xorist | a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96

General

Target

a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
Size

360KB
MD5

d18e67d2a58494b2c71b89cacffb2194
SHA1

c1ad5621e0c215a31d10f181c0e9ab3871dcf64d
SHA256

a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96
SHA512

b2c1f6330558d77dd87f81470e0fe9c1b9d1849f621be829c67fe8d52e7d2c2304ca68f0a97e0a5cc409f16d0458cf051739fdd43e78c0b453a9ad466723a7b1
SSDEEP

6144:0sNDYMXrZmzkIZxXn+cAhokJ8zlSOC0b4RHHrpncsZzw1RXE2BYrMEhh3WnM/t9L:0CLNbInn+cw8NNiH9ncsNw1DBYZwnat0

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2516-3989-0x0000000000400000-0x0000000000520000-memory.dmp	family_xorist
behavioral2/memory/2516-3995-0x0000000000400000-0x0000000000520000-memory.dmp	family_xorist
behavioral2/memory/2516-7007-0x0000000000400000-0x0000000000520000-memory.dmp	family_xorist
behavioral2/memory/2516-7008-0x0000000000400000-0x0000000000520000-memory.dmp	family_xorist
behavioral2/memory/2516-7009-0x0000000000400000-0x0000000000520000-memory.dmp	family_xorist
behavioral2/memory/2516-7010-0x0000000000400000-0x0000000000520000-memory.dmp	family_xorist
behavioral2/memory/2516-7012-0x0000000000400000-0x0000000000520000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist

Drops file in Drivers directory 8 IoCs

Processes:

a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\es-ES\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe

Drops startup file 1 IoCs

Processes:

a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\R4r5E8RBfwmV5am.exe"	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe

Drops file in System32 directory 64 IoCs

Processes:

a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe

description	ioc	process
File created	C:\Windows\System32\DriverStore\FileRepository\mdmusrf.inf_amd64_ddaa09c6103bc6ce\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_a2dp_src.inf_amd64_0bdbb11733d87f9a\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wsdprint.inf_amd64_b616bed30e8928ca\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\fr-FR\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\1394.inf_amd64_a08737ea39f5790b\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgsm.inf_amd64_d7b1959484ec8228\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\Volume\Professional\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\Speech_OneCore\Common\fr-FR\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\ja-JP\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcpv.inf_amd64_906547002cc7c58e\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\de\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\ja-JP\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\uk-UA\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmjf56e.inf_amd64_07bca0bfd5173050\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bcmfn2.inf_amd64_5ebadf201c5b5845\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_monitor.inf_amd64_f02375bf47a4adb2\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_ucm.inf_amd64_c30468a947db0fa8\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ialpss2i_gpio2_cnl.inf_amd64_a60833fda31e9831\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaus.inf_amd64_f9b71b1d9c8643e2\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvchannel.inf_amd64_ba3e73aa330c95d6\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\pt-PT\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\avc.inf_amd64_0eaf27d749819837\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\de-DE\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_floppydisk.inf_amd64_bc7bd9dca28933ec\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tpmvsc.inf_amd64_9b03a5f041e8d2b2\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bth.inf_amd64_fffc54d66d592d52\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\Printing_Admin_Scripts\de-DE\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\fr\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\es-ES\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_35bbbe80dec15683\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmcd.inf_amd64_43b149b35876b241\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wfpcapture.inf_amd64_54cf91ab0e4c9ac2\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\F12\uk-UA\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Kds\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\it-IT\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcom1.inf_amd64_cfd501781ae941c0\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_7c0c516fb22456cd\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\oobe\en-US\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\oobe\ja-JP\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\Recovery\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\ja-JP\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsUpdate\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_hfp_hf.inf_amd64_0c00f8f3a465c9a4\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmusrgl.inf_amd64_19bd1d6c2b642b6f\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_7080f6b8ea1744fb\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\en-US\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\fr-FR\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mausbhost.inf_amd64_34c86c15777c913b\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsier.inf_amd64_3ae2ea3a55ec0279\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_b96cdf411c43c00c\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\uk-UA\Licenses\OEM\Professional\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\cs-CZ\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidinterrupt.inf_amd64_eeb986311b3a5b16\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaiwa5.inf_amd64_8416dd97e1ecb6dc\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbcciddriver.inf_amd64_400a61104320a399\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\sppui\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\Com\it-IT\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ehstorpwddrv.inf_amd64_220e4fad6c84d016\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\Professional\license.rtf	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\slmgr\0410\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\fr-FR\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aadfilnnaiknaacc.bmp"	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2516-0-0x0000000000400000-0x0000000000520000-memory.dmp	upx
behavioral2/memory/2516-3989-0x0000000000400000-0x0000000000520000-memory.dmp	upx
behavioral2/memory/2516-3995-0x0000000000400000-0x0000000000520000-memory.dmp	upx
behavioral2/memory/2516-7007-0x0000000000400000-0x0000000000520000-memory.dmp	upx
behavioral2/memory/2516-7008-0x0000000000400000-0x0000000000520000-memory.dmp	upx
behavioral2/memory/2516-7009-0x0000000000400000-0x0000000000520000-memory.dmp	upx
behavioral2/memory/2516-7010-0x0000000000400000-0x0000000000520000-memory.dmp	upx
behavioral2/memory/2516-7012-0x0000000000400000-0x0000000000520000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe

description	ioc	process
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\SplashScreen\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hu-hu\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ro-ro\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fi-fi\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\Resources\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ro-ro\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\AppxMetadata\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\Windows Media Player\uk-UA\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\Windows Photo Viewer\it-IT\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_2019.716.2313.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pl-pl\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\Common Files\System\ja-JP\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-gb\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\SmartSelect\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleAppAssets\Videos\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sv-se\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\cs-cz\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pl-pl\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe

Drops file in Windows directory 64 IoCs

Processes:

a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection.Emit.ILGeneration\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_dual_hidi2c.inf_31bf3856ad364e35_10.0.19041.1_none_28eb57ba9670482a\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..pdate-adm.resources_31bf3856ad364e35_10.0.19041.1266_en-us_d2d3ce7d77f34587\r\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-directx-xinput1_4_31bf3856ad364e35_10.0.19041.844_none_298659e19095b66b\r\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..rverifier.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_507eae046d879438\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-admin-gpedit_31bf3856ad364e35_10.0.19041.572_none_ac0702a9c3d2a173\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00050429_31bf3856ad364e35_10.0.19041.1_none_d05691dbbe23299c\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-kernelbase.resources_31bf3856ad364e35_10.0.19041.117_en-us_56376a26153e49f4\f\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_wvms_vspp.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_329d752049b003c2\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-l..fessional.resources_31bf3856ad364e35_10.0.19041.1_de-de_a50685ddae0e0168\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-eapttlsext.resources_31bf3856ad364e35_10.0.19041.1_it-it_1586c3f738d0c57d\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..rser-task.resources_31bf3856ad364e35_10.0.19041.1_de-de_46f7c23e142559e8\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-naturallanguage6-base_31bf3856ad364e35_10.0.19041.1_none_06dff86af4d19f08\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..iencehost.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_52fbb1b86a870614\f\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_system.diagnostics.tracesource_b03f5f7f11d50a3a_4.0.15805.0_none_7fe888873c946868\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-detectionandsharingapi_31bf3856ad364e35_10.0.19041.746_none_21f10bf9715bdc4c\f\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-i..l-keyboard-00000461_31bf3856ad364e35_10.0.19041.1_none_a787537137f69bc6\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.WebHeaderCollection\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_c_swcomponent.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_42cddbf20ce2839a\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_ds-ui-ext.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_76a9f2508c964d9a\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ingshandlers-gaming_31bf3856ad364e35_10.0.19041.1_none_b13f86f373618376\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wmpdmc-ux_31bf3856ad364e35_10.0.19041.746_none_cc5cbb9556301da3\f\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\msil_microsoft.powershell.commands.utility_31bf3856ad364e35_10.0.19041.1_none_4525b961676e6182\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ISECommon.Resources\v4.0_3.0.0.0_es_31bf3856ad364e35\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ilenotify.resources_31bf3856ad364e35_7.0.19041.1_it-it_fad7e364135764a4\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..clientsku.resources_31bf3856ad364e35_10.0.19041.1_en-us_435f0fb5c1db539b\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ui-biofeedback-library_31bf3856ad364e35_10.0.19041.746_none_e001faf79e7a1547\r\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-dxptasks-sync_31bf3856ad364e35_10.0.19041.1_none_4eefb5d2815eeb9c\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-s..t-tracker.resources_31bf3856ad364e35_10.0.19041.1_es-es_e605cd84358188a2\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-i..2platform.resources_31bf3856ad364e35_11.0.19041.1_uk-ua_6c6234ba4e286635\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-com-dtc-setup_31bf3856ad364e35_10.0.19041.746_none_76199c1c412ad571\r\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..assistant.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62438fb5f8bbc7b1\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..cingstack.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_717b107bf166ac34\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-uxinit_31bf3856ad364e35_10.0.19041.1_none_1346fe218b9024fc\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_netfx35wpf-system.windows.presentation_31bf3856ad364e35_10.0.19041.1_none_3b5cff45a7566775\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_windows-application..nd-timebroker-winrt_31bf3856ad364e35_10.0.19041.746_none_d32e9c2f3574618c\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-creddialogcontroller_31bf3856ad364e35_10.0.19041.964_none_153b220df68af98e\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\SystemResources\Windows.UI.AccountsControl\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_dual_net8185.inf_31bf3856ad364e35_10.0.19041.1_none_96b6a763fa59d2f2\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_9e8f8d77439e2f97\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..rvice-daf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_4be48725b2499112\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..cemanager.resources_31bf3856ad364e35_10.0.19041.1_de-de_ae843aecd74a2a2e\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wdi-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ec3ae361a06c0221\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-win32k_31bf3856ad364e35_10.0.19041.264_none_96d51a9cf96821f6\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-csrss.resources_31bf3856ad364e35_10.0.19041.1_es-es_9aa21fd0b555d920\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-dskquota.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_e0fef0cf2d145e23\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user.resources_31bf3856ad364e35_10.0.19041.1_en-us_10e060ae0a92fbc1\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_bg-bg_dd016b0b9ea8d750\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_system.data.entity.design.resources_b77a5c561934e089_4.0.15805.0_fr-fr_1198d81c8911a395\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-msauditevtlog_31bf3856ad364e35_10.0.19041.610_none_afaadb8f0b8a9278\r\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-s..nnectedaccountstate_31bf3856ad364e35_10.0.19041.746_none_d79dc91ea424c11c\r\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_bthspp.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_dadca33145a42bc2\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_hyperv-vmemulatednic.resources_31bf3856ad364e35_10.0.19041.1_de-de_203ca664578377b7\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-enrollengine_31bf3856ad364e35_10.0.19041.1266_none_0da9b93573cd9ce7\r\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..tion_service_iassam_31bf3856ad364e35_10.0.19041.1_none_31a07115f317ca01\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-directx-d3dcompiler_31bf3856ad364e35_10.0.19041.546_none_d1a00ba6af407536\f\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-directx-direct3d11_31bf3856ad364e35_10.0.19041.1202_none_6ecd2612b74330f8\r\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..-domain-clients-svc_31bf3856ad364e35_10.0.19041.964_none_21f025fe4ae682b3\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-nbtstat.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_13e49f9dadecf0a7\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-runtime-mediaframe_31bf3856ad364e35_10.0.19041.746_none_4b923aa3058360ed\f\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.19041.746_none_a47144c464d15475\f\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.19041.1202_none_f4a35974d85ff180\HOW TO DECRYPT FILES.txt	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe

Modifies registry class 10 IoCs

Processes:

a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YUMODILULDNZGLE\shell\open	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YUMODILULDNZGLE\DefaultIcon	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YUMODILULDNZGLE\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\R4r5E8RBfwmV5am.exe,0"	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YUMODILULDNZGLE\shell\open\command	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YUMODILULDNZGLE\ = "CRYPTED!"	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YUMODILULDNZGLE\shell	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YUMODILULDNZGLE\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\R4r5E8RBfwmV5am.exe"	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.shadaloo2	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.shadaloo2\ = "YUMODILULDNZGLE"	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YUMODILULDNZGLE	a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe

C:\Users\Admin\AppData\Local\Temp\a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe
"C:\Users\Admin\AppData\Local\Temp\a5663a1281ae0cb8fc8e858f00b3a5b6cc6084626ec9d07a2d2e226d5df4fb96.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\HOW TO DECRYPT FILES.txt

Filesize
383B

MD5
eca1b2db16019e4cd5ffb7bdfca70551

SHA1
719412e310b24357626c64247bd984c9830a24ce

SHA256
580d3b111bf25c4db730da0274d08f90c104a4061c0a255a70c4f7a1ab2571a5

SHA512
821314a4c2e3dd02a55b72519018cbc9e4268e0ba046b8aa1ac0f8fcd2fa2a270a8a5173263eae090c74db31e81248b207bd80fe0ee487deb2a66d6d792e8759

Download Submit
memory/2516-0-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/2516-3989-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/2516-3995-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/2516-7007-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/2516-7008-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/2516-7009-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/2516-7010-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/2516-7012-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads