Analysis Overview
SHA256
ca6e55ff3b1a7cc0ab11b25d532233fcbabaf5862556e7a37425d5ba76f535da
Threat Level: Known bad
The file MasonRansomware.exe was found to be: Known bad.
Malicious Activity Summary
Neshta
Detect Neshta payload
Deletes itself
Reads user/profile data of web browsers
Executes dropped EXE
Modifies system executable filetype association
Drops startup file
Drops desktop.ini file(s)
Enumerates connected drives
Suspicious use of SetThreadContext
AutoIT Executable
Drops file in Windows directory
Drops file in Program Files directory
Unsigned PE
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Modifies registry class
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK Matrix V13
Analysis: static1
Detonation Overview
Reported
2024-06-18 18:00
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-18 18:00
Reported
2024-06-18 18:01
Platform
win10-20240404-en
Max time kernel
23s
Max time network
17s
Command Line
Signatures
Detect Neshta payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Neshta
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe | C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe | C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VWYQFE.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\3582-490\ScreenLockApp.exe | N/A |
| N/A | N/A | C:\Windows\svchost.com | N/A |
| N/A | N/A | C:\Windows\svchost.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe | N/A |
| N/A | N/A | C:\Windows\svchost.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\3582-490\SCREEN~1.EXE | N/A |
Modifies system executable filetype association
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe | N/A |
Reads user/profile data of web browsers
Drops desktop.ini file(s)
| Description | Indicator | Process | Target |
| File opened for modification | F:\$RECYCLE.BIN\S-1-5-21-3699363923-1875576828-3287151903-1000\desktop.ini | C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe | N/A |
Enumerates connected drives
AutoIT Executable
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3240 set thread context of 3048 | N/A | C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe | C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe |
Drops file in Program Files directory
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\directx.sys | C:\Windows\svchost.com | N/A |
| File opened for modification | C:\Windows\svchost.com | C:\Windows\svchost.com | N/A |
| File opened for modification | C:\Windows\svchost.com | C:\Windows\svchost.com | N/A |
| File opened for modification | C:\Windows\svchost.com | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe | N/A |
| File opened for modification | C:\Windows\directx.sys | C:\Windows\svchost.com | N/A |
| File opened for modification | C:\Windows\directx.sys | C:\Windows\svchost.com | N/A |
| File opened for modification | C:\Windows\directx.sys | C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE | N/A |
| File opened for modification | C:\Windows\svchost.com | C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE | N/A |
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings | C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings | C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\3582-490\ScreenLockApp.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\3582-490\SCREEN~1.EXE | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe
"C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe"
C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe
"C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe"
C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe
"C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe"
C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe
"C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe"
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe"
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe"
C:\Users\Admin\AppData\Local\Temp\3582-490\ScreenLockApp.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\ScreenLockApp.exe"
C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE"
C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe"
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe
C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SCREEN~1.EXE"
C:\Users\Admin\AppData\Local\Temp\3582-490\SCREEN~1.EXE
C:\Users\Admin\AppData\Local\Temp\3582-490\SCREEN~1.EXE
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa C:\Users\Admin\AppData\Local\Temp\64.cab /quiet /extract:C:\Windows\system32\migwiz\ & exit
C:\Windows\system32\wusa.exe
wusa C:\Users\Admin\AppData\Local\Temp\64.cab /quiet /extract:C:\Windows\system32\migwiz\
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\888.vbs"
Network
Files
memory/3240-0-0x0000000073A9E000-0x0000000073A9F000-memory.dmp
memory/3240-1-0x00000000008D0000-0x0000000000BFA000-memory.dmp
memory/3240-2-0x0000000005480000-0x000000000551C000-memory.dmp
memory/3240-3-0x0000000002DF0000-0x0000000002DFA000-memory.dmp
memory/3240-4-0x0000000073A90000-0x000000007417E000-memory.dmp
memory/3240-5-0x0000000005AB0000-0x0000000005FAE000-memory.dmp
memory/3048-6-0x0000000000400000-0x0000000000722000-memory.dmp
memory/3240-9-0x0000000073A90000-0x000000007417E000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MasonRansomware.exe.log
| MD5 | 4b1382f82cb506f36d30c01d5d515bca |
| SHA1 | 621aeafd1d115a27c71dd58c6211716c9640aba6 |
| SHA256 | d01a9a6d2f90166ffccd93ebf12c3ba6dd2ab12a9c047a6449d5968cc92d4200 |
| SHA512 | 8700fd86011f3af3467ccb6c6d6c56f4004aada7a82186047dbba1cb01c3a2344213ecb1f1c67f3e20d269a79b0e61238b043a363047b050eecbd84bba4e65a5 |
memory/3048-10-0x0000000073A90000-0x000000007417E000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe
| MD5 | f70eeb19a96e3ee21b289e86ac97700c |
| SHA1 | 3b99ffb7ac3dcc18bae898f379f869128d31a03b |
| SHA256 | 82e0a977f2d2454ddb0fbaa8cc3ffd103eb4be453d2d1a176751e4e3b1ee93ff |
| SHA512 | 8d4d3efb42901f59d26835f4c903155bd49f7176aa209d7f4a2714fc2f76b1ec2c91ce58a34e46500b757e3fb068cab854557ea88c1b400475b0974bcd6f4915 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe
| MD5 | 0a38ff490ed8cf0cba13acf59f6d054e |
| SHA1 | 884cf0894711f44556312441f71c508e3f2f7fa1 |
| SHA256 | 2ae2797f7f6543788cc7fd1ca7a89a17a9cddfd28af3f13515c8e521126e93c3 |
| SHA512 | bdd476f5509d758ac5518d0309e213fb5005ced349e452f4fe185b643264d84771be70d4901eeffc1c335ee584e0329bb7edee162372b8214b2d3d58036d4611 |
memory/3048-22-0x0000000073A90000-0x000000007417E000-memory.dmp
memory/4428-23-0x0000000000400000-0x00000000005F6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\3582-490\ScreenLockApp.exe
| MD5 | ef7a9bd97bec8a6070b2b99053d54ab1 |
| SHA1 | 2ab06b299df7896555220b5fc5f8924a8fc901a5 |
| SHA256 | 50814f4e49e5150e41fc9a3e4bd3145b27043d23f5d72780cdfa956df00ba8da |
| SHA512 | 1c0b3f06317ca0916a102eb374207d9ff2f9ba2e14f855e9296d104ed4ccaf7f119ab44c43f492ab36269b3e1fa3f81c19cb0f661ca33bf2e1a2a400d4d989d3 |
memory/3220-29-0x0000000000620000-0x000000000073E000-memory.dmp
memory/3220-30-0x0000000004FC0000-0x0000000005052000-memory.dmp
memory/3220-31-0x0000000004F90000-0x0000000004F9A000-memory.dmp
C:\Windows\svchost.com
| MD5 | 8c82da886615880591097012f5c495e1 |
| SHA1 | e967cbe5bb33fb4ceb302a079e707e12d6ed013c |
| SHA256 | 6e8e9e3190510366c4f76ce47911d9c91e56741c282ffd897bfb9ca32e4aa9c6 |
| SHA512 | 418c0a2aa43c4001ae913ac225596d6fd6c6e39361d15d602152517805a0e6421ca10d87ad582136e11b290aa3627ddb9032fe00f0041720e8d6105f0b93c54a |
C:\Windows\directx.sys
| MD5 | 71ede13495b64d16ac7f8ba80c706649 |
| SHA1 | 7a34d38eb63cdcdc24f895872b88a7187c37f8a2 |
| SHA256 | a054103a808dfddb9cd8231ff4f57b562ffec811aa412ac6373c221572d87d99 |
| SHA512 | 6cec814a8ab9026783d6a68fa5abd2a9588ea1de9cbf14f684171a6e221b0bb55c3beb3008ebb92cb3eaf4a5a1b705f889dd7bcad7ef6e7eaaa5c18cd6c381e8 |
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe
| MD5 | 80041f5a17c53028f8603321de845061 |
| SHA1 | 33a25cbd6cabca83c78b6f0e668f64d5a096f29b |
| SHA256 | 0370fe07f7a6150a7d7acdbd9776a3c0be85620ea00bf625701db6cf02f458df |
| SHA512 | 9ea6a75518490e6ffee822b69447c9af9beeacc68aec271990cb0561f02766e9c367e12305ada485f4a0359368ec269542c630f52301292c401f114008524dea |
C:\Windows\directx.sys
| MD5 | 8deccdae5aeaeb8494b8d12cb8281a50 |
| SHA1 | fdd88ad4ea5451418254bcf09cc72a3f37d5834b |
| SHA256 | 26ee5649a2999b4e313476e1f5b48932bd8daf3e7869b8324d39c52be28b36a6 |
| SHA512 | 9365b6a06c1e3662eee6a608cd28445cc21a47ee25ed7de761a01d472c079248a174f0bf982af89388b80e37a95cd56663dccf93eb0a5973ff7e171a388affb6 |
C:\Users\Admin\AppData\Local\Temp\64.cab
| MD5 | 8cfa6b4acd035a2651291a2a4623b1c7 |
| SHA1 | 43571537bf2ce9f8e8089fadcbf876eaf4cf3ae9 |
| SHA256 | 6e438201a14a70980048d2377c2195608d5dc2cf915f489c0a59ac0627c98fa9 |
| SHA512 | e0a73401ce74c8db69964ef5a53f2a1b8caf8c739359785970295dae82619e81c0a21466327a023cf4009e0c15981a20bf1e18c73821083908fce722faa82685 |
C:\Users\Admin\AppData\Local\Temp\aut85CA.tmp
| MD5 | 9dda4db9e90ff039ad5a58785b9d626d |
| SHA1 | 507730d87b32541886ec1dd77f3459fa7bf1e973 |
| SHA256 | fc31b205d5e4f32fa0c71c8f72ee06b92a28bd8690f71ab8f94ff401af2228fe |
| SHA512 | 4cfecaaccd0f8f9e31690ff80cca83edc962e73861043fffded1a3847201455d5adca7c5ef3866c65e6e516205e67b2f31c8149aad5be1065c1eb586b013f86a |
C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
| MD5 | 8c753d6448183dea5269445738486e01 |
| SHA1 | ebbbdc0022ca7487cd6294714cd3fbcb70923af9 |
| SHA256 | 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997 |
| SHA512 | 4f6fddefc42455540448eac0b693a4847e21b68467486376a4186776bfe137337733d3075b7b87ed7dac532478dc9afc63883607ec8205df3f155fee64c7a9be |
C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
| MD5 | 176436d406fd1aabebae353963b3ebcf |
| SHA1 | 9ffdfdb8cc832a0c6501c4c0e85b23a0f7eff57a |
| SHA256 | 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f |
| SHA512 | a2d1a714e0c1e5463260c64048ba8fd5064cfa06d4a43d02fc04a30748102ff5ba86d20a08e611e200dc778e2b7b3ae808da48132a05a61aa09ac424a182a06a |
memory/3600-106-0x0000000000400000-0x000000000041B000-memory.dmp
C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
| MD5 | 12c29dd57aa69f45ddd2e47620e0a8d9 |
| SHA1 | ba297aa3fe237ca916257bc46370b360a2db2223 |
| SHA256 | 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880 |
| SHA512 | 255176cd1a88dfa2af3838769cc20dc7ad9d969344801f07b9ebb372c12cee3f47f2dba3559f391deab10650875cad245d9724acfa23a42b336bfa96559a5488 |
C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
| MD5 | 92dc0a5b61c98ac6ca3c9e09711e0a5d |
| SHA1 | f809f50cfdfbc469561bced921d0bad343a0d7b4 |
| SHA256 | 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc |
| SHA512 | d9eefb19f82e0786d9be0dbe5e339d25473fb3a09682f40c6d190d4c320cca5556abb72b5d97c6b0da4f8faefdc6d39ac9d0415fdf94ebcc90ecdf2e513c6a31 |
C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
| MD5 | 4ddc609ae13a777493f3eeda70a81d40 |
| SHA1 | 8957c390f9b2c136d37190e32bccae3ae671c80a |
| SHA256 | 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950 |
| SHA512 | 9d7f90d1529cab20078c2690bf7bffab5a451a41d8993781effe807e619da0e7292f991da2f0c5c131b111d028b3e6084e5648c90816e74dfb664e7f78181bc5 |
C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
| MD5 | 5791075058b526842f4601c46abd59f5 |
| SHA1 | b2748f7542e2eebcd0353c3720d92bbffad8678f |
| SHA256 | 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394 |
| SHA512 | 83e303971ed64019fde9e4ba6f6e889f8fb105088490dfa7dcf579a12baff20ef491f563d132d60c7b24a4fd3cac29bd9dc974571cd162000fae8fba4e0e54fb |
C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
| MD5 | 9dfcdd1ab508b26917bb2461488d8605 |
| SHA1 | 4ba6342bcf4942ade05fb12db83da89dc8c56a21 |
| SHA256 | ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5 |
| SHA512 | 1afc1b95f160333f1ff2fa14b3f22a28ae33850699c6b5498915a8b6bec1cfc40f33cb69583240aa9206bc2ea7ab14e05e071275b836502a92aa8c529fc1b137 |
C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
| MD5 | cce8964848413b49f18a44da9cb0a79b |
| SHA1 | 0b7452100d400acebb1c1887542f322a92cbd7ae |
| SHA256 | fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5 |
| SHA512 | bf8fc270229d46a083ced30da6637f3ca510b0ce44624a9b21ec6aacac81666dffd41855053a936aa9e8ea6e745a09b820b506ec7bf1173b6f1837828a35103d |
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
| MD5 | 09acdc5bbec5a47e8ae47f4a348541e2 |
| SHA1 | 658f64967b2a9372c1c0bdd59c6fb2a18301d891 |
| SHA256 | 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403 |
| SHA512 | 3867bf98e1a0e253114a98b78b047b0d8282b5abf4aaf836f31cc0e26224e2a1b802c65df9d90dc7696a6dbcb9a8e4b900f1d1299e1b11e36f095ebaf8a2e5b8 |
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
| MD5 | 576410de51e63c3b5442540c8fdacbee |
| SHA1 | 8de673b679e0fee6e460cbf4f21ab728e41e0973 |
| SHA256 | 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe |
| SHA512 | f7761f3878775b30cc3d756fa122e74548dfc0a27e38fa4109e34a59a009df333d074bf14a227549ae347605f271be47984c55148685faac479aeb481f7191db |
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
| MD5 | 3b73078a714bf61d1c19ebc3afc0e454 |
| SHA1 | 9abeabd74613a2f533e2244c9ee6f967188e4e7e |
| SHA256 | ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29 |
| SHA512 | 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4 |
C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
| MD5 | 322302633e36360a24252f6291cdfc91 |
| SHA1 | 238ed62353776c646957efefc0174c545c2afa3d |
| SHA256 | 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c |
| SHA512 | 5a1f7c44ce7f5036bffc18ebac39e2bf70e6f35fa252617d665b26448f4c4473adfa115467b7e2d9b7068823e448f74410cdcdfef1ac1c09021e051921787373 |
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
| MD5 | 39c8a4c2c3984b64b701b85cb724533b |
| SHA1 | c911f4c4070dfe9a35d9adcb7de6e6fb1482ce00 |
| SHA256 | 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d |
| SHA512 | f42ca2962fe60cff1a13dea8b81ff0647b317c785ee4f5159c38487c34d33aecba8478757047d31ab2ee893fbdcb91a21655353456ba6a018fc71b2278db4db2 |
C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
| MD5 | 8ffc3bdf4a1903d9e28b99d1643fc9c7 |
| SHA1 | 919ba8594db0ae245a8abd80f9f3698826fc6fe5 |
| SHA256 | 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6 |
| SHA512 | 0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427 |
memory/2544-107-0x0000000000400000-0x000000000041B000-memory.dmp
C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
| MD5 | bcd0f32f28d3c2ba8f53d1052d05252d |
| SHA1 | c29b4591df930dabc1a4bd0fa2c0ad91500eafb2 |
| SHA256 | bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb |
| SHA512 | 79f407735853f82f46870c52058ceee4d91857a89db14868ee1169abd5c0fd2e3fa1ed230ab90b5f479a9581b88998643d69b0df498defea29e73b0d487f3b10 |
C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
| MD5 | d47ed8961782d9e27f359447fa86c266 |
| SHA1 | d37d3f962c8d302b18ec468b4abe94f792f72a3b |
| SHA256 | b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a |
| SHA512 | 3e33f2cdf35024868b183449019de9278035e7966b342ba320a6c601b5629792cbb98a19850d4ca80b906c85d10e8503b0193794d1f1efa849fa33d26cff0669 |
C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe
| MD5 | 028aea45f143a63ba70146a4abe2ceeb |
| SHA1 | c616258da4d8a7c9ff7dd5fff089d983d1553e09 |
| SHA256 | adc7b8fc26491206149496e2bceaf3686424274f444f14e2dd6fbf2ac7423ddf |
| SHA512 | a266d0e2fd2676db41317622938cc03ff33c1904129d4ba0ef2d97a88313c882e719c8d4798c18a97ca64bc5ebdb90dd05290f25569e967966e2f5399f1f511d |
C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe
| MD5 | d1c48274711d83d4a1a0cfb2abdf8d31 |
| SHA1 | b4367dd7201ef0cc22d56613e428efda07da57a8 |
| SHA256 | ade1db79870327538841d5470483c6474083f08d871bb7d56cfc9e76971c8640 |
| SHA512 | 7a3e7927b8be3dc1706e6511bf04475558da076696435f937c4eafa94111c378f3bcaa1ea4e5063e91e3e333c91f086a75baaff6c5cc190d3d314c5eee1687a3 |
C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
| MD5 | 452c3ce70edba3c6e358fad9fb47eb4c |
| SHA1 | d24ea3b642f385a666159ef4c39714bec2b08636 |
| SHA256 | da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c |
| SHA512 | fe8a0b9b1386d6931dc7b646d0dd99c3d1b44bd40698b33077e7eeba877b53e5cb39ff2aa0f6919ccab62953a674577bc1b2516d9cadc0c051009b2083a08085 |
C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
| MD5 | 892cf4fc5398e07bf652c50ef2aa3b88 |
| SHA1 | c399e55756b23938057a0ecae597bd9dbe481866 |
| SHA256 | e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781 |
| SHA512 | f16a9e4b1150098c5936ec6107c36d47246dafd5a43e9f4ad9a31ecab69cc789c768691fa23a1440fae7f6e93e8e62566b5c86f7ed6bb4cfe26368149ea8c167 |
C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
| MD5 | 9a8d683f9f884ddd9160a5912ca06995 |
| SHA1 | 98dc8682a0c44727ee039298665f5d95b057c854 |
| SHA256 | 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423 |
| SHA512 | 6aecf8c5cb5796d6879f8643e20c653f58bad70820896b0019c39623604d5b3c8a4420562ab051c6685edce60aa068d9c2dbb4413a7b16c6d01a9ac10dc22c12 |
C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE
| MD5 | f7c714dbf8e08ca2ed1a2bfb8ca97668 |
| SHA1 | cc78bf232157f98b68b8d81327f9f826dabb18ab |
| SHA256 | fc379fda348644fef660a3796861c122aa2dd5498e80279d1279a7ddb259e899 |
| SHA512 | 28bc04c4df3f632865e68e83d045b3ecd2a263e62853c922b260d0734026e8a1541988fcbf4ddc9cf3aba6863214d6c6eb51f8bbb2586122a7cb01a70f08d16c |
C:\PROGRA~2\Google\Update\DISABL~1.EXE
| MD5 | 3b0e91f9bb6c1f38f7b058c91300e582 |
| SHA1 | 6e2e650941b1a96bb0bb19ff26a5d304bb09df5f |
| SHA256 | 57c993cadf4bf84810cea23a7112c6e260624beaab48d0e4332d3462900fec1d |
| SHA512 | a4fbe28a0135f4632e0a5b6bd775f8d010250b0fbfe223db1fe81d18552a6bc166ebce807853ba02e6a476e9829454805e415ca828a5e043bd1e63dc53599d0f |
C:\PROGRA~2\MOZILL~1\UNINST~1.EXE
| MD5 | a471aeae6a5ecdbdf978d076551228ad |
| SHA1 | 7ae57187319530e84371cefac2271db349431f4e |
| SHA256 | d621284d9f534a8dfb275e2c8d1cd39bb46c025ec687e48e053309e633195944 |
| SHA512 | f9840c8f6bdadbf1da8ee7f1806902f7ab37b6d0d531fdb922f409e96a407bc2017541848f5cb9645201a252640d97024c57f5b2b3f6a57dc1bff30874b368a5 |
C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe
| MD5 | 051978153bcd2b1cf032fa1bf5a82020 |
| SHA1 | ec6d1d42905a1c92ccee5f4980898d7a1d72aa23 |
| SHA256 | 88e90f04db57a472acacf1f4e7616d05a488fc7a1b41a468b357ac4419489940 |
| SHA512 | 68dec8a12b2c10a9ff83907705c68c77284928d9349a8ba93808d09123752b84944505208d7d71540e340dcbb06e74c79fa24748098308eeecab5f80ab4e8d15 |
C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE
| MD5 | 0d9146d70ac6a41ead1ea2d50d729508 |
| SHA1 | b9e6ff83a26aaf105640f5d5cdab213c989dc370 |
| SHA256 | 0b876ddeefd88d5e98de7e409c5b6546ba8ffa195c168f9a4b6ba33b44d437ab |
| SHA512 | c9394decfd469bfedd883095d604e11208aa290334ff5c0dce852f2ca74fba27c37ba2984dab8b27430e573681e22c9f903e53b01510a4b77d337cbd92c56cb3 |
C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
| MD5 | 8e7b72380cc9ee9bf35c0de5fde4ab3a |
| SHA1 | c19151c331ab274bbf5f6792ca707eb8a7017dba |
| SHA256 | d82ca304cf64be3922b12111c962e09a6ddb2b8477e25b6c3f0400eddc38c80b |
| SHA512 | acff1c08f9c8443d0b0589f5a7d7cab532462788406feba64825fdd2addf5b6cc8e773713e93c98991afbc7e364233fe7cf0659574cebe2200f8f7f818bfe927 |
C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\181510~1.001\FILESY~1.EXE
| MD5 | f3228c24035b3f54f78bb4fd11c36aeb |
| SHA1 | 2fe73d1f64575bc4abf1d47a9dddfe7e2d9c9cbb |
| SHA256 | d2767c9c52835f19f6695c604081bf03cdd772a3731cd2e320d9db5e477d8af7 |
| SHA512 | b526c63338d9167060bc40ffa1d13a8c2e871f46680cd4a0efc2333d9f15bf21ae75af45f8932de857678c5bf785011a28862ce7879f4bffdb9753c8bc2c19b5 |
C:\Users\ALLUSE~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE
| MD5 | 63dc05e27a0b43bf25f151751b481b8c |
| SHA1 | b20321483dac62bce0aa0cef1d193d247747e189 |
| SHA256 | 7d607fb69c69a72a5bf4305599279f46318312ce1082b6a34ac9100b8c7762ce |
| SHA512 | 374d705704d456cc5f9f79b7f465f6ec7c775dc43001c840e9d6efbbdef20926ed1fa97f8a9b1e73161e17f72520b96c05fa58ac86b3945208b405f9166e7ba3 |
C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\VC_RED~1.EXE
| MD5 | 06366e48936df8d5556435c9820e9990 |
| SHA1 | 0e3ed1da26a0c96f549720684e87352f1b58ef45 |
| SHA256 | cd47cce50016890899413b2c3609b3b49cb1b65a4dfcaa34ece5a16d8e8f6612 |
| SHA512 | bea7342a6703771cb9b11cd164e9972eb981c33dcfe3e628b139f9e45cf1e24ded1c55fcdfa0697bf48772a3359a9ddd29e4bb33c796c94727afd1c4d5589ea3 |
C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE
| MD5 | 97510a7d9bf0811a6ea89fad85a9f3f3 |
| SHA1 | 2ac0c49b66a92789be65580a38ae9798237711db |
| SHA256 | c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea |
| SHA512 | 2a93e2a3bd187fdde160f87ef777ccd1d1c398d547b7c869e6b64469b9418ad04d887cdfe94af7407476377bf2d009f576de3935c025b7aefbab26fbcd8f90fb |
C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE
| MD5 | 9597098cfbc45fae685d9480d135ed13 |
| SHA1 | 84401f03a7942a7e4fcd26e4414b227edd9b0f09 |
| SHA256 | 45966655baaed42df92cd6d8094b4172c0e7a0320528b59cf63fca7c25d66e9c |
| SHA512 | 16afbdffe4b4b2e54b4cc96fe74e49ca367dea50752321ddf334756519812ba8ce147ef5459e421dc42e103bc3456aab1d185588cc86b35fa2315ac86b2a0164 |
C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE
| MD5 | 86749cd13537a694795be5d87ef7106d |
| SHA1 | 538030845680a8be8219618daee29e368dc1e06c |
| SHA256 | 8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5 |
| SHA512 | 7b6ae20515fb6b13701df422cbb0844d26c8a98087b2758427781f0bf11eb9ec5da029096e42960bf99ddd3d4f817db6e29ac172039110df6ea92547d331db4c |
C:\Users\Admin\AppData\Local\Temp\888.vbs
| MD5 | 8be57121a3ecae9c90cce4adf00f2454 |
| SHA1 | aca585c1b6409bc2475f011a436b319e42b356d8 |
| SHA256 | 35d7204f9582b63b47942a4df9a55b8825b6d0af295b641f6257c39f7dda5f5e |
| SHA512 | 85521f6cd62dd5bb848933a188a9ddb83dd7ae2c5f4a97b65ba7785c3d58dba27694c7df308f4cf0fdaaa8c55251ff14ed1632e315a16d8d0b15217bac381f72 |
C:\Users\Admin\AppData\Local\Lock.Adobe
| MD5 | de6fdff1993c731e52e49d52a6e684d9 |
| SHA1 | 120d1ff8a24109eed24ac1a5697383d50bcc0f47 |
| SHA256 | 645c2d0cb9f6edf276f7dead9ab8c72531cdae22f54962d174c1339c30cb1b42 |
| SHA512 | 99d05bf76a3a7466ccf27ac304ba35639716089d8dae388aaa707bfb6feb3f362251a65951663dd86abcac5a5e7358a5f29faedfe4c0b55ae136ba9d8f1209c1 |
memory/4628-238-0x0000000000400000-0x000000000041B000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Troll~Virus.exe.log
| MD5 | 16c5fce5f7230eea11598ec11ed42862 |
| SHA1 | 75392d4824706090f5e8907eee1059349c927600 |
| SHA256 | 87ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151 |
| SHA512 | 153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc |
memory/1248-246-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3100-247-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4628-340-0x0000000000400000-0x000000000041B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp
| MD5 | 1edc9dd1160c5231fb708e5af18e982d |
| SHA1 | 98cefa73fe7c9f8957a73bbad0c760d8167de41c |
| SHA256 | 6445be188ada983da0b1428538cde668744a6a7e5774b7cdeb1d9ea05e465310 |
| SHA512 | 0b78a4a20b7e27d3607ad12df8daa531061d1ef5628a89f02a5073b421af917d785a9e33ee159ba02a72441a3b61662875543d847bba79bd605ca6c831b132cb |
memory/4628-350-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3100-352-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1248-353-0x0000000000400000-0x000000000041B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\wl.jpg
| MD5 | bde674be75317ab178ce59d133a4d507 |
| SHA1 | 996b9b0a0f4bf8234ee95df5beb58614e1b85c67 |
| SHA256 | d0bd2c6f0161d2d45473206777634be8a79907cfd5fc45cf6433edc5280ebe63 |
| SHA512 | 846d133b57254d77b835361ec506a5e99d24ae631f1a0f3ad0c21147629f5c378a2f13e4bbc1f5ca468b9a27f7faf04c055b52edce7bd634a00cc92577e03894 |