Malware Analysis Report

2024-09-11 00:02

Sample ID 240618-wlsrnaxhjk
Target MasonRansomware.exe
SHA256 ca6e55ff3b1a7cc0ab11b25d532233fcbabaf5862556e7a37425d5ba76f535da
Tags
neshta persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ca6e55ff3b1a7cc0ab11b25d532233fcbabaf5862556e7a37425d5ba76f535da

Threat Level: Known bad

The file MasonRansomware.exe was found to be: Known bad.

Malicious Activity Summary

neshta persistence spyware stealer

Neshta

Detect Neshta payload

Deletes itself

Reads user/profile data of web browsers

Executes dropped EXE

Modifies system executable filetype association

Drops startup file

Drops desktop.ini file(s)

Enumerates connected drives

Suspicious use of SetThreadContext

AutoIT Executable

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-18 18:00

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 18:00

Reported

2024-06-18 18:01

Platform

win10-20240404-en

Max time kernel

23s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Neshta

persistence spyware neshta

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VWYQFE.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3699363923-1875576828-3287151903-1000\desktop.ini C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\a: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\l: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\m: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\u: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\v: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\x: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\b: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\r: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\y: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\h: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\i: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\k: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\n: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\p: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\w: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\z: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\e: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\g: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\j: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\o: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\q: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\s: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\t: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3240 set thread context of 3048 N/A C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\WinMail.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ScreenLockApp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\SCREEN~1.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3240 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe
PID 3240 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe
PID 3240 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe
PID 3240 wrote to memory of 192 N/A C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe
PID 3240 wrote to memory of 192 N/A C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe
PID 3240 wrote to memory of 192 N/A C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe
PID 3240 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe
PID 3240 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe
PID 3240 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe
PID 3240 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe
PID 3240 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe
PID 3240 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe
PID 3240 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe
PID 3240 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe
PID 3048 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe
PID 3048 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe
PID 3048 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe
PID 3048 wrote to memory of 4428 N/A C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe
PID 3048 wrote to memory of 4428 N/A C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe
PID 4628 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ScreenLockApp.exe
PID 4628 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ScreenLockApp.exe
PID 4628 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ScreenLockApp.exe
PID 4428 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe C:\Windows\svchost.com
PID 4428 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe C:\Windows\svchost.com
PID 4428 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe C:\Windows\svchost.com
PID 4428 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe C:\Windows\svchost.com
PID 4428 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe C:\Windows\svchost.com
PID 4428 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe C:\Windows\svchost.com
PID 1248 wrote to memory of 3100 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE
PID 1248 wrote to memory of 3100 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE
PID 1248 wrote to memory of 3100 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE
PID 2544 wrote to memory of 3024 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe
PID 2544 wrote to memory of 3024 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe
PID 2544 wrote to memory of 3024 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe
PID 3100 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE C:\Windows\svchost.com
PID 3100 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE C:\Windows\svchost.com
PID 3100 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE C:\Windows\svchost.com
PID 3600 wrote to memory of 5092 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\SCREEN~1.EXE
PID 3600 wrote to memory of 5092 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\SCREEN~1.EXE
PID 3600 wrote to memory of 5092 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\SCREEN~1.EXE
PID 3024 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe C:\Windows\system32\cmd.exe
PID 3024 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe C:\Windows\system32\cmd.exe
PID 4764 wrote to memory of 2792 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 4764 wrote to memory of 2792 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 3024 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe C:\Windows\System32\WScript.exe
PID 3024 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe C:\Windows\System32\WScript.exe

Processes

C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe

"C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe"

C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe

"C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe"

C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe

"C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe"

C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe

"C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\ScreenLockApp.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\ScreenLockApp.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe"

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SCREEN~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\SCREEN~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SCREEN~1.EXE

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa C:\Users\Admin\AppData\Local\Temp\64.cab /quiet /extract:C:\Windows\system32\migwiz\ & exit

C:\Windows\system32\wusa.exe

wusa C:\Users\Admin\AppData\Local\Temp\64.cab /quiet /extract:C:\Windows\system32\migwiz\

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\888.vbs"

Network

N/A

Files

memory/3240-0-0x0000000073A9E000-0x0000000073A9F000-memory.dmp

memory/3240-1-0x00000000008D0000-0x0000000000BFA000-memory.dmp

memory/3240-2-0x0000000005480000-0x000000000551C000-memory.dmp

memory/3240-3-0x0000000002DF0000-0x0000000002DFA000-memory.dmp

memory/3240-4-0x0000000073A90000-0x000000007417E000-memory.dmp

memory/3240-5-0x0000000005AB0000-0x0000000005FAE000-memory.dmp

memory/3048-6-0x0000000000400000-0x0000000000722000-memory.dmp

memory/3240-9-0x0000000073A90000-0x000000007417E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MasonRansomware.exe.log

MD5 4b1382f82cb506f36d30c01d5d515bca
SHA1 621aeafd1d115a27c71dd58c6211716c9640aba6
SHA256 d01a9a6d2f90166ffccd93ebf12c3ba6dd2ab12a9c047a6449d5968cc92d4200
SHA512 8700fd86011f3af3467ccb6c6d6c56f4004aada7a82186047dbba1cb01c3a2344213ecb1f1c67f3e20d269a79b0e61238b043a363047b050eecbd84bba4e65a5

memory/3048-10-0x0000000073A90000-0x000000007417E000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe

MD5 f70eeb19a96e3ee21b289e86ac97700c
SHA1 3b99ffb7ac3dcc18bae898f379f869128d31a03b
SHA256 82e0a977f2d2454ddb0fbaa8cc3ffd103eb4be453d2d1a176751e4e3b1ee93ff
SHA512 8d4d3efb42901f59d26835f4c903155bd49f7176aa209d7f4a2714fc2f76b1ec2c91ce58a34e46500b757e3fb068cab854557ea88c1b400475b0974bcd6f4915

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe

MD5 0a38ff490ed8cf0cba13acf59f6d054e
SHA1 884cf0894711f44556312441f71c508e3f2f7fa1
SHA256 2ae2797f7f6543788cc7fd1ca7a89a17a9cddfd28af3f13515c8e521126e93c3
SHA512 bdd476f5509d758ac5518d0309e213fb5005ced349e452f4fe185b643264d84771be70d4901eeffc1c335ee584e0329bb7edee162372b8214b2d3d58036d4611

memory/3048-22-0x0000000073A90000-0x000000007417E000-memory.dmp

memory/4428-23-0x0000000000400000-0x00000000005F6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\ScreenLockApp.exe

MD5 ef7a9bd97bec8a6070b2b99053d54ab1
SHA1 2ab06b299df7896555220b5fc5f8924a8fc901a5
SHA256 50814f4e49e5150e41fc9a3e4bd3145b27043d23f5d72780cdfa956df00ba8da
SHA512 1c0b3f06317ca0916a102eb374207d9ff2f9ba2e14f855e9296d104ed4ccaf7f119ab44c43f492ab36269b3e1fa3f81c19cb0f661ca33bf2e1a2a400d4d989d3

memory/3220-29-0x0000000000620000-0x000000000073E000-memory.dmp

memory/3220-30-0x0000000004FC0000-0x0000000005052000-memory.dmp

memory/3220-31-0x0000000004F90000-0x0000000004F9A000-memory.dmp

C:\Windows\svchost.com

MD5 8c82da886615880591097012f5c495e1
SHA1 e967cbe5bb33fb4ceb302a079e707e12d6ed013c
SHA256 6e8e9e3190510366c4f76ce47911d9c91e56741c282ffd897bfb9ca32e4aa9c6
SHA512 418c0a2aa43c4001ae913ac225596d6fd6c6e39361d15d602152517805a0e6421ca10d87ad582136e11b290aa3627ddb9032fe00f0041720e8d6105f0b93c54a

C:\Windows\directx.sys

MD5 71ede13495b64d16ac7f8ba80c706649
SHA1 7a34d38eb63cdcdc24f895872b88a7187c37f8a2
SHA256 a054103a808dfddb9cd8231ff4f57b562ffec811aa412ac6373c221572d87d99
SHA512 6cec814a8ab9026783d6a68fa5abd2a9588ea1de9cbf14f684171a6e221b0bb55c3beb3008ebb92cb3eaf4a5a1b705f889dd7bcad7ef6e7eaaa5c18cd6c381e8

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe

MD5 80041f5a17c53028f8603321de845061
SHA1 33a25cbd6cabca83c78b6f0e668f64d5a096f29b
SHA256 0370fe07f7a6150a7d7acdbd9776a3c0be85620ea00bf625701db6cf02f458df
SHA512 9ea6a75518490e6ffee822b69447c9af9beeacc68aec271990cb0561f02766e9c367e12305ada485f4a0359368ec269542c630f52301292c401f114008524dea

C:\Windows\directx.sys

MD5 8deccdae5aeaeb8494b8d12cb8281a50
SHA1 fdd88ad4ea5451418254bcf09cc72a3f37d5834b
SHA256 26ee5649a2999b4e313476e1f5b48932bd8daf3e7869b8324d39c52be28b36a6
SHA512 9365b6a06c1e3662eee6a608cd28445cc21a47ee25ed7de761a01d472c079248a174f0bf982af89388b80e37a95cd56663dccf93eb0a5973ff7e171a388affb6

C:\Users\Admin\AppData\Local\Temp\64.cab

MD5 8cfa6b4acd035a2651291a2a4623b1c7
SHA1 43571537bf2ce9f8e8089fadcbf876eaf4cf3ae9
SHA256 6e438201a14a70980048d2377c2195608d5dc2cf915f489c0a59ac0627c98fa9
SHA512 e0a73401ce74c8db69964ef5a53f2a1b8caf8c739359785970295dae82619e81c0a21466327a023cf4009e0c15981a20bf1e18c73821083908fce722faa82685

C:\Users\Admin\AppData\Local\Temp\aut85CA.tmp

MD5 9dda4db9e90ff039ad5a58785b9d626d
SHA1 507730d87b32541886ec1dd77f3459fa7bf1e973
SHA256 fc31b205d5e4f32fa0c71c8f72ee06b92a28bd8690f71ab8f94ff401af2228fe
SHA512 4cfecaaccd0f8f9e31690ff80cca83edc962e73861043fffded1a3847201455d5adca7c5ef3866c65e6e516205e67b2f31c8149aad5be1065c1eb586b013f86a

C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE

MD5 8c753d6448183dea5269445738486e01
SHA1 ebbbdc0022ca7487cd6294714cd3fbcb70923af9
SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
SHA512 4f6fddefc42455540448eac0b693a4847e21b68467486376a4186776bfe137337733d3075b7b87ed7dac532478dc9afc63883607ec8205df3f155fee64c7a9be

C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE

MD5 176436d406fd1aabebae353963b3ebcf
SHA1 9ffdfdb8cc832a0c6501c4c0e85b23a0f7eff57a
SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
SHA512 a2d1a714e0c1e5463260c64048ba8fd5064cfa06d4a43d02fc04a30748102ff5ba86d20a08e611e200dc778e2b7b3ae808da48132a05a61aa09ac424a182a06a

memory/3600-106-0x0000000000400000-0x000000000041B000-memory.dmp

C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE

MD5 12c29dd57aa69f45ddd2e47620e0a8d9
SHA1 ba297aa3fe237ca916257bc46370b360a2db2223
SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
SHA512 255176cd1a88dfa2af3838769cc20dc7ad9d969344801f07b9ebb372c12cee3f47f2dba3559f391deab10650875cad245d9724acfa23a42b336bfa96559a5488

C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE

MD5 92dc0a5b61c98ac6ca3c9e09711e0a5d
SHA1 f809f50cfdfbc469561bced921d0bad343a0d7b4
SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
SHA512 d9eefb19f82e0786d9be0dbe5e339d25473fb3a09682f40c6d190d4c320cca5556abb72b5d97c6b0da4f8faefdc6d39ac9d0415fdf94ebcc90ecdf2e513c6a31

C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE

MD5 4ddc609ae13a777493f3eeda70a81d40
SHA1 8957c390f9b2c136d37190e32bccae3ae671c80a
SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
SHA512 9d7f90d1529cab20078c2690bf7bffab5a451a41d8993781effe807e619da0e7292f991da2f0c5c131b111d028b3e6084e5648c90816e74dfb664e7f78181bc5

C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe

MD5 5791075058b526842f4601c46abd59f5
SHA1 b2748f7542e2eebcd0353c3720d92bbffad8678f
SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
SHA512 83e303971ed64019fde9e4ba6f6e889f8fb105088490dfa7dcf579a12baff20ef491f563d132d60c7b24a4fd3cac29bd9dc974571cd162000fae8fba4e0e54fb

C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE

MD5 9dfcdd1ab508b26917bb2461488d8605
SHA1 4ba6342bcf4942ade05fb12db83da89dc8c56a21
SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
SHA512 1afc1b95f160333f1ff2fa14b3f22a28ae33850699c6b5498915a8b6bec1cfc40f33cb69583240aa9206bc2ea7ab14e05e071275b836502a92aa8c529fc1b137

C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe

MD5 cce8964848413b49f18a44da9cb0a79b
SHA1 0b7452100d400acebb1c1887542f322a92cbd7ae
SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
SHA512 bf8fc270229d46a083ced30da6637f3ca510b0ce44624a9b21ec6aacac81666dffd41855053a936aa9e8ea6e745a09b820b506ec7bf1173b6f1837828a35103d

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE

MD5 09acdc5bbec5a47e8ae47f4a348541e2
SHA1 658f64967b2a9372c1c0bdd59c6fb2a18301d891
SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
SHA512 3867bf98e1a0e253114a98b78b047b0d8282b5abf4aaf836f31cc0e26224e2a1b802c65df9d90dc7696a6dbcb9a8e4b900f1d1299e1b11e36f095ebaf8a2e5b8

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe

MD5 576410de51e63c3b5442540c8fdacbee
SHA1 8de673b679e0fee6e460cbf4f21ab728e41e0973
SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
SHA512 f7761f3878775b30cc3d756fa122e74548dfc0a27e38fa4109e34a59a009df333d074bf14a227549ae347605f271be47984c55148685faac479aeb481f7191db

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

MD5 3b73078a714bf61d1c19ebc3afc0e454
SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe

MD5 322302633e36360a24252f6291cdfc91
SHA1 238ed62353776c646957efefc0174c545c2afa3d
SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
SHA512 5a1f7c44ce7f5036bffc18ebac39e2bf70e6f35fa252617d665b26448f4c4473adfa115467b7e2d9b7068823e448f74410cdcdfef1ac1c09021e051921787373

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE

MD5 39c8a4c2c3984b64b701b85cb724533b
SHA1 c911f4c4070dfe9a35d9adcb7de6e6fb1482ce00
SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
SHA512 f42ca2962fe60cff1a13dea8b81ff0647b317c785ee4f5159c38487c34d33aecba8478757047d31ab2ee893fbdcb91a21655353456ba6a018fc71b2278db4db2

C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

MD5 8ffc3bdf4a1903d9e28b99d1643fc9c7
SHA1 919ba8594db0ae245a8abd80f9f3698826fc6fe5
SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
SHA512 0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427

memory/2544-107-0x0000000000400000-0x000000000041B000-memory.dmp

C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE

MD5 bcd0f32f28d3c2ba8f53d1052d05252d
SHA1 c29b4591df930dabc1a4bd0fa2c0ad91500eafb2
SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
SHA512 79f407735853f82f46870c52058ceee4d91857a89db14868ee1169abd5c0fd2e3fa1ed230ab90b5f479a9581b88998643d69b0df498defea29e73b0d487f3b10

C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe

MD5 d47ed8961782d9e27f359447fa86c266
SHA1 d37d3f962c8d302b18ec468b4abe94f792f72a3b
SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
SHA512 3e33f2cdf35024868b183449019de9278035e7966b342ba320a6c601b5629792cbb98a19850d4ca80b906c85d10e8503b0193794d1f1efa849fa33d26cff0669

C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe

MD5 028aea45f143a63ba70146a4abe2ceeb
SHA1 c616258da4d8a7c9ff7dd5fff089d983d1553e09
SHA256 adc7b8fc26491206149496e2bceaf3686424274f444f14e2dd6fbf2ac7423ddf
SHA512 a266d0e2fd2676db41317622938cc03ff33c1904129d4ba0ef2d97a88313c882e719c8d4798c18a97ca64bc5ebdb90dd05290f25569e967966e2f5399f1f511d

C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe

MD5 d1c48274711d83d4a1a0cfb2abdf8d31
SHA1 b4367dd7201ef0cc22d56613e428efda07da57a8
SHA256 ade1db79870327538841d5470483c6474083f08d871bb7d56cfc9e76971c8640
SHA512 7a3e7927b8be3dc1706e6511bf04475558da076696435f937c4eafa94111c378f3bcaa1ea4e5063e91e3e333c91f086a75baaff6c5cc190d3d314c5eee1687a3

C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe

MD5 452c3ce70edba3c6e358fad9fb47eb4c
SHA1 d24ea3b642f385a666159ef4c39714bec2b08636
SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
SHA512 fe8a0b9b1386d6931dc7b646d0dd99c3d1b44bd40698b33077e7eeba877b53e5cb39ff2aa0f6919ccab62953a674577bc1b2516d9cadc0c051009b2083a08085

C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe

MD5 892cf4fc5398e07bf652c50ef2aa3b88
SHA1 c399e55756b23938057a0ecae597bd9dbe481866
SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
SHA512 f16a9e4b1150098c5936ec6107c36d47246dafd5a43e9f4ad9a31ecab69cc789c768691fa23a1440fae7f6e93e8e62566b5c86f7ed6bb4cfe26368149ea8c167

C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe

MD5 9a8d683f9f884ddd9160a5912ca06995
SHA1 98dc8682a0c44727ee039298665f5d95b057c854
SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
SHA512 6aecf8c5cb5796d6879f8643e20c653f58bad70820896b0019c39623604d5b3c8a4420562ab051c6685edce60aa068d9c2dbb4413a7b16c6d01a9ac10dc22c12

C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE

MD5 f7c714dbf8e08ca2ed1a2bfb8ca97668
SHA1 cc78bf232157f98b68b8d81327f9f826dabb18ab
SHA256 fc379fda348644fef660a3796861c122aa2dd5498e80279d1279a7ddb259e899
SHA512 28bc04c4df3f632865e68e83d045b3ecd2a263e62853c922b260d0734026e8a1541988fcbf4ddc9cf3aba6863214d6c6eb51f8bbb2586122a7cb01a70f08d16c

C:\PROGRA~2\Google\Update\DISABL~1.EXE

MD5 3b0e91f9bb6c1f38f7b058c91300e582
SHA1 6e2e650941b1a96bb0bb19ff26a5d304bb09df5f
SHA256 57c993cadf4bf84810cea23a7112c6e260624beaab48d0e4332d3462900fec1d
SHA512 a4fbe28a0135f4632e0a5b6bd775f8d010250b0fbfe223db1fe81d18552a6bc166ebce807853ba02e6a476e9829454805e415ca828a5e043bd1e63dc53599d0f

C:\PROGRA~2\MOZILL~1\UNINST~1.EXE

MD5 a471aeae6a5ecdbdf978d076551228ad
SHA1 7ae57187319530e84371cefac2271db349431f4e
SHA256 d621284d9f534a8dfb275e2c8d1cd39bb46c025ec687e48e053309e633195944
SHA512 f9840c8f6bdadbf1da8ee7f1806902f7ab37b6d0d531fdb922f409e96a407bc2017541848f5cb9645201a252640d97024c57f5b2b3f6a57dc1bff30874b368a5

C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe

MD5 051978153bcd2b1cf032fa1bf5a82020
SHA1 ec6d1d42905a1c92ccee5f4980898d7a1d72aa23
SHA256 88e90f04db57a472acacf1f4e7616d05a488fc7a1b41a468b357ac4419489940
SHA512 68dec8a12b2c10a9ff83907705c68c77284928d9349a8ba93808d09123752b84944505208d7d71540e340dcbb06e74c79fa24748098308eeecab5f80ab4e8d15

C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE

MD5 0d9146d70ac6a41ead1ea2d50d729508
SHA1 b9e6ff83a26aaf105640f5d5cdab213c989dc370
SHA256 0b876ddeefd88d5e98de7e409c5b6546ba8ffa195c168f9a4b6ba33b44d437ab
SHA512 c9394decfd469bfedd883095d604e11208aa290334ff5c0dce852f2ca74fba27c37ba2984dab8b27430e573681e22c9f903e53b01510a4b77d337cbd92c56cb3

C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE

MD5 8e7b72380cc9ee9bf35c0de5fde4ab3a
SHA1 c19151c331ab274bbf5f6792ca707eb8a7017dba
SHA256 d82ca304cf64be3922b12111c962e09a6ddb2b8477e25b6c3f0400eddc38c80b
SHA512 acff1c08f9c8443d0b0589f5a7d7cab532462788406feba64825fdd2addf5b6cc8e773713e93c98991afbc7e364233fe7cf0659574cebe2200f8f7f818bfe927

C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\181510~1.001\FILESY~1.EXE

MD5 f3228c24035b3f54f78bb4fd11c36aeb
SHA1 2fe73d1f64575bc4abf1d47a9dddfe7e2d9c9cbb
SHA256 d2767c9c52835f19f6695c604081bf03cdd772a3731cd2e320d9db5e477d8af7
SHA512 b526c63338d9167060bc40ffa1d13a8c2e871f46680cd4a0efc2333d9f15bf21ae75af45f8932de857678c5bf785011a28862ce7879f4bffdb9753c8bc2c19b5

C:\Users\ALLUSE~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE

MD5 63dc05e27a0b43bf25f151751b481b8c
SHA1 b20321483dac62bce0aa0cef1d193d247747e189
SHA256 7d607fb69c69a72a5bf4305599279f46318312ce1082b6a34ac9100b8c7762ce
SHA512 374d705704d456cc5f9f79b7f465f6ec7c775dc43001c840e9d6efbbdef20926ed1fa97f8a9b1e73161e17f72520b96c05fa58ac86b3945208b405f9166e7ba3

C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\VC_RED~1.EXE

MD5 06366e48936df8d5556435c9820e9990
SHA1 0e3ed1da26a0c96f549720684e87352f1b58ef45
SHA256 cd47cce50016890899413b2c3609b3b49cb1b65a4dfcaa34ece5a16d8e8f6612
SHA512 bea7342a6703771cb9b11cd164e9972eb981c33dcfe3e628b139f9e45cf1e24ded1c55fcdfa0697bf48772a3359a9ddd29e4bb33c796c94727afd1c4d5589ea3

C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE

MD5 97510a7d9bf0811a6ea89fad85a9f3f3
SHA1 2ac0c49b66a92789be65580a38ae9798237711db
SHA256 c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea
SHA512 2a93e2a3bd187fdde160f87ef777ccd1d1c398d547b7c869e6b64469b9418ad04d887cdfe94af7407476377bf2d009f576de3935c025b7aefbab26fbcd8f90fb

C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE

MD5 9597098cfbc45fae685d9480d135ed13
SHA1 84401f03a7942a7e4fcd26e4414b227edd9b0f09
SHA256 45966655baaed42df92cd6d8094b4172c0e7a0320528b59cf63fca7c25d66e9c
SHA512 16afbdffe4b4b2e54b4cc96fe74e49ca367dea50752321ddf334756519812ba8ce147ef5459e421dc42e103bc3456aab1d185588cc86b35fa2315ac86b2a0164

C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE

MD5 86749cd13537a694795be5d87ef7106d
SHA1 538030845680a8be8219618daee29e368dc1e06c
SHA256 8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5
SHA512 7b6ae20515fb6b13701df422cbb0844d26c8a98087b2758427781f0bf11eb9ec5da029096e42960bf99ddd3d4f817db6e29ac172039110df6ea92547d331db4c

C:\Users\Admin\AppData\Local\Temp\888.vbs

MD5 8be57121a3ecae9c90cce4adf00f2454
SHA1 aca585c1b6409bc2475f011a436b319e42b356d8
SHA256 35d7204f9582b63b47942a4df9a55b8825b6d0af295b641f6257c39f7dda5f5e
SHA512 85521f6cd62dd5bb848933a188a9ddb83dd7ae2c5f4a97b65ba7785c3d58dba27694c7df308f4cf0fdaaa8c55251ff14ed1632e315a16d8d0b15217bac381f72

C:\Users\Admin\AppData\Local\Lock.Adobe

MD5 de6fdff1993c731e52e49d52a6e684d9
SHA1 120d1ff8a24109eed24ac1a5697383d50bcc0f47
SHA256 645c2d0cb9f6edf276f7dead9ab8c72531cdae22f54962d174c1339c30cb1b42
SHA512 99d05bf76a3a7466ccf27ac304ba35639716089d8dae388aaa707bfb6feb3f362251a65951663dd86abcac5a5e7358a5f29faedfe4c0b55ae136ba9d8f1209c1

memory/4628-238-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Troll~Virus.exe.log

MD5 16c5fce5f7230eea11598ec11ed42862
SHA1 75392d4824706090f5e8907eee1059349c927600
SHA256 87ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151
SHA512 153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc

memory/1248-246-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3100-247-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4628-340-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp

MD5 1edc9dd1160c5231fb708e5af18e982d
SHA1 98cefa73fe7c9f8957a73bbad0c760d8167de41c
SHA256 6445be188ada983da0b1428538cde668744a6a7e5774b7cdeb1d9ea05e465310
SHA512 0b78a4a20b7e27d3607ad12df8daa531061d1ef5628a89f02a5073b421af917d785a9e33ee159ba02a72441a3b61662875543d847bba79bd605ca6c831b132cb

memory/4628-350-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3100-352-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1248-353-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\wl.jpg

MD5 bde674be75317ab178ce59d133a4d507
SHA1 996b9b0a0f4bf8234ee95df5beb58614e1b85c67
SHA256 d0bd2c6f0161d2d45473206777634be8a79907cfd5fc45cf6433edc5280ebe63
SHA512 846d133b57254d77b835361ec506a5e99d24ae631f1a0f3ad0c21147629f5c378a2f13e4bbc1f5ca468b9a27f7faf04c055b52edce7bd634a00cc92577e03894