chaos | 3730e9cba4a93bc985ef7cd2368ccbf5eccd4724f514b38b20e320e5553dd08d

Analysis

max time kernel
1888s
max time network
1889s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe
Size

71KB
MD5

8f033c07f57f8ce2e62e3a327f423d55
SHA1

57ac411652d7b1d9accaa8a1af5f4b6a45ef7448
SHA256

6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b
SHA512

f3712e7d5d55b27a4c20de07cce136e6d58ce62fa146d29b34dece6248e4456139703c50df10cb318346311cfeee0a8449d49163e821744efcde3ecfe8b880df
SSDEEP

768:zncoLkaCbCq2l52DbnoPV0Yglwlu1y7e7th3BuItxn:QoLkaCb12l0DbCV6Wqyixn

Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Restore_Files.html

Ransom Note

<img src='https://odkrywcyplanet.pl/wp-content/uploads/2020/05/galaktyka-Cosmos-Redshift-7.jpg' alt='' width='235' height='167' /> A S T R A L O C K E R 2.0   What happened? ---------------------------------------------- All Your files has been succesfully encrypted due to security problem with Your PC. All Your backups are deleted, or encrypted. Can I recover my files? ---------------------------------------------- Sure! But You need special decryptor for that. If You want to recover Your files, you need to cooperate. What can I do to get my files back? ---------------------------------------------- You can buy my decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer. The price for the software is about 50$ (USD). Payment can be made in Monero, or Bitcoin (Cryptocurrency) only. What guarantees? ---------------------------------------------- I value my reputation. If i do not do my work and liabilities, nobody will pay me. This is not in my interests. All my decryption software is perfectly tested and will decrypt your data. How do I pay, where do I get Monero or Bitcoin? ---------------------------------------------- Purchasing Monero or Bitcoin varies by country, it's best to do a quick google search yourself to learn how to buy Monero or Bitcoin. You need to pay 50$ in Bitcoin or Monero. You can buy Bitcoin here: https://localbitcoins.com/ Where i can pay? ---------------------------------------------- Monero Address: 48CEU93NRDqCmH3qfksLRLeQJ9mjbFCUXEyZkStiRDWtDodmAtd7voHF1sHa17MgmoYmMoErrJstV6nC1DqYoKxT38r6TUh Bitcoin Addres: bc1qpawwquwas0gd88u66hgxp222p52madqp5lk5xw Contact ---------------------------------------------- After payment contact: [email protected] and send Your personal ID with transaction ID (if you are paying with Bitcoin) Warning! If you report these emails, they may be suspended and NOBODY gets help. It is in Your INTEREST to get the decryptor. Your personal ID is: ID12_Yashma 1)Don't change the extension of the files. You will harm the files. 2)Don't move encrypted files. 3)Don't try to recover files by Yourself. This is impossible. Your files are encrypted with Curve25519 encryption algorithm, You can't decrypt files without private key. 4)Don't report to authoritaries. If You do it, key will be deleted, and Your files will be encrypted forever. 5)The price will be lower if you email me within 24 hours after encrypting your files.

Emails

/>[email protected]<br

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 3 IoCs

Processes:

resource	yara_rule
behavioral16/memory/2368-1-0x0000000000DD0000-0x0000000000DE8000-memory.dmp	family_chaos
C:\Users\Admin\AppData\Roaming\svchost.exe	family_chaos
behavioral16/memory/2324-8-0x0000000001070000-0x0000000001088000-memory.dmp	family_chaos

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

1888 bcdedit.exe
1724 bcdedit.exe
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

1644 wbadmin.exe
Disables Task Manager via registry modification
evasion

pid	process
1888	bcdedit.exe
1724	bcdedit.exe

pid	process
1644	wbadmin.exe

Drops startup file 2 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Restore_Files.html	svchost.exe

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

2324 svchost.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2324	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	svchost.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MZGHW204\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Ringtones\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2660163958-4080398480-1122754539-1000\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\U0AIBA2P\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AFPGXSZI\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JAHTY535\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\4TWWWYKL\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K9RFKP48\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\L0CT0ZLQ\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exe

pid process

2792 vssadmin.exe

pid	process
2792	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b0000000002000000000010660000000100002000000019524a77074ec56c9e1e5a8351c5e60b7d2e54ddeba4a66e4582e19d46f90eea000000000e800000000200002000000012ae6c29764678b461560d9f353c5f277dd404c9557d539ebeb3e174ed64c68f200000008974bc31b6b3179ed3c1860aa9bdabf31446886cc071b5b8deb564e009893f854000000082487fedd6aafbe208a633fc353f19d6208380aa5379e88d004b6e2ba4eb5d892c3b58c3c61f47633f72d4379b2b365426b5b98c9e7b270166da5009a6c7318a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b0000000002000000000010660000000100002000000026b3d791a9cded269f7453376a75398b8a37c024c101f59e77157b4cf77874ac000000000e80000000020000200000007d8d6076e99929922d1474be0d2310a31a39171ca1fc36ef0079d4b8ce490ab590000000c4a8bab385a88228e9acd2932b06728fb22751de7da563f2356f72796a450618018b97d3d7aec12cc47fddd1237b118ce28f01719cb4a044a751cec4d0385afe62545146829e7b7cf6ccb04e978b3927626def13332b9efeae31da4d826f9cdaed401ee476d0b8f710614c91ec0e7fb46c532bc2f631d2355f2977b9c72a43a17885e00370a2225b0f300a20dc39cd4440000000eabd443255d1093b887e2dbfed12c6d1b7b49eb96f711470620e59be03f4ebf55a7aa26446c4e8f140f12c1bed0c912771560a09128302f6a80846a138256dde	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{099F3A01-4352-11EF-86AA-DE81EF03C4D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427282377"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0c611e05ed7da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427284178"	iexplore.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exesvchost.exe

pid process

2368 6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe
2324 svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exesvchost.exe

pid	process
2368	6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe
2368	6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe
2368	6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe
2324	svchost.exe
2324	svchost.exe
2324	svchost.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exesvchost.exevssvc.exeWMIC.exewbengine.exe

description	pid	process
Token: SeDebugPrivilege	2368	6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe
Token: SeDebugPrivilege	2324	svchost.exe
Token: SeBackupPrivilege	2704	vssvc.exe
Token: SeRestorePrivilege	2704	vssvc.exe
Token: SeAuditPrivilege	2704	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3036	WMIC.exe
Token: SeSecurityPrivilege	3036	WMIC.exe
Token: SeTakeOwnershipPrivilege	3036	WMIC.exe
Token: SeLoadDriverPrivilege	3036	WMIC.exe
Token: SeSystemProfilePrivilege	3036	WMIC.exe
Token: SeSystemtimePrivilege	3036	WMIC.exe
Token: SeProfSingleProcessPrivilege	3036	WMIC.exe
Token: SeIncBasePriorityPrivilege	3036	WMIC.exe
Token: SeCreatePagefilePrivilege	3036	WMIC.exe
Token: SeBackupPrivilege	3036	WMIC.exe
Token: SeRestorePrivilege	3036	WMIC.exe
Token: SeShutdownPrivilege	3036	WMIC.exe
Token: SeDebugPrivilege	3036	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3036	WMIC.exe
Token: SeRemoteShutdownPrivilege	3036	WMIC.exe
Token: SeUndockPrivilege	3036	WMIC.exe
Token: SeManageVolumePrivilege	3036	WMIC.exe
Token: 33	3036	WMIC.exe
Token: 34	3036	WMIC.exe
Token: 35	3036	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3036	WMIC.exe
Token: SeSecurityPrivilege	3036	WMIC.exe
Token: SeTakeOwnershipPrivilege	3036	WMIC.exe
Token: SeLoadDriverPrivilege	3036	WMIC.exe
Token: SeSystemProfilePrivilege	3036	WMIC.exe
Token: SeSystemtimePrivilege	3036	WMIC.exe
Token: SeProfSingleProcessPrivilege	3036	WMIC.exe
Token: SeIncBasePriorityPrivilege	3036	WMIC.exe
Token: SeCreatePagefilePrivilege	3036	WMIC.exe
Token: SeBackupPrivilege	3036	WMIC.exe
Token: SeRestorePrivilege	3036	WMIC.exe
Token: SeShutdownPrivilege	3036	WMIC.exe
Token: SeDebugPrivilege	3036	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3036	WMIC.exe
Token: SeRemoteShutdownPrivilege	3036	WMIC.exe
Token: SeUndockPrivilege	3036	WMIC.exe
Token: SeManageVolumePrivilege	3036	WMIC.exe
Token: 33	3036	WMIC.exe
Token: 34	3036	WMIC.exe
Token: 35	3036	WMIC.exe
Token: SeBackupPrivilege	1672	wbengine.exe
Token: SeRestorePrivilege	1672	wbengine.exe
Token: SeSecurityPrivilege	1672	wbengine.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2472 iexplore.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	process
2472	iexplore.exe
2472	iexplore.exe
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exesvchost.execmd.execmd.execmd.exeiexplore.exe

description	pid	process	target process
PID 2368 wrote to memory of 2324	2368	6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe	svchost.exe
PID 2368 wrote to memory of 2324	2368	6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe	svchost.exe
PID 2368 wrote to memory of 2324	2368	6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe	svchost.exe
PID 2324 wrote to memory of 2780	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 2780	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 2780	2324	svchost.exe	cmd.exe
PID 2780 wrote to memory of 2792	2780	cmd.exe	vssadmin.exe
PID 2780 wrote to memory of 2792	2780	cmd.exe	vssadmin.exe
PID 2780 wrote to memory of 2792	2780	cmd.exe	vssadmin.exe
PID 2780 wrote to memory of 3036	2780	cmd.exe	WMIC.exe
PID 2780 wrote to memory of 3036	2780	cmd.exe	WMIC.exe
PID 2780 wrote to memory of 3036	2780	cmd.exe	WMIC.exe
PID 2324 wrote to memory of 2028	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 2028	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 2028	2324	svchost.exe	cmd.exe
PID 2028 wrote to memory of 1888	2028	cmd.exe	bcdedit.exe
PID 2028 wrote to memory of 1888	2028	cmd.exe	bcdedit.exe
PID 2028 wrote to memory of 1888	2028	cmd.exe	bcdedit.exe
PID 2028 wrote to memory of 1724	2028	cmd.exe	bcdedit.exe
PID 2028 wrote to memory of 1724	2028	cmd.exe	bcdedit.exe
PID 2028 wrote to memory of 1724	2028	cmd.exe	bcdedit.exe
PID 2324 wrote to memory of 1944	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 1944	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 1944	2324	svchost.exe	cmd.exe
PID 1944 wrote to memory of 1644	1944	cmd.exe	wbadmin.exe
PID 1944 wrote to memory of 1644	1944	cmd.exe	wbadmin.exe
PID 1944 wrote to memory of 1644	1944	cmd.exe	wbadmin.exe
PID 2324 wrote to memory of 2472	2324	svchost.exe	iexplore.exe
PID 2324 wrote to memory of 2472	2324	svchost.exe	iexplore.exe
PID 2324 wrote to memory of 2472	2324	svchost.exe	iexplore.exe
PID 2472 wrote to memory of 2912	2472	iexplore.exe	IEXPLORE.EXE
PID 2472 wrote to memory of 2912	2472	iexplore.exe	IEXPLORE.EXE
PID 2472 wrote to memory of 2912	2472	iexplore.exe	IEXPLORE.EXE
PID 2472 wrote to memory of 2912	2472	iexplore.exe	IEXPLORE.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe
"C:\Users\Admin\AppData\Local\Temp\6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:2792
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3036
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1888
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1724
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:1644
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Roaming\Restore_Files.html
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2472
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2472 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2912

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2704

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:840

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9824357e1a9ea9526f0e76d3120342b

SHA1
d2ba2dd1a219d278c0891233e823f370cc1f0fdd

SHA256
348a6a5f4e32ce954af345a5532e276160f4e593f6a5b18c3770809fe09b2bff

SHA512
47e40d13a75e93f30be545ed3b9a9088f1557a765268c9f2fbc9c29401a49a34d3ce2da0d0461258b4f5418b5f7825d39252b0e044b3b6960bd6d753d7442a5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a4238d0bfb2a47b1e434042b2250f9a

SHA1
91330e064a738468f9dfcdffee08fba5d407f864

SHA256
13ecc6a104f2e2e5302e8cbc65c154c4562b23848e6ff7e8526088c2dde3c663

SHA512
3281b7a6adf22562e696f33e71a8076d1948c7d18797812531316c08739981640f283a6a6eb8ee008ab5685b9519fcad94cf8711c8fe914f519ec383e49ca03e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
114cae1b5877d48038c026f6ebd042d2

SHA1
a684ab775aebaed1906e887d3a4b51af14bdb476

SHA256
4f0a6f28ef13ea779096835e0c9f478486430872dce3e74acf50c03810dfebc2

SHA512
687a66c66a0973339f01cf03fbb3695090f00e65cd93b4d199e3bb4150600d5c6693b3f889831a042d98f9cddb2fa754682afa61a75816cb1fa7fc72364fd8b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1eb5bfad146cde52afa048b6049199a

SHA1
e65dfaca6ca5a750c706dbaadaedfc288a8200cf

SHA256
5af9da04a7942c7819ec733fad6405add661bfa91f2017d50686ccc4b8e04590

SHA512
fe2d2f39cbafbb76508662ceb970aa668e7388507f861b8506dabc515c3a2f71a97e5504fb939d549639efecd93cf206743cbabe9dc3a2e27c8eee89dc443edb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
768f8b2fdf3ca2b1e9a5248413dd35c3

SHA1
f0860f436a53c4cbe0ac2f42cd826c2398dc670c

SHA256
8e3f4c171dd4807fde79850e2a47865df461d244b2f3333b925b7af37364363f

SHA512
6eb8616627b76a14072ab4c52a967997fd5be8a14aedc2c837c648cdfe584199b24c12a9b243c354c3248c827559cd988522593c8ab2349a5b2b5d607879b863

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f4e0eaa8c86adc6318b746e1c60cfa6

SHA1
e97f59eaba955010cd33194f9810a50d5a3e0f54

SHA256
c17adf5ed8d376a95473a9186c555910443ac8dee1f814e917d95fbbcc26fb29

SHA512
335929ad0f25069efa01454a89834c9a3e74a57547564e4b31cc4ea61c340338dc92d9d4649369be49455b6545855a9b9b80c200c7f5eb5664f6e2bd52edbcdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b56ec1fa064f4041a83969a23914605f

SHA1
4d59df3c285d25742e94a0933cdd04eb980a30af

SHA256
935c4bb315f1b1837e3edb2e5b4395a8d34aed45686abd2a20c2cc07eac2c72e

SHA512
7cc04b42394e5cda2d1d2289c2f77d9cec891eb6bc8832125b8a23362209455a072921a8aa80ce432321134fa6db17e55fa31cb8f060bcd5afad3f2ef8b35879

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ad524642fac1fd196fb39a1c2881f5a

SHA1
313ea6e43e9603a2ee6276353a27690c141d9036

SHA256
8a2ebed5cdd52ac7101e5c3d1a67d840839e79195d795197077fe060651cdce9

SHA512
49b4a6f38c9eb7a1396b2317d85d7e2662ed6d880b02939a5ac6703f4688556e9f439a6149333971ed82b256d623f6a92de12762d840554de9b38bbf8b55c249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8b8805138aa1ba237472c3077979da9

SHA1
a1b9549d339b40ea512f5b69f95168d6984a4d33

SHA256
c8379cfb95c19a0987b763131cf76892e6820df0d5f58d0e0344943988975590

SHA512
f01f23593f9a87862fc23d5010136511131315f452143e6953ebf11e5e8afc5e3c9d1f34b9cbc19911f0e07bfbebc08a22fd7f9ab450b35ac2940e2e62e4d6de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a725641f111adda9db628720daeab159

SHA1
96cb4cbae22aca38a4bbf390120c96bc3d4a41fb

SHA256
38c0eb118838d520211973f11866aaa435006ce8ef92f1d70ddb32cc86a394e2

SHA512
12f9afcbf7ec30203e1059299512c2f98f12c1a9dcddf56b399d0b5b6591572fcf5c83124bc3f3650216973388ca3cc7decde2b600969dc1e456527d6858fdac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e58ea767d9c313eca6144bb7b3516e6f

SHA1
1f63d942926520819c56a5a783a0b5ac930faa15

SHA256
856071b831161c59a23a18ecc411193283b06a4c734dd15e2488abc244e25bf2

SHA512
ff30be3c9940f0dd3c295cb50797402872f3e0f85bef5e6f766d0f624ce478ad7cb25867f8a88f32412286e1105ce3a32615acb2330479022f05d41258014e3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5917b833fe9686170c34a852ed88c488

SHA1
de8ba5ffb5718ca60fac412d4b5ba32ef003075c

SHA256
9ba93f8d7901efed1888b83ae0dc0a0d552f11bae805e8893d7cb9a642e56558

SHA512
923c253bcab299ae4213bd3eb318b87f3f6a8376a727020e362cea439e56cf1b379bcd7be28278785a3ae49e010d7d21d7ef10a112ded69be9974c3ffe8d9c6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bcec5a63a1d0eb4604e5b885e581c8a

SHA1
ade37b0bd108460f0c664c175855b378c0214627

SHA256
65f38f4f7b76825e8613816fe32bc1c1d30ea7e367ab4a8aa3a881b2610a37c6

SHA512
9944e830881c5a1de878b1cdaab44bc2203d8cd0f45d35f4fa17ea45247656c60d6f6c738b78e1f0c878583e34c61f7a6510359ea186fa6876d7fd170d997db4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a52b22156fc0f5de334e691e3f92c358

SHA1
f44c3af50a1ad07f56de3cce54ea6b5ceebe66e2

SHA256
7b05ad85aeb039b1e6a80c51f9a74c963ec46159836e30accf13f8584829a59f

SHA512
3d882415f703a6669d9ea38c505bcee26ca852c3c605c3dd0244d5463f90f7d6e16e47331a1a4554a5eba24b941e3de55f5c95d1ee5b6e1e77849a622fb1e3c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e3ee8f62992e8d904343563216ed502

SHA1
029f7cd375332c4126299b1ad1a0fdcada7871f7

SHA256
e3d3a06fa00732b4a988eb4fc7deca98183569c549b052725911e1874318d947

SHA512
c16df10ee55d195194c5b8b35978c94f0eca79d3733b3f547ca881ba14a1e753218e75012c2ce256194bc622fc8bc5e88ea53618ff7ee4590f20dbae86ab6602

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37cc2550830d66c2628330c502fd6937

SHA1
c237b59717b8c22b46618bb0b2330fc8ea164dc4

SHA256
cb9be874abf72a63f89dc1d3032a989ba6844f740728097e8d2eb08638cce369

SHA512
fc56b8460050dfcb2c94dbdc772ee442cfd8292e387d550c59ba15c82df1369a77af30f05a641ecd8111c3250c22bd5419783b2a753cba5b561448da5569bc43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1c7dc9df4ca4463fc8e1b43c4e3a832

SHA1
50527bee95a76a0357bc655d00d18000cde43602

SHA256
cfd8aa284ba49c798d6fd7ad5f8f87abb5eb1e936a61f4ac79f83a090309e3cc

SHA512
5158b601aece94bf6fb7a784f546cd0df085b3a279e2deff8b610390808e449c6605275be7acede114da8d54b9eee8856835fa5e763177d7c51402091214814f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5de121926ea3e119a1fe9c338ab025ab

SHA1
a5352fb6072bd653bffbe3a4dcaf4e495f8c389b

SHA256
fb651aec1f4ee2f8fdc6b2a1d97c5a23cbbb4dbdacf37912e4792a0352c9d574

SHA512
529a2db70de2320714e7fe6ffd10ac3a47072f6e4ceb010b941a99c433a02abfca3d606c291e4a9bec95238466df65c73cfb376f92a80cb7c6d8886e4dda1a94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a4faa2409fc6f7be456ccf8e946297c

SHA1
015a505a33c1cbb21e00fbde04b4abeef0bdb9f5

SHA256
1b5f320e2f3ca10709111639ac382e55239e4f41129a0ea742c6f8463913e330

SHA512
43fa97f7fcd7796bf06f48c0c743c776dcea33d291ea9adea86fb365ca62b14c5b4601d94730d851422d251204f4c665d301bbdb994b414eebdf571328c13980

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5b077cb691f49ac4f30d7cdd42719eb

SHA1
e2f71ad50b4eec177d6ca3648a21bafc0d02523d

SHA256
7afe8b1e1be1174c78246150186fc43f09978c6da58771119b0c2c108ed339a4

SHA512
0eee33ec03ba110e2e419f0f5c8a926b8b789a298396bdd61c85ea7c684a597d99f2d8d7ccc5d8ee7da59d7c4eee14c378f2f3b96682b5d55d8fe920215ddb3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
146c5a132e4c9452c6e13098451a43b5

SHA1
3e6f5ef2d3d1d4daa38012753ac6c5dc24589ba9

SHA256
8d065dd0cfa5ba9fe4c9d2686a8990619a5cebee400306d9be6666c3a304b0f2

SHA512
c50feec7ea2d2578742d9027aae5b172ae72079ffd03c99106c46bae967210f0023aa3d1e44a866cac77ac2f2b1614cad1314ba67d1a62bc27348a1a1e0971ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d96b2ab185ac5fabae4806be70d34e2c

SHA1
852c448a2f206bda16ef6c3054469afacc0b61d4

SHA256
1a4984da8078707084f0d4827d16162e280a010d73b35b747a94d40f3c4e8845

SHA512
c6db8dd5f9248b5f33321d3ec9c38017d3ed86b9c4a0c9f8b7bcbc465fb646899dcd4aec48380f258b989756a97295e1dbefa42562f028770e69611d227a350e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b630698864c88413974ad4e5c084eb0e

SHA1
eaa76f1e37d6a7eb8af62bf14f7320e72991933a

SHA256
f7f0d9c7e102e43d5f9eccce4edaf571d2a4a2bc4d998ddc3bed9cb0519be40b

SHA512
3e3d1d5b4d0b39decb694a8670518ad9c6b8ea262b1e7fbd3c844db5f1ab7ed600781a75b09b56217152cd6211bc7f78fbab6c802c1f4ca03d76ef4cace63461

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
775b75464f2265eedd7a61b4ee1728ad

SHA1
9d3c305690eb9afc74f5bc3cd1d2605b34c81063

SHA256
250f41a941be9895b013a29d53fc56e49c7730139e4c117eec9aab7878da61f2

SHA512
652c4af51eed4fc57a953bb04552398d32afde23c2389e9c53f36a01fc5a21925232b20b01c0f9e2c9a91ecb3175df8885e44e8a7d750c89dc6c5db748bc39ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddfec18c5ed6f1bdd0328fbacfe65f41

SHA1
9974d624970777e5f1664eec23671c3b7377f9e9

SHA256
e4900fe1dfddd266e8ee624f0e96ea375ace11708bee4a71a92176bf494adddf

SHA512
cdd3d684de1ae92d63dc24f2a1114d2c7af836b0e830605e6178de8f09ae9c65556369cb3b43588f94de32c9a4221c6673b062937df0f1ff3d8abe6e5d0971fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0280972edda2d2a0b0b4eafe932a9fb3

SHA1
1eafecb746215fa2a5b0223c556de3ea7c8902df

SHA256
2c4822920b99b5652c7ca002383a3f2e11c57eaf71249436dd113d7bf1d5c4e8

SHA512
0be6ec08894be87855ac9dc846b5ed558e8ab060687770e40d74b94cb3e2d443f7c2e51c6940cd28af60a8e8c24d23cbffb4770b85efc7bc55ab8b01a3da2eb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
216ffbe539b98c87dc2a273bceac2ee1

SHA1
75dd09158f50f00334eed5cf645e8f755c47441b

SHA256
6d6f3edb068acc555f707760e447401f3b30c1e9d695e24337add900dae4a761

SHA512
77b3337fe1c7c9370464312b968f05ae7c70b4361a434bdf852fc67ce5511e98db94f937c0d1ec17a9fb3105598bfc62a4f26f653142af85cc436e2746f07ed4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec32862a558264bed10ca8587eb97b32

SHA1
58d7968bc2bb512f62d1f59563c6c5ec294a1892

SHA256
52abd0e432a3e65b69c795f5ee7e876fcc4e51b60c72a905b94a0c3db97a6839

SHA512
c535a8ca04ea28e34d6aecb41c7aaa93cb8b8fcc8994513199f3b727c2a2207ae76fd78ec3bee166268ccf92b806032ce86ea0a46b16e1d2f1bd98980ad2322f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Restore_Files.html

Filesize
3KB

MD5
cf0cc6e9f7b71141a348d2f8a9cc800f

SHA1
bd198c4263359f42901ee30c3c24fc0ee8b2bd9e

SHA256
5a78197d3cd89269832678d0a59244b21fb0d6a8a87c2a080f68975e9c2febb9

SHA512
4dd5ff23ba3401ffc050e34dd83f37aeef6e4e24ff29809309ddd40ffce4b4b9cab2764f53dbf843c4cf870e37590ece34c98d7bce9f50b193f632a3b1db38de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab37E5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar37E6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
71KB

MD5
8f033c07f57f8ce2e62e3a327f423d55

SHA1
57ac411652d7b1d9accaa8a1af5f4b6a45ef7448

SHA256
6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b

SHA512
f3712e7d5d55b27a4c20de07cce136e6d58ce62fa146d29b34dece6248e4456139703c50df10cb318346311cfeee0a8449d49163e821744efcde3ecfe8b880df

Download Submit
C:\Users\Admin\Desktop\LimitRename.htm

Filesize
1B

MD5
d1457b72c3fb323a2671125aef3eab5d

SHA1
5bab61eb53176449e25c2c82f172b82cb13ffb9d

SHA256
8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1

SHA512
ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0

Download Submit
memory/2324-10-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/2324-8-0x0000000001070000-0x0000000001088000-memory.dmp

Filesize
96KB

Download
memory/2324-11-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/2324-1359-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/2368-1-0x0000000000DD0000-0x0000000000DE8000-memory.dmp

Filesize
96KB

Download
memory/2368-0-0x000007FEF5E13000-0x000007FEF5E14000-memory.dmp

Filesize
4KB

Download
memory/2368-2-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/2368-9-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download