29e

Download Submit
C:\Users\Admin\AppData\Roaming\CommandCenter.exe.config

Filesize
4KB

MD5
784eb6aef7fc6a110bc4d0ad68c73fc7

SHA1
57296e660cd407bd344c0aa3ba5ba801dc100d53

SHA256
37754e821fec9db336ff9686fddc22286779b16a70b5f4c9cc03f00ebdd090c2

SHA512
745d2d915f92ccfd31ed6c50fd036f4d45a305d8f6aedaafab5493a8a19520dbf45c3e7ca9d5e5fab71e9f5fe1206ef461d89939c5ba7eea6cd676737008228d

Download Submit
C:\Users\Admin\AppData\Roaming\Cool Gray 7 bl 3.ADO

Filesize
524B

MD5
6c55602d113c4ae021a2f9d39e31b91c

SHA1
0ead8715297d1fa05cf511f41e284b4620fdb1e8

SHA256
82e20ebd46ee61262bb8b8053704ef164d53adcf325bdef1cbd285de7f5df470

SHA512
8cc1a4f4ebee4c5bfb7059d7f10470343ff16269b41f8c7fb2a6ebb75ce55ca8faaeb4c465365deac9af6c5cfc84055114fad5b8a0ca9bca8ce4f0507263e4fc

Download Submit
C:\Users\Admin\AppData\Roaming\Cordoba

Filesize
549B

MD5
3d71e7ec338b110bef71cbc6996c6d9c

SHA1
d80d9bc1829d2d71685a209261c3f0e76f03d3b0

SHA256
0801a5431e97bd05131d57ba124ca2ca5b1050049290215e94719a01da941a3f

SHA512
26b36adcfa7d4c41dab8fbbeaa627731f8d760de16c03a3904f62ec106a0a381e0e8262b81f310ee6bb389ce98135b351b89c8f6adb2602c80c168f84b295141

Download Submit
C:\Users\Admin\AppData\Roaming\EmbeddingExampleXML2PDF.png

Filesize
2KB

MD5
3cf6648cd274555e8f3bfa3a7d9ffa1c

SHA1
af230c42ba68f8e30bc391126131ce021dfd9dc2

SHA256
5bf738037dfe60941220fc5d6673d775b8e8563a60ae60e90f211c56cfae993e

SHA512
7f38777433e26e1313a6b545f7f12271742d86c9b236f7beb9d8cf8f0c0db3387c2206b24e0127cb2f90048e1746d37e1dc0e6d409d66162f1eeb71608e7c3c2

Download Submit
C:\Users\Admin\AppData\Roaming\Glace_Bay

Filesize
1KB

MD5
7055bea372b3c051d20dee039d325eaf

SHA1
78df1610e4e45a9ff7971da6bd4a1519046c14d0

SHA256
15cf22d121ae8f64f2af3bc2491297880951e4b101beee16db2ad2d7da80ee9d

SHA512
603197442ec069a51f8ceb9685523ee912d7431085f69e2441cc9ebf6759f2341684ad3e22bd5c75adf1125b381cd064f9515a77e975fa07a922c67ccc198364

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\typeperf.lnk

Filesize
1KB

MD5
c1a709d6bfa77cd4b5459ce62e78d60a

SHA1
acb554ff2a6e84a9854992e0f09219a9026dced7

SHA256
0b373aea76bad9827f4259cd0c96ed64873010077281b070d59753558500bff8

SHA512
37e308b75652bdd4608645c9501c131b6c2d5ce86a9517de604cafd591df430ff3d1ca2cee85ce7582da26de04e5969e3e7f21a4c3c145ee0dc7922bccd8f54c

Download Submit
C:\Users\Admin\AppData\Roaming\NurlHatpin.5

Filesize
1KB

MD5
d7843418181016cff8d42574edcbac97

SHA1
80ae28e05d71297408327885ce7544a3883e81ff

SHA256
9c9c54daf631f11cf9a0f2bf04c11dc900ed15e463d1e508fd5a1d44d6d475a0

SHA512
c27f99735af201ac306970ef3189f0e40745710a38e20aafaeb22e6ab8675615382b2dc33b17968a4f8346e251aa07049d06cbd8bbfbe499c59f559ca58f9f99

Download Submit
C:\Users\Admin\AppData\Roaming\Nwiz.dll

Filesize
73KB

MD5
ed295ad146bac227c65f7f52abaa77eb

SHA1
7d74e721bfcd635a184b75c47459bafcb666e435

SHA256
ec531ae2f1a55dd30ed40f235bbc79911dd58f8a7468b5d5c8310ab1e7e3eb28

SHA512
f79e076149530cab979889b76fc6e9543c7eefef5ed8ba79655e62d0ebf6251419ad5ccb63eff8558b78cc88ee43f7aeac1068b1b628f23f84f5be40cc67dcbe

Download Submit
C:\Users\Admin\AppData\Roaming\app_updater_smartbutton_focus.png

Filesize
3KB

MD5
e4ea8e9278fcc51961ff1d32949204ce

SHA1
c45e17beb3511c3104956db2dfa060ecf653fbe7

SHA256
67cb6f80d47be05f99eaf7b532a5f881cc23cc80dbfe3edb6f2e3aa6418f04eb

SHA512
d7897e67559d6d22a8aec791d852046a577be6700e639a75a996e2fa62dc653b57221a6ccce3e9bec4fbd564820e519506c9799213ccadb8ce96b7fdf08863ae

Download Submit
C:\Users\Admin\AppData\Roaming\arrow.png

Filesize
1KB

MD5
6a44b564542fbe1befab8102a0900e36

SHA1
baa8efb5fcd969e03097fcbc4130f91ea5b97acb

SHA256
5c026b26a4698ec9cb2138210d6f7c7702b1b5111214e4a59b92946784605cd4

SHA512
4cca6c543154c879e98c9b309b2636804996d851bc7f926c0cab2abcc89d0d2a8ae1b09d225d2834f967e6f6cc334a47b78b2c55f16e9da8ca67eca486f1a0b6

Download Submit
C:\Users\Admin\AppData\Roaming\blurb.on.titlepage.enabled.xml

Filesize
1KB

MD5
3ac941ea4fc59b792b7b516463bb1f1f

SHA1
28834123bc7adfa90d2410a20e8560f1afb0129c

SHA256
784819b94dc42646be7f771553ae6c4a040382d0b07d735f53c33c40dba5cecf

SHA512
8992d55fbc869922ff3e85b91d65de2d7568ba29bd330118c73427955ff7daca2f47ece1bc943a56c5e0bd1ae6e850545e77be783f7310018a9943b8166b94db

Download Submit
C:\Users\Admin\AppData\Roaming\blurb.on.titlepage.enabled.xml

Filesize
1KB

MD5
4f5755a5a8321a3d69eeff8f33732ee8

SHA1
d0ec23d3817eca08fe7b39dadc78f7151c945cb8

SHA256
07eefccf7c826d8decb85ae62e9b2795ae09854e92e4b9ec9f60731943faad46

SHA512
0663758da34f1db7d86490f3979114a2e838318f90808a4587913af1e2af8c85fe97a83638fe9ac073d8cd6ae9cf69e67f70437e9380b1aad9812e09102b6730

Download Submit
C:\Users\Admin\AppData\Roaming\callout.graphics.xml

Filesize
1KB

MD5
e2e34c8b10a52f1490c8d4a3306a112c

SHA1
686b4328930cff2e01853759d8dc801f2a86d6a7

SHA256
e87ad1d3c3babb6bb18126de9022610586c439a36df94b368097671b4edd0abc

SHA512
c1896447e65d981ba1ad26afb423096d7c526ce25815f6f616923726df56c5e7abd8739306f68f468679bb920dc6af8672c133cd0d15bd841c3c7a148a7cf9ac

Download Submit
C:\Users\Admin\AppData\Roaming\chapter.autolabel.xml

Filesize
2KB

MD5
7623f2b569ab91833cd345eead830e73

SHA1
e95ea6aa4880ed4d5616d1766d514541c815b0e5

SHA256
4e5e5197a7baa85df15b2ab86932f8c90c24e4a1896f84e44c263f1af46bde43

SHA512
d31796f75db3c503c78298d16eef50700a57899f473a2ee3723899c6c0bd6c448c2b90270742f3b32446c0a105cb10beb2dafe81f4dd3b4dca7738a1dc674c98

Download Submit
C:\Users\Admin\AppData\Roaming\chapter.autolabel.xml

Filesize
2KB

MD5
f3154089d763db97db18894bf22a2720

SHA1
cfdc592a2ff87df89efd8b28f8d75226794f3f4e

SHA256
a49a3c03b314d467818f4fef501cd11844d996e66890ac51e34c2cf1076ec349

SHA512
1341a7b49929471ded7b89ff0546b75b482602bccbd7114435595fd292ecc9f598d51f1f85813e2db43054c988c13a23abf41c8ce20c314537221c5e802034b1

Download Submit
C:\Users\Admin\AppData\Roaming\circle_yellow.png

Filesize
4KB

MD5
c6c49558bd62ca6423cb04337f028299

SHA1
3398d9baca67d75184d5dd186b7753aa608dc58c

SHA256
2a0a92387228447f6dea75ca02b036259d50b569c65b0bdeb284a2bbec5c411f

SHA512
f0446bda9df8d055d26632696a179ba794f8c856011d1897eb07c7da5f45851a8af864df85e11bd981d45c9ab1e4ca591890c60f209f75c8a8cb7601ffd871d8

Download Submit
C:\Users\Admin\AppData\Roaming\commons-logging.NOTICE.txt

Filesize
519B

MD5
302dd482a7b089d89ca4fd6daac18a4f

SHA1
f374cfa6fc05c5f900ea4cd2258700fd2279981f

SHA256
1d551ccbce1f875b2bffbfac570e44878181a9c457e0254a85f95aa62904603f

SHA512
3e2779497f904c65d9e7a0a2c9faf370478f6cd95ce5fc3e02886474e30a4fab3e1b54e0da057a6356e983926281295f44acd882cd8041b1eb97e6d8883003fe

Download Submit
C:\Users\Admin\AppData\Roaming\delete-2.png

Filesize
1KB

MD5
074aa4bebc3c1f1e4af4afb446a42fbe

SHA1
15c4dc56288a01f65e2b45bc1581c0cdad6c6646

SHA256
2557b202d87ee69b4f12824355f47691d867dd7d1f02ed4fdd32353901f290c8

SHA512
466ececcc75d4633059a8b499ca11d52b875ad65b2e3dd9af5ab99eec7eff9c81dcea35331294b2662c149827429407d12dd971fb6acd10cbf31c2d16d1572e4

Download Submit
C:\Users\Admin\AppData\Roaming\desktop_settings.png

Filesize
2KB

MD5
d152f9d352a61ae147ca835aea1871c7

SHA1
588af7ab27ad99c871d4de947804d53e43ace7fb

SHA256
3b97c5df48caa96923e89eaf5449c7fbb05bf91056656fbac55e1eb7a871a403

SHA512
985115cbc29a3fbce0f38f4c6dfa610421f7c7e4910a3af8424baa4156ba32a908f168f49a79543172eac458e8ff3cbf420a1b817b2f04439c664d1469c9df87

Download Submit
C:\Users\Admin\AppData\Roaming\desktop_settings.png

Filesize
1KB

MD5
30d4b351117ef25ded894659f14d5c37

SHA1
3037e0929a310cb6f88c1898efe0f3ddd0d09c61

SHA256
03b3920409fbd4158c298fe98e5ddfd4f61871cbaf1f83bfe7efd6f4c1855152

SHA512
6fd014f3fdb693c947fbc6fb8df68d7647ede489108719f84081d2ce1e96ec5afc2c2a28ccb0257f9f9af9239f930d22711ffe1743a5c9765289d341abc86d8f

Download Submit
C:\Users\Admin\AppData\Roaming\dynamic.toc.xml

Filesize
1KB

MD5
1ab35dc7acb261425e6451940edc9056

SHA1
a7be5ee193dec603f0207bf1507106f3f9ccf3bc

SHA256
23ef7fe3701f0855272b85f56412b71e6509574f396622fa4e3f0c1b67cfa926

SHA512
276fd267a62faa445a292d7d9412d5795e07997e063ac7741593369dc2458233086f72a2e6073d12c116e62c6e5165c8880622f5f8232df7f582cb70699fe040

Download Submit
C:\Users\Admin\AppData\Roaming\ehdrv.inf

Filesize
1KB

MD5
f7680db2f3ca203a38412d3fbd5a7df4

SHA1
f3789f83109ea8277428c5e5bbc624ba6b610ac4

SHA256
65fc65d02fc9a1ce34795bc08937f592df73602e8e19376c89d689a92fe002cb

SHA512
8489955f064421a07b20eb8d5a9da743aa5d860b6e475614b7523ac060e461a87320b4f49f166feebc85b03ed9fe9e330e5a3df2c5497d47134f3d396b84ef58

Download Submit
C:\Users\Admin\AppData\Roaming\f22.png

Filesize
1KB

MD5
d8abf78e144e7521df20ceac8ee7810c

SHA1
764b28f968978640ca24049a8a0eb322f3dcb734

SHA256
be6934004ed9c71b7bda54bc4eed7f98bef46a7bcbe8463d03a7730116cfcd4e

SHA512
c997a3ba1442200fef03a31435f2250d72e188c09e9497ed67adbb327c73ea6046be6a8197d798a958fbfbc793f554c31307859d64fa22a917f605309ddc56e0

Download Submit
C:\Users\Admin\AppData\Roaming\f22.png

Filesize
1KB

MD5
86799bd2334b437fcb6c6f9ad8d99c9d

SHA1
75e34d4f21dc0d5045cf961be844e82509381523

SHA256
7993757be14787c38686806654bf46199ca7e1c33b198de5dcd25513b3489daa

SHA512
5f16bb06eed3b1f7b274981ce74fc77da630d610bedd67d4b2726a875b657c71f7ba692901303c3cf4f9ab3b845c635ad36a1948844396668256d30f22980c92

Download Submit
C:\Users\Admin\AppData\Roaming\floppy_drive.png

Filesize
4KB

MD5
776a8f129861e8df85d1de11ea9d02d6

SHA1
f5db2f86a5d950ccbac8204a0ac542a5b0be1c6e

SHA256
743e95dcb3604449bdee723e8d89995f1ef3f93fdb218600276cb7e0d2908b13

SHA512
60e3155cdc9b8ee2a105c438e8c78b01d3fb35c0116253af95a44dad0a19eed57cd455a8f28d9ad8ddaba42200b87a3d640a9e1e72cd94f5c53b2f4a4ad86a3c

Download Submit
C:\Users\Admin\AppData\Roaming\floppy_drive.png

Filesize
3KB

MD5
d65cbb08c714ec6cbdb78c3054eb62d7

SHA1
a754a029b02145b0cdc96ce976a61e28bbe4c06b

SHA256
b52591d818798f876c60485dad6a85447e85193faaf6357868b0878c37d25285

SHA512
cadb61959b61b98806d1c4874c4bd831251ad2a84a2d766be6d990a4ddc712e80bf86679e475fee32f92b0197799e14a9924de2a984cf3265514dea6e9b64458

Download Submit
C:\Users\Admin\AppData\Roaming\forward_long.png

Filesize
1KB

MD5
fd172f30ca22f82b6eaf03286553ca1d

SHA1
5d95622b9a666cf8824971f2a3e33e8c6d62392a

SHA256
0fd8232bdf9698803a33544d5fd1459d8d993d4ec04907b107d105ea9e087481

SHA512
f2772d54015ebc27f335b168fad580ea45af1d48e0026802e7e9c0e85a20bf8a7e541f7eb2e2f6677d0db49d7797b829b7ea13ef8a901cf2d0ebb4f1d8a281a7

Download Submit
C:\Users\Admin\AppData\Roaming\forward_long.png

Filesize
887B

MD5
52a6ccee7b61aaebdad8b0ac25d54680

SHA1
4aa90440ff85fb8eb9900f4f761e1706f8a763b7

SHA256
78dc9a077f420c64ac03126608e052f33a471191e55ac51625b5f8081e78c96e

SHA512
becce92eaa29f38b11cf2fc3b68d6feb7d2de12dac03634685a8f2f09dbfeff518d2c540830a6565d27e9e4706154fdcfb592de655ad6cb480beb5f602167fdb

Download Submit
C:\Users\Admin\AppData\Roaming\generate.id.attributes.xml

Filesize
2KB

MD5
3ded1e86067e3287650e86ae6cd08d68

SHA1
8c0f1176a1cd857ee7f55c9662ddf76eace1d84f

SHA256
02cba6b2987d9136e997d8ab24c13e0b0c0fe8266e2f5c99cbb8f84fbcdc7195

SHA512
6494895cb66f721244ba1b826486864e0294535140aa1d7f9dc10c132c18f91fbd7ce7332e7dfe1b316bfbea3c07c74b67a7b439c0fb47420f021ede37e28af5

Download Submit
C:\Users\Admin\AppData\Roaming\generate.id.attributes.xml

Filesize
2KB

MD5
9c9a95e738765fc608d7c4e76b2f35cb

SHA1
9dc240f7154d9aaf682906a987f141b3dd4be7e0

SHA256
3c33893b88336ee1a3b8371c05ce32b51010b5ec73f67af002d53ca66174534c

SHA512
aab54fde37e68017852729846f7fd77db36bd38ba20ad2991ae95c534fa85c518e1d837c308db87c88412877eb5742555f512053b537b16d032d291cc3cc01d1

Download Submit
C:\Users\Admin\AppData\Roaming\{5B76921C-F710-0C00-7C90-036FED3C4413}\typeperf.exe

Filesize
205KB

MD5
aeec04636219ce2624bbd934fa27ee06

SHA1
d4ce719cd75629a18d7d83d28e1d9627ae18d5db

SHA256
91aa1c3663df7271a7e9d5f5bc8330e85b525d2f78391e98a80b47971259882c

SHA512
17b3164f97c98f9a3fe58f0d3a401144d25f73a6f07f0503f788b167d4b65035aa736db0a6b2c4285f2e05a4cea66e50bf06397847c29404e694be03533f6258

Download Submit
C:\Users\Admin\Music\# DECRYPT MY FILES #.html

Filesize
12KB

MD5
2d0da39046d984de0b71ac1e470004c6

SHA1
0349ecc36c576c306b82d3d5a3271ffa2c977127

SHA256
bb3338b8089492f38cd4083124e366e708477b64750bf336718a2d40a799a5d3

SHA512
c0286f91b6f4d01fa243da70d71095bb5c8187726daad4dad03d7e0020cdd334cbaeb838a7d304b3da71b95ce5e433e836e9f54bc606d21dde48dc19b9640814

Download Submit
C:\Users\Admin\Music\# DECRYPT MY FILES #.txt

Filesize
10KB

MD5
9b2eeda834d6f10109ed92a75a8140aa

SHA1
de5177f65933243845e30ab3efef07e4df9201ee

SHA256
af516dbb867a50b5871567f95ed2447ded699316db7f46fe782c2be954d55766

SHA512
8595361a382d6b02026db8c49c3a2f9ab1cc26f304cbe0c77f5c13110c1ba5dc2c7774a64152bc1ad44a0c35e3baaf2d46f16a5929b7a89e3c7a9f263f335e8a

Download Submit
C:\Users\Admin\Music\# DECRYPT MY FILES #.url

Filesize
85B

MD5
d3db4136cbd8d05c8aec741f1498ba35

SHA1
38b1bd9fcb5cc4c1d7afc04269e6c74f9df64717

SHA256
75b1881c63399a5f30f36dd85a094efa16e047bd71cb839f0efa7960d1e92494

SHA512
7536173e39f85dd25a29fdc1aa7761fc305eace277d57619d8900c2c05d54bbde2d7974b948a467ff5cf2130cbee6d2e788961169e9f924076ac041fd95d05f6

Download Submit
C:\Users\Admin\Music\# DECRYPT MY FILES #.vbs

Filesize
219B

MD5
35a3e3b45dcfc1e6c4fd4a160873a0d1

SHA1
a0bcc855f2b75d82cbaae3a8710f816956e94b37

SHA256
8ad5e0f423ce1ff13f45a79746813f0f1d56993d7f125ab96f3d93fb54bdc934

SHA512
6d8e68b969ef67903aff526e983b0fb496678e4c819139e560a11f754a36c4b5770ac2ecf3fc1d9cb5aaa84f80363b4f55553255569503893192911b80d9d853

Download Submit
memory/408-511-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-488-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-499-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-502-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-500-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-155-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-504-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-505-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-503-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-512-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-141-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-513-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-507-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-142-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-600-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-490-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-477-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-501-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-472-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-154-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-556-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-152-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-145-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-143-0x0000000003BF0000-0x0000000003BF1000-memory.dmp

Filesize
4KB

Download
memory/408-148-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-146-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1292-56-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1292-49-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1292-48-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1292-47-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1292-43-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2824-44-0x0000000002F30000-0x0000000002F4E000-memory.dmp

Filesize
120KB

Download
memory/2824-41-0x0000000002F30000-0x0000000002F4E000-memory.dmp

Filesize
120KB

Download
memory/4184-135-0x0000000003030000-0x000000000304E000-memory.dmp

Filesize
120KB

Download
memory/4184-138-0x0000000003030000-0x000000000304E000-memory.dmp

Filesize
120KB

Download