b8c1f3abe165e1bab5616f0b739f1cb53c642c40ffc92f9f26aec1a73eaf0de2

Analysis

max time kernel
238s
max time network
177s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

encoder2.exe
Size

328KB
MD5

3ef478a7c898e91f09385da44555d986
SHA1

07c1f289891b59892ae45253ffdc969f11267ac5
SHA256

1d241bd0b71408abcf11871a9318cbfcd925b195814951c3123abca27554c6f4
SHA512

e67b411fbc1a05a6482b03d8320fad0bd08836c5fa651b435473ee3233bb62240c1ffaab1ede7f58fee9eee70f4e313a230411a143495e2d30826546148cd4d1
SSDEEP

3072:uhl75wtMO7RTbcA6Ao7A75PeunlG7m//5/vZ/5TVk5ixJNe4yg6bMtJWPhyhMvcc:E5sRXcTAmEFRJ/525caYzfpCHFc8j

Score

9^/10

credential_access defense_evasion discovery execution impact ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (7777) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 16 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	ioc	process
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe

Drops file in Program Files directory 64 IoCs

Processes:

encoder2.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Pitcairn	encoder2.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15059_.GIF	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00439_.WMF	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00807_.WMF	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143754.GIF	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7FR.dub	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\NAVBRPH2.POC	encoder2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boa_Vista	encoder2.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Lima	encoder2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18202_.WMF	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLJRNLR.FAE	encoder2.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png	encoder2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099180.WMF	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\VelvetRose.css	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLADDR.FAE	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PNCTUATE.POC	encoder2.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv	encoder2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif	encoder2.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Orange Circles.htm	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0304933.WMF	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OSPP.VBS	encoder2.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DECRYPT_INFORMATION.html	encoder2.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Panama	encoder2.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\DECRYPT_INFORMATION.html	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0158477.WMF	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02265_.WMF	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18211_.WMF	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0158007.WMF	encoder2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar	encoder2.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png	encoder2.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\msado26.tlb	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.PPT	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBCOLOR.SCM	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART4.BDR	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AppConfigInternal.zip	encoder2.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png	encoder2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14866_.GIF	encoder2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02028K.JPG	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0285360.WMF	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0229385.WMF	encoder2.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287644.JPG	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00014_.WMF	encoder2.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png	encoder2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF	encoder2.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB9.BDR	encoder2.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Dawson_Creek	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21518_.GIF	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LTHD98.POC	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS_K_COL.HXK	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormToolImages.jpg	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\RESUME.DPV	encoder2.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\README.HTM	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382962.JPG	encoder2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Apex.xml	encoder2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

vssadmin.exeIEXPLORE.EXEvssadmin.exevssadmin.exevssadmin.exevssadmin.exeencoder2.execmd.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.execmd.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	encoder2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe

Interacts with shadow copies 3 TTPs 14 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	process
35748	vssadmin.exe
37012	vssadmin.exe
37180	vssadmin.exe
36332	vssadmin.exe
35492	vssadmin.exe
36952	vssadmin.exe
37016	vssadmin.exe
37072	vssadmin.exe
37132	vssadmin.exe
36920	vssadmin.exe
37084	vssadmin.exe
35908	vssadmin.exe
36016	vssadmin.exe
36004	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0023d275e13adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A14073C1-A6D4-11EF-93F4-C28ADB222BBA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000ebd4116b273984cb4f552b735cb3ddc0000000002000000000010660000000100002000000005b00dc0f6ffff6ab217b5e28a9ead6bdda4c21b64c9806d0ee00d6e49eb2c2b000000000e8000000002000020000000a2d87bb51c3b5bd7f99b4b9278e481ad2b79baeaded791cbcfeac74e821f68ad200000006c8d78ef7dd5f2e2694b8fd1df8c647d9ad24e581c6c75ff088706dc7d9ade8a40000000603d7e3b5010efdd481bb50295cce24656a8b822d720be64d6fcf7ded90147925ce6a84904cae0e94d720a4825cf8071c3f868af4f5e640e95b53216df68182a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000ebd4116b273984cb4f552b735cb3ddc00000000020000000000106600000001000020000000a36051d0427a4ad00b6f05b68f436511eaa79c9707c6796f15bc8ee3cdbd0d56000000000e8000000002000020000000f95a831349776e51b4658886579129bde65619c943068f468511d5ac5bd5f19690000000b5e61bbf49ee4a041e07f22bd0ac1e97b1f839ad949a79f6093b7798b9c576ae8d5786e00257b22798448dfd10f1fef1a32d57c237c10fbd66641d1f7a53af32b874cdcfe84a428315abe36240c3b9471e00f44a041a64144538a368b4afc5274efff24045685350fe1d50521f4ffef04b38fe4a7d5aefd0d4eeccba00f3d21477ac8e6dc86079d9cfdcae69a8b387e3400000004d67e3a2fdec33dcc64eddfe6344dd1f44659a60e1824d8f74d6c14e298f7a2cac8b3a4113d4e48b8da070e536de099145e827369efdfd8c743ff51a503cc01a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438223632"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 36540 vssvc.exe
Token: SeRestorePrivilege 36540 vssvc.exe
Token: SeAuditPrivilege 36540 vssvc.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

36536 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

36536 iexplore.exe
36536 iexplore.exe
35136 IEXPLORE.EXE
35136 IEXPLORE.EXE
35136 IEXPLORE.EXE
35136 IEXPLORE.EXE

description	pid	process
Token: SeBackupPrivilege	36540	vssvc.exe
Token: SeRestorePrivilege	36540	vssvc.exe
Token: SeAuditPrivilege	36540	vssvc.exe

pid	process
36536	iexplore.exe

pid	process
36536	iexplore.exe
36536	iexplore.exe
35136	IEXPLORE.EXE
35136	IEXPLORE.EXE
35136	IEXPLORE.EXE
35136	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

encoder2.execmd.execmd.exeiexplore.exe

description	pid	process	target process
PID 800 wrote to memory of 37868	800	encoder2.exe	cmd.exe
PID 800 wrote to memory of 37868	800	encoder2.exe	cmd.exe
PID 800 wrote to memory of 37868	800	encoder2.exe	cmd.exe
PID 800 wrote to memory of 37868	800	encoder2.exe	cmd.exe
PID 800 wrote to memory of 37876	800	encoder2.exe	cmd.exe
PID 800 wrote to memory of 37876	800	encoder2.exe	cmd.exe
PID 800 wrote to memory of 37876	800	encoder2.exe	cmd.exe
PID 800 wrote to memory of 37876	800	encoder2.exe	cmd.exe
PID 37868 wrote to memory of 35492	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 35492	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 35492	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 35492	37868	cmd.exe	vssadmin.exe
PID 37876 wrote to memory of 36536	37876	cmd.exe	iexplore.exe
PID 37876 wrote to memory of 36536	37876	cmd.exe	iexplore.exe
PID 37876 wrote to memory of 36536	37876	cmd.exe	iexplore.exe
PID 37876 wrote to memory of 36536	37876	cmd.exe	iexplore.exe
PID 36536 wrote to memory of 35136	36536	iexplore.exe	IEXPLORE.EXE
PID 36536 wrote to memory of 35136	36536	iexplore.exe	IEXPLORE.EXE
PID 36536 wrote to memory of 35136	36536	iexplore.exe	IEXPLORE.EXE
PID 36536 wrote to memory of 35136	36536	iexplore.exe	IEXPLORE.EXE
PID 37868 wrote to memory of 35748	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 35748	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 35748	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 35748	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 36332	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 36332	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 36332	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 36332	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37012	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37012	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37012	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37012	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 36952	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 36952	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 36952	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 36952	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 36920	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 36920	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 36920	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 36920	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37016	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37016	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37016	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37016	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37072	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37072	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37072	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37072	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37084	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37084	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37084	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37084	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37132	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37132	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37132	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37132	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37180	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37180	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37180	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 37180	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 35908	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 35908	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 35908	37868	cmd.exe	vssadmin.exe
PID 37868 wrote to memory of 35908	37868	cmd.exe	vssadmin.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\encoder2.exe
"C:\Users\Admin\AppData\Local\Temp\encoder2.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:37868
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin Delete Shadows /all /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:35492
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
    3⤵
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:35748
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
    3⤵
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:36332
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:37012
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:36952
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:36920
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:37016
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:37072
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:37084
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:37132
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:37180
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:35908
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:36016
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin Delete Shadows /all /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:36004
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\users\Admin\Desktop\DECRYPT_INFORMATION.html
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:37876
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\DECRYPT_INFORMATION.html
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:36536
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:36536 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:35136

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:36540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DECRYPT_INFORMATION.html

Filesize
6KB

MD5
56fc3877d1e70f019924f7a99b6ff83e

SHA1
e50e34f73ef36f35bf22703bea443e6e83353d50

SHA256
e45ba3951dbcc4fa1b7bf149cea5f84eec959dbfbf25c110c22d34c1b9cdbc95

SHA512
3d4fd6ec330f714fc82f4ffde788937c75d6b1b0a86a416a49a0972d62b9ef305aa5e785b2fcff381902dd48d20d817d7dcf7d0da8a7080df15dfb3ba91332db

Download Submit
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_38b42d9b-3e83-45f4-8789-a30be34574b0[[email protected]].HRM

Filesize
338B

MD5
44a0eadc0b41b1f04398c64ea57e2e0c

SHA1
5e7b27ceed9d6942e59517350a539f72a792f1e0

SHA256
ebff4beee07e1eaf9a16595d17076af29442cc9cc812d330a5b4bba676ba78ec

SHA512
d931681eab861fc49917d54125f5cd528b9adbf429f0096a169704c17e5ffd592d7354bfa2e56b5e85acdad04e8ade16b36f548a6c139e46fcbc1e9c2b16d2f1

Download Submit
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\7f603bed929170f96576b4e2d9988a32_38b42d9b-3e83-45f4-8789-a30be34574b0[[email protected]].HRM

Filesize
2KB

MD5
32822250f70b7c01c58a997c84700585

SHA1
2f2395537014190c0f2831d205d4cb67cdf70894

SHA256
3c4bc00191c7c4ad59b61d2b27d200a3230532a2e96f70c83e895886f467b584

SHA512
20f2c7e7fc6d844aa79b0c883e97ae66839b2253794a92a1bb57bf651f27673d5cc3809633e60a12638ed14d805342b2f9c1f08b41bc22f5e052d595f2eb4a2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
9c205e2a30779fdc6a709cf147bd1137

SHA1
ff2b32b92d9eb53eb6134c4d22082ffe14ab4124

SHA256
2d3605d8b5c567b6a2ff217a479969f65e68d19ee26afdc7effbc474848871dc

SHA512
0b51103a8d5be57f87acca2698b21f992b430f1bafe3a542d89f7da26441c9f8ef73f784d8238b21b58ec917f696df20635606bfb519e40aeac9f58de0fb9fdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a64944e05274edafee9251fbb360928c

SHA1
74b20fa87226d128f9a0440f04730166a6b60925

SHA256
13de714986d330575d8158c340954e7e1e38b642cbbfb6259a56b8530f4d86de

SHA512
e4d167bb76929821e407167bb7257c29a4b039275c1d0cef37de1568f87374f0470957db39c96ab9802a8eae9860be24b9c3cc6e5d054fd7e5aafd4707c82c9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97c74f45b2e2f7f3035a37f4c9faba6f

SHA1
230c9f60f2033bdb4f5d560edac5291a17f28f16

SHA256
9ef17197a85c5a80e52e3428e5116bf649d4b415133da945a9810a3ccd27a535

SHA512
c9681054e6441425d33b4fc07e17302b04869d7c839f415b64f390f8da577e532ad91d1f645783cad35a39602f31551fe0524e0bbbe15f6bcfb93ca004276cd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0dd271de538699b7a6b53669ddd5ab7

SHA1
019cc8b518b75f9928b1608de50f733f384ead1f

SHA256
414221b77f6c6554e1a9e9815763dea0e7fe7bebd443e07b7d7ecff5059d9731

SHA512
a1227ca584ff0bfa8d90a078cde3cf27c4527aefea14be8223efd27589b49bc2737c03480af44a42c2fb396711722a86d17601f51051db0f1d9e06d246a797f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa850c676c050895e44330b6c7cad239

SHA1
f151ee59cdc64e92e1d244fa9912a820f74196cb

SHA256
5b8949ae2fbfbfbf942af1c8af0f3146d6d5a081da1e72dcc1a0dd5264435434

SHA512
a1ae84259361041fa17e33e2de5bfc9aa37eb31d430941755c8739850c9242f270b1c0d075f488d186e3c472a4031798daf5e0d064322147b225fb66dc82dfae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c97784e33f9efef287562039cdc11313

SHA1
02ed1426af24241ee96cd7fa3e363b65c136bdc8

SHA256
f0e988d40b80c9b58153c8f759063158b8871de91f3076ed0c4766357f5e292d

SHA512
eeffbba17474a28ed93d25915d568289ecbc1deaef687195e53a30e8190b39e213750c27f960940365e6e08312afc3d1add39fae9d6776ded48987ccf51a3d61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8536567b8d35748e6a9d69d1536561d

SHA1
10228cbce446384c9e40c0bed9c3df114570ba69

SHA256
0c0017498d68da865581151f413026b10c1523a040580dd329b8e87740df5660

SHA512
fe138e2d45b9fcfda6efaf0a251f0d02726adcfe0fa6ad1790043442d3ea11e2805a38856a98319164e2af6e648a5a700464c665911a310f9c7f6267eccc401e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca1c35450b8747d385d3cfda5bb94eb9

SHA1
691a4955966f6aefdf945c32da5b381852933e9b

SHA256
afe7cfb7e80297559bfadbd15c7fc3afb447604e55150ad28b73442e1b117d3f

SHA512
58abb11321a119401ea14877f583a21363ba9200e1d0706a3e028123d618d65c40916a9282727ed88c1a3dab3b436e132fef6431aaa202260ac463424a3c324c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4830955d39245116de3feeddcbc807a

SHA1
41c91ca1da12e7722af15ba626da1f42ebd26242

SHA256
2ee33c282b5c040d600826b6482e5a641e2cc62b7740b144dd413d876f4e3233

SHA512
7e4551cdb0799feab4d33763905188206d764382060a5a17c012989e28f08f5a8bf2d24a4f38e28a3c04ac51cc53d5c46fc3394e82e364ba6055d7ec13fc0e05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8026d4d33a95e3595306a5de896d0ba

SHA1
de4a4a00127eaddf56a95487a261e642801356ca

SHA256
e203123659208afda4ed23c1bb0f0fcb863fc1a6ac9bff5c72ede1c228a18c2b

SHA512
0a752ea0255bdd3e06a0a40903df727d157773c6b8369e9ea9aa41628f763472edf8c2e98f96d7648cbd282eda7d0441b26e0b1ca7f8354d80bc147edbbc21fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
658945222932908258a096170a8adb4a

SHA1
9b49c556ffbb8c41ea7a854baee1134aa0d23bfc

SHA256
485adbffae1644d382add32f020d56592abf227db78cff45493a56a703041937

SHA512
aa2b1150eae9ad653f7998099f26b4a204cc9cf3f75d9a4039f55b1606edd5597c1cfbf6a069cdf2d9bcaf202c1bedf51ba009a795bc1bc9f8aff15cc9c87360

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5759d41e874341da78d408f929b3e653

SHA1
600a76d9e5624af8c2e00b79cab1467acea15749

SHA256
17f690f9794c3967929eb4f7c2f7a01564d6e1f422461ec35b20a164089c7a76

SHA512
31d27de3229061b930488a4e031ac7bd9e6399f9b197ba44accb6fcbe77716a349cf193a5b23a06ab5688840c018108ce5962d9772752e26bcb6aba6f45704d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74ded1f529664ed1109aaed2448fd62c

SHA1
1654fb684767bff2900d9be41431ee37d0c300fa

SHA256
0a7cb165ea90b251462388cfe9e470e99e516786c18cfa2d4f4f51abc692ab9c

SHA512
f32aebc97709afd98b1ff9fc7fe22f50dfdc1cde53714e15e98281cd4d1424795712060825b70f85cff5fc4a3b815e0a259de6741a768fa33c5737386032c820

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13cf4588fb5d4ec9b835d463f5955958

SHA1
74c88320e29cbfdfe5e174ee346bf8d434e1287d

SHA256
c4e9bdce1a25cf5f09bd44ff13d63e206ddf7531a770f19c9fa9dd29df489715

SHA512
790703c5d26d427d0ac727196ed2782a0994f1ffc04bbe92b7a1e3ff4d4478a00ef01031173ed7e1a858c039d082c86f2db63e80c4f76b98b4d470e5c368bd95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6172a7d3f56f78de8110fe44cab3fca8

SHA1
c8c40f361478c352bd9956cd27a3173a1b98f409

SHA256
aa8faee66c4d7b956faf94c3e50087070477f8a5aee40ec14b465125bf5a2548

SHA512
8df4c3f7584c92516b75b73424d28c91fad608488fc6acca0b686380fd69ec7210252316cd32360ddc025e4b64e6ef025d389c60b1242064d4ea40e6ded6dcd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d612f6c1655895cd14c723d4ecd12566

SHA1
f6052615c57d6e3703a5fecb94517c4a7400d5e3

SHA256
36b5e16b7e8c1f777c3fda6086c80474d41dcd12954055b250a682c213c2ce04

SHA512
0f5da61dadf529276b11ffb50708d97b21c22ab6df29a14b7e4ad1936847adc79f7a79c8d4cd20bf4fad9565431d2eb4fef0fad15d92d011283aeb4244558a94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d57a1a82cecaea48e934fb3355bbb62a

SHA1
4784162248561d07272cdefc587fc1cb4e8c449e

SHA256
c1c6fe04c2a24dd2b49a1226b0efaed4263864a8c42bec79ea7c17587b054a82

SHA512
31c5a3f54578e9360840bacf84cea49053950a224c729b77a22950eab4717d93f4d9516bf7aae4a91d5a9a20893a696c191f59de649387fa3f444b41a4f1983d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85b297b9fddaf61988ff481eeae58949

SHA1
d51e80be2b58050517ab45b0ef065fc615df03ed

SHA256
01dca6d1dbb636f454da891b7e516eb55d3b17d85c2abc6652b8f228449b1318

SHA512
bb3d93d85501508b7085be0289241284dbe4cec543d8441c6ab631fa179f37734b5a79c138162aeaaa834d63b4820247ade561cc1639e07c989e6ea0162a8dc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25ab759c88025a3836d3b3a8bbe497d3

SHA1
6326941881249d7e8f147f50bcd34fa06d556279

SHA256
15b5c5f6cff3d7d3c0437f61687afacc948e196ecc547240a67387094b63e21c

SHA512
b313979f8b974ee889b9462a3ae935a0c58395e2a63ed899027305a910efc166303a17a2ec1c3dc6d60b990a7cdec2d920cfc255a95408075e37d1b70fc6b0a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2919993805289f3193cfc9d5d76da2f

SHA1
558665ceac9b9cff4d07e50541a68eb3818097a4

SHA256
e669e408f4d3865a62dc673cf7a1380454c81cb562f70ccd6c3367bad1f4d61f

SHA512
ddad71ad5cef4cf08e1a87f1901a5ff95f98e117fbb087031ebf757937a57be9045ee5c86f80041f25aead0f4098be4935fed24c838e5c33d6eca469539a297e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
09969ff2417395c1b639b50a882509cc

SHA1
30db2572310886b91a37cdd595c7393a360f9359

SHA256
e7ca39a4f29ece82ab3ef9052294b7f664dd6da5a7d1265a60e24a1b4c7cb028

SHA512
b396bec7a765cc5111aca2289e16969d3cb0d8770edeef1125b5ed640e28a09ea939ed3b8c55eecdbf9e60ee9d398f1e6d1af48c230537540cabf2250c041485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1838.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\users\Public\window.bat

Filesize
1KB

MD5
d2aba3e1af80edd77e206cd43cfd3129

SHA1
3116da65d097708fad63a3b73d1c39bffa94cb01

SHA256
8940135a58d28338ce4ea9b9933e6780507c56ab37a2f2e3a1a98c6564548a12

SHA512
0059bd4cc02c52a219a0a2e1836bf04c11e2693446648dd4d92a2f38ed060ecd6c0f835e542ff8cfef8903873c01b8de2b38ed6ed2131a131bdd17887c11d0ec

Download Submit
\??\c:\Users\Admin\Documents\BackupProtect.ods[[email protected]].HRM

Filesize
1.1MB

MD5
190375b2b291071d64cbe188f1eae41c

SHA1
9f91f7d380cbab9ddaef5b20dac232faf88463be

SHA256
4e889518e3dcc41c35a9f8b90d951c9f185e3066e75e611c997ea7e629f2bb6a

SHA512
cc14cc49bd8c6ec55ab9c30601a983383e457a74da4774e3ea506efef575b86fe9047ff65efbf835b129a21d9d2fdad28d9f09057362985d4f349caf4e0221c4

Download Submit
\??\c:\Users\Admin\Pictures\BackupInstall.jpeg[[email protected]].HRM

Filesize
638KB

MD5
13c5e9d5bfa089c9660ff29a5c2ec09f

SHA1
4c4498ee2ad3c8e3a08eb60de5e760ddd7954ae7

SHA256
344038eb9be64482d55109c040ea30a0cbc4e765f85f85b77e08d3797cb41107

SHA512
87ff77c48f1cba0d198b0ccfc2b3da4e70cdb67c45448d68a1fc131e7613485d54a1f19c1853f54668cd89e328df7eedfd0510d0f6e7a82be0747334db01a04f

Download Submit
memory/800-19200-0x0000000000400000-0x000000000077B000-memory.dmp

Filesize
3.5MB

Download
memory/800-2-0x0000000002350000-0x00000000023D0000-memory.dmp

Filesize
512KB

Download
memory/800-3-0x0000000000400000-0x000000000077B000-memory.dmp

Filesize
3.5MB

Download
memory/800-2228-0x0000000000400000-0x000000000077B000-memory.dmp

Filesize
3.5MB

Download
memory/800-6113-0x0000000002350000-0x00000000023D0000-memory.dmp

Filesize
512KB

Download
memory/800-10388-0x0000000000400000-0x000000000077B000-memory.dmp

Filesize
3.5MB

Download
memory/800-10389-0x0000000073570000-0x000000007397F000-memory.dmp

Filesize
4.1MB

Download
memory/800-17676-0x0000000000400000-0x000000000077B000-memory.dmp

Filesize
3.5MB

Download