Overview

overview

10

Static

static

3

Starcat ra...re.exe

windows7-x64

9

Starcat ra...re.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    80s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/12/2024, 07:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Starcat ransomware.exe

  • Size

    4.2MB

  • MD5

    0df6cb830d2f8f248ebb420e0473e40b

  • SHA1

    4f89623b972450fac3b320779672003b06fa5d9f

  • SHA256

    9cc7fd79b16ed36fe78d8b6bc9ea5e99bb1fb48a39d6051c3961bf503fd16a24

  • SHA512

    765073189498d4889a18dcd959cec54e4d837a3de249607c8dd4288f2204ba48992cf284afa76fcedf1f6a59954305b37fb0ab99639fca96a643526d16d067a7

  • SSDEEP

    49152:DYIU6iwVwASOuGtlqGz2OiG3NWE8Nsz3QEyB+68eBDN4NoIumzqsRrtYpFGY+uby:L+UaOwENQ3mzROac6t

Score
10/10
defense_evasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\USERS\ADMIN\DESKTOP\RECOVER FILES,VIEW HERE.TXT

Ransom Note
hello, my friend! we have encrypted all your computer files. please do not use antivirus software, otherwise your files will never be recovered. the encryption algorithm uses CHACHA20+RSA4096, and your key is encrypted using RSA16384. in this world, no one can decrypt your files except us. even if you use a supercomputer, you cannot decrypt the files. how to get the files back? you must pay us $5,000 worth of XMR to decrypt your files. you can search for monero virtual currency on google, and then you can see its price and how to trade virtual currency. you only have 7 chances to send us emails, so don't try to bargain with us, it will be bad for you it doesn't help at all, but will only irritate us. if you don't complete the transaction within 7 days, we will delete your key and make all your files public! of course, you can send us 3 files less than 3mb, and we will decrypt them for free. after the decryption is completed, please send the XMR to the address we provide. when sending an email, send us your key and your transaction record together. after we receive your request, we will complete your request within 24 hours. i wish you a happy life! our email: [email protected] our XMR address: 48hDBzD7J8fMVxcy7J6gTy3tJ3gZDgBgigrzrKVDuK8o2FYbv6CjWeJFU6ar3Mp8oFUtXDZExcoH41wqA1x8cnuVUkbqDai your rsa public key: -----BEGIN PUBLIC KEY----- MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA/U2ld/TxhgCI5kifTj7R scEo5rRdnl6wxdsvNE8BbcSErvdk4QznWEBK2vWLrFLXws6rDc32mr7ASdycZUoB /WTq3YKvpCyyPQlpAjkDq+oqhJXxqgen/5qcmXCqxQTLXO2MaeK+f++k/WoFmAXr 7nuJyOEltjeKTvyOMdl4fIST1HRVeTXgpPgpxpWfCG/HOEmDSHp3vTxK6FmxgnyL 2ymTPrvniClJG39YuoKotm5RvFbf4Ptl2ESY4r28Xf2Ddh8WVPY3F7FmyMxsYEJw ZkEMh92Uu3VqAN2F2z29sTw4hks37wDjaul+vJdTp2PRpHppQQvtibt+hCUsDWeh +Y+2WJS6CLWKQ0OS9NAeC9oeXeS9HbU6WQgUwARW1T0EA5sClx5AtwcAEXaLZfm1 7hTan2f54jBeAk12cbp2Ou4eD+ey57Aaw9D6EBgAhBQRatvHwUXSKiLxpT5exM7i w+sjOs6YPQ3atXoujs16/xzgSDyAU8leivVMYFWoW6u6/t8iTdloE7AUzZse2eDs OV7HtOb27VnS3nRMatnpZIGjNjW8uqQClYtr4b7GBkpFOVpCv1TG1pmHh9ySzpLX 7di5uyKykC9oKEkKSOef1ibkC2sZ1h7FuxfE2hUpX8/s0V0zJmqzTJ6VfDgl/eIn 3PJrNAKX/E0Pph8IlayvRN0CAwEAAQ== -----END PUBLIC KEY----- your rsa private key: please pull the text to the bottom for viewing ЗдpaBcTByй, дpyг! Mы зaшифpoBaли Bce Baши кoMпbюTepHыe фaйлы. ПoжaлyйcTa, He иcпoлbзyйTe aHTиBиpycHoe пpoгpaMMHoe oбecпeчeHиe, иHaчe Baши фaйлы Hикoгдa He бyдyT BoccTaHoBлeHы. aлгopиTM шифpoBaHия иcпoлbзyeT CHACHA20+RSA4096, a Baш ключ зaшифpoBaH c пoMoщbю RSA16384. B эToM Mиpe HикTo кpoMe Hac He cMoжeT pacшифpoBaTb Baши фaйлы. Дaжe ecли Bы иcпoлbзyeTe cyпepкoMпbюTep, Bы He cMoжeTe pacшифpoBaTb фaйлы. кaк BepHyTb фaйлы? Bы дoлжHы зaплaTиTb HaM XMR Ha cyMMy 5000 дoллapoB зa pacшифpoBкy Baшиx фaйлoB. Bы MoжeTe HaйTи BиpTyaлbHyю BaлюTy Monero B Google, a зaTeM yBидeTb ee цeHy и cпocoбы TopгoBли BиpTyaлbHoй BaлюToй. y Bac ecTb Toлbкo 7 шaHcoB oTпpaBиTb HaM элeкTpoHHoe пиcbMo, пoэToMy He пыTaйTecb TopгoBaTbcя c HaMи, эTo бyдeT плoxo для Bac, эTo coBceM He пoMoжeT, a Toлbкo paзoзлиT Hac. Ecли Bы He зaBepшиTe TpaHзaкцию B TeчeHиe 7 дHeй, Mы yдaлиM Baш ключ и cдeлaeM Bce Baши фaйлы oбщeдocTyпHыMи! КoHeчHo, Bы MoжeTe oTпpaBиTb HaM 3 фaйлa paзMepoM MeHee 3 Mб, и Mы иx бecплaTHo pacшифpyeM. Пocлe зaBepшeHия pacшифpoBки oTпpaBbTe XMR Ha yкaзaHHый HaMи aдpec. пpи oTпpaBкe элeкTpoHHoгo пиcbMa oTпpaBbTe HaM cBoй ключ и зaпиcb TpaHзaкции BMecTe. пocлe пoлyчeHия Baшeгo зaпpoca Mы BыпoлHиM Baш зaпpoc B TeчeHиe 24 чacoB. жeлaю Teбe cчacTлиBoй жизHи! Haшa элeкTpoHHaя пoчTa: [email protected] Haш aдpec XMR: 48hDBzD7J8fMVxcy7J6gTy3tJ3gZDgBgigrzrKVDuK8o2FYbv6CjWeJFU6ar3Mp8oFUtXDZExcoH41wqA1x8cnuVUkbqDai Baш oTкpыTый ключ RSA: -----BEGIN PUBLIC KEY----- MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA/U2ld/TxhgCI5kifTj7R scEo5rRdnl6wxdsvNE8BbcSErvdk4QznWEBK2vWLrFLXws6rDc32mr7ASdycZUoB /WTq3YKvpCyyPQlpAjkDq+oqhJXxqgen/5qcmXCqxQTLXO2MaeK+f++k/WoFmAXr 7nuJyOEltjeKTvyOMdl4fIST1HRVeTXgpPgpxpWfCG/HOEmDSHp3vTxK6FmxgnyL 2ymTPrvniClJG39YuoKotm5RvFbf4Ptl2ESY4r28Xf2Ddh8WVPY3F7FmyMxsYEJw ZkEMh92Uu3VqAN2F2z29sTw4hks37wDjaul+vJdTp2PRpHppQQvtibt+hCUsDWeh +Y+2WJS6CLWKQ0OS9NAeC9oeXeS9HbU6WQgUwARW1T0EA5sClx5AtwcAEXaLZfm1 7hTan2f54jBeAk12cbp2Ou4eD+ey57Aaw9D6EBgAhBQRatvHwUXSKiLxpT5exM7i w+sjOs6YPQ3atXoujs16/xzgSDyAU8leivVMYFWoW6u6/t8iTdloE7AUzZse2eDs OV7HtOb27VnS3nRMatnpZIGjNjW8uqQClYtr4b7GBkpFOVpCv1TG1pmHh9ySzpLX 7di5uyKykC9oKEkKSOef1ibkC2sZ1h7FuxfE2hUpX8/s0V0zJmqzTJ6VfDgl/eIn 3PJrNAKX/E0Pph8IlayvRN0CAwEAAQ== -----END PUBLIC KEY----- Baш зaкpыTый ключ RSA: ПepeйTи BHизy, пocMoTpeTb. 朋友你好！我們已經加密了您所有的電腦檔案。請不要使用防毒軟體，否則您的檔案將永遠無法恢復。加密演算法使用CHACHA20+RSA4096，你的金鑰使用RSA16384加密。在這個世界上，除了我們之外，沒有人可以解密您的檔案。即使您使用超級計算機，也無法解密檔案。如何取回文件？您必須向我們支付價值 5,000 美元的 XMR 才能解密您的檔案。您可以在谷歌上搜尋門羅幣虛擬貨幣，然後您可以看到它的價格以及如何交易虛擬貨幣。您只有 7 次向我們發送電子郵件的機會，所以不要試圖與我們討價還價，這對您來說沒有任何幫助，只會激怒我們。如果您在 7 天內未完成交易，我們將刪除您的金鑰並公開您的所有文件！當然，您可以向我們發送3個小於3mb的文件，我們將免費解密它們。解密完成後，請將XMR發送至我們提供的地址。發送電子郵件時，請將您的金鑰和交易記錄一起發送給我們。我們收到您的請求後，將在 24 小時內完成您的請求。祝您生活愉快！ 我們的電子郵件：[email protected] 我們的XMR地址：48hDBzD7J8fMVxcy7J6gTy3tJ3gZDgBgigrzrKVDuK8o2FYbv6CjWeJFU6ar3Mp8oFUtXDZExcoH41wqA1x8cnuVUkbqDai 您的 rsa 公鑰： -----BEGIN PUBLIC KEY----- MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA/U2ld/TxhgCI5kifTj7R scEo5rRdnl6wxdsvNE8BbcSErvdk4QznWEBK2vWLrFLXws6rDc32mr7ASdycZUoB /WTq3YKvpCyyPQlpAjkDq+oqhJXxqgen/5qcmXCqxQTLXO2MaeK+f++k/WoFmAXr 7nuJyOEltjeKTvyOMdl4fIST1HRVeTXgpPgpxpWfCG/HOEmDSHp3vTxK6FmxgnyL 2ymTPrvniClJG39YuoKotm5RvFbf4Ptl2ESY4r28Xf2Ddh8WVPY3F7FmyMxsYEJw ZkEMh92Uu3VqAN2F2z29sTw4hks37wDjaul+vJdTp2PRpHppQQvtibt+hCUsDWeh +Y+2WJS6CLWKQ0OS9NAeC9oeXeS9HbU6WQgUwARW1T0EA5sClx5AtwcAEXaLZfm1 7hTan2f54jBeAk12cbp2Ou4eD+ey57Aaw9D6EBgAhBQRatvHwUXSKiLxpT5exM7i w+sjOs6YPQ3atXoujs16/xzgSDyAU8leivVMYFWoW6u6/t8iTdloE7AUzZse2eDs OV7HtOb27VnS3nRMatnpZIGjNjW8uqQClYtr4b7GBkpFOVpCv1TG1pmHh9ySzpLX 7di5uyKykC9oKEkKSOef1ibkC2sZ1h7FuxfE2hUpX8/s0V0zJmqzTJ6VfDgl/eIn 3PJrNAKX/E0Pph8IlayvRN0CAwEAAQ== -----END PUBLIC KEY----- 您的 rsa 私鑰：到底部查看鑰匙 Hallo mein Freund! Wir haben alle Ihre Computerdateien verschlüsselt. Bitte verwenden Sie keine Antivirensoftware, da Ihre Dateien sonst nie wiederhergestellt werden können. Der Verschlüsselungsalgorithmus verwendet CHACHA20+RSA4096 und Ihr Schlüssel wird mit RSA16384 verschlüsselt. Auf dieser Welt kann niemand außer uns Ihre Dateien entschlüsseln. Selbst wenn Sie einen Supercomputer verwenden, können Sie die Dateien nicht entschlüsseln. Wie bekomme ich die Dateien zurück? Sie müssen uns XMR im Wert von 5.000 US-Dollar zahlen, um Ihre Dateien zu entschlüsseln. Sie können auf Google nach der virtuellen Währung Monero suchen und dann den Preis sehen und erfahren, wie Sie mit der virtuellen Währung handeln können. Sie haben nur 7 Möglichkeiten, uns E-Mails zu senden, also versuchen Sie nicht, mit uns zu verhandeln, das wäre schlecht für Sie, es hilft überhaupt nicht, sondern wird uns nur irritieren. Wenn Sie die Transaktion nicht innerhalb von 7 Tagen abschließen, löschen wir Ihren Schlüssel und machen alle Ihre Dateien öffentlich! Selbstverständlich können Sie uns auch 3 Dateien mit einer Größe von weniger als 3 MB zusenden und wir entschlüsseln diese kostenlos. Nachdem die Entschlüsselung abgeschlossen ist, senden Sie bitte das XMR an die von uns angegebene Adresse. Wenn Sie eine E-Mail senden, senden Sie uns bitte Ihren Schlüssel und Ihre Transaktionsaufzeichnung zusammen. Nachdem wir Ihre Anfrage erhalten haben, werden wir Ihre Anfrage innerhalb von 24 Stunden bearbeiten. Ich wünsche dir ein glückliches Leben! unsere E-Mail: [email protected] unsere XMR-adresse: 48hDBzD7J8fMVxcy7J6gTy3tJ3gZDgBgigrzrKVDuK8o2FYbv6CjWeJFU6ar3Mp8oFUtXDZExcoH41wqA1x8cnuVUkbqDai Ihr öffentlicher RSA-Schlüssel: -----BEGIN PUBLIC KEY----- MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA/U2ld/TxhgCI5kifTj7R scEo5rRdnl6wxdsvNE8BbcSErvdk4QznWEBK2vWLrFLXws6rDc32mr7ASdycZUoB /WTq3YKvpCyyPQlpAjkDq+oqhJXxqgen/5qcmXCqxQTLXO2MaeK+f++k/WoFmAXr 7nuJyOEltjeKTvyOMdl4fIST1HRVeTXgpPgpxpWfCG/HOEmDSHp3vTxK6FmxgnyL 2ymTPrvniClJG39YuoKotm5RvFbf4Ptl2ESY4r28Xf2Ddh8WVPY3F7FmyMxsYEJw ZkEMh92Uu3VqAN2F2z29sTw4hks37wDjaul+vJdTp2PRpHppQQvtibt+hCUsDWeh +Y+2WJS6CLWKQ0OS9NAeC9oeXeS9HbU6WQgUwARW1T0EA5sClx5AtwcAEXaLZfm1 7hTan2f54jBeAk12cbp2Ou4eD+ey57Aaw9D6EBgAhBQRatvHwUXSKiLxpT5exM7i w+sjOs6YPQ3atXoujs16/xzgSDyAU8leivVMYFWoW6u6/t8iTdloE7AUzZse2eDs OV7HtOb27VnS3nRMatnpZIGjNjW8uqQClYtr4b7GBkpFOVpCv1TG1pmHh9ySzpLX 7di5uyKykC9oKEkKSOef1ibkC2sZ1h7FuxfE2hUpX8/s0V0zJmqzTJ6VfDgl/eIn 3PJrNAKX/E0Pph8IlayvRN0CAwEAAQ== -----END PUBLIC KEY----- Ihr privater RSA-Schlüssel: Bitte ziehen Sie den Text zum Anzeigen nach unten こんにちは、友よ！あなたのコンピュータファイルはすべて暗号化しました。ウイルス対策ソフトウェアは使用しないでください。そうしないと、ファイルは回復されません。暗号化アルゴリズムはchacha20 + RSA4096を使用し、キーはRSA16384を使用して暗号化されます。この世界では、私たち以外の誰もあなたのファイルを復号化できません。スーパーコンピューターを使用しても、ファイルを復号化することはできません。ファイルを取り戻すには？ファイルを復号化するには、5,000ドル相当のXMRを支払う必要があります。Googleでmonero仮想通貨を検索すると、その価格と仮想通貨の取引方法を確認できます。メールを送信できるチャンスは7回だけですので、私たちと交渉しないでください。それはあなたにとって悪いですし、まったく役に立たず、私たちを苛立たせるだけです。7日以内に取引を完了しないと、キーを削除し、すべてのファイルを公開します。もちろん、3MB未満のファイルを3つ送信していただければ、無料で復号化します。復号化が完了したら、弊社が提供するアドレスに XMR を送信してください。メールを送信する際は、キーとトランザクション レコードを一緒に送信してください。リクエストを受信してから 24 時間以内にリクエストを完了します。幸せな人生をお祈りします! 弊社のメール アドレス: [email protected] 弊社の XMR アドレス: 48hDBzD7J8fMVxcy7J6gTy3tJ3gZDgBgigrzrKVDuK8o2FYbv6CjWeJFU6ar3Mp8oFUtXDZExcoH41wqA1x8cnuVUkbqDai RSA 公開キー: -----BEGIN PUBLIC KEY----- MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA/U2ld/TxhgCI5kifTj7R scEo5rRdnl6wxdsvNE8BbcSErvdk4QznWEBK2vWLrFLXws6rDc32mr7ASdycZUoB /WTq3YKvpCyyPQlpAjkDq+oqhJXxqgen/5qcmXCqxQTLXO2MaeK+f++k/WoFmAXr 7nuJyOEltjeKTvyOMdl4fIST1HRVeTXgpPgpxpWfCG/HOEmDSHp3vTxK6FmxgnyL 2ymTPrvniClJG39YuoKotm5RvFbf4Ptl2ESY4r28Xf2Ddh8WVPY3F7FmyMxsYEJw ZkEMh92Uu3VqAN2F2z29sTw4hks37wDjaul+vJdTp2PRpHppQQvtibt+hCUsDWeh +Y+2WJS6CLWKQ0OS9NAeC9oeXeS9HbU6WQgUwARW1T0EA5sClx5AtwcAEXaLZfm1 7hTan2f54jBeAk12cbp2Ou4eD+ey57Aaw9D6EBgAhBQRatvHwUXSKiLxpT5exM7i w+sjOs6YPQ3atXoujs16/xzgSDyAU8leivVMYFWoW6u6/t8iTdloE7AUzZse2eDs OV7HtOb27VnS3nRMatnpZIGjNjW8uqQClYtr4b7GBkpFOVpCv1TG1pmHh9ySzpLX 7di5uyKykC9oKEkKSOef1ibkC2sZ1h7FuxfE2hUpX8/s0V0zJmqzTJ6VfDgl/eIn 3PJrNAKX/E0Pph8IlayvRN0CAwEAAQ== -----END PUBLIC KEY----- RSA 秘密キー: 一番下に行って鍵を見てください bonjour mon ami! nous avons crypté tous vos fichiers informatiques. Veuillez ne pas utiliser de logiciel antivirus, sinon vos fichiers ne seront jamais récupérés. l'algorithme de cryptage utilise CHACHA20+RSA4096 et votre clé est cryptée à l'aide de RSA16384. dans ce monde, personne ne peut décrypter vos fichiers à part nous. Même si vous utilisez un superordinateur, vous ne pouvez pas décrypter les fichiers. comment récupérer les fichiers ? vous devez nous payer 5 000 $ de XMR pour décrypter vos fichiers. vous pouvez rechercher la monnaie virtuelle monero sur Google, puis voir son prix et comment échanger de la monnaie virtuelle. vous n'avez que 7 chances de nous envoyer des emails, alors n'essayez pas de négocier avec nous, ce sera mauvais pour vous, cela n'aidera pas du tout, mais ne fera que nous irriter. Si vous ne finalisez pas la transaction dans les 7 jours, nous supprimerons votre clé et rendrons tous vos fichiers publics! bien sûr, vous pouvez nous envoyer 3 fichiers de moins de 3 Mo, et nous les décrypterons gratuitement. Une fois le décryptage terminé, veuillez envoyer le XMR à l'adresse que nous fournissons. lors de l'envoi d'un e-mail, envoyez-nous ensemble votre clé et votre relevé de transaction. après réception de votre demande, nous compléterons votre demande dans les 24 heures. je te souhaite une vie heureuse! notre email: [email protected] notre adresse XMR : 48hDBzD7J8fMVxcy7J6gTy3tJ3gZDgBgigrzrKVDuK8o2FYbv6CjWeJFU6ar3Mp8oFUtXDZExcoH41wqA1x8cnuVUkbqDai votre clé publique rsa: -----BEGIN PUBLIC KEY----- MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA/U2ld/TxhgCI5kifTj7R scEo5rRdnl6wxdsvNE8BbcSErvdk4QznWEBK2vWLrFLXws6rDc32mr7ASdycZUoB /WTq3YKvpCyyPQlpAjkDq+oqhJXxqgen/5qcmXCqxQTLXO2MaeK+f++k/WoFmAXr 7nuJyOEltjeKTvyOMdl4fIST1HRVeTXgpPgpxpWfCG/HOEmDSHp3vTxK6FmxgnyL 2ymTPrvniClJG39YuoKotm5RvFbf4Ptl2ESY4r28Xf2Ddh8WVPY3F7FmyMxsYEJw ZkEMh92Uu3VqAN2F2z29sTw4hks37wDjaul+vJdTp2PRpHppQQvtibt+hCUsDWeh +Y+2WJS6CLWKQ0OS9NAeC9oeXeS9HbU6WQgUwARW1T0EA5sClx5AtwcAEXaLZfm1 7hTan2f54jBeAk12cbp2Ou4eD+ey57Aaw9D6EBgAhBQRatvHwUXSKiLxpT5exM7i w+sjOs6YPQ3atXoujs16/xzgSDyAU8leivVMYFWoW6u6/t8iTdloE7AUzZse2eDs OV7HtOb27VnS3nRMatnpZIGjNjW8uqQClYtr4b7GBkpFOVpCv1TG1pmHh9ySzpLX 7di5uyKykC9oKEkKSOef1ibkC2sZ1h7FuxfE2hUpX8/s0V0zJmqzTJ6VfDgl/eIn 3PJrNAKX/E0Pph8IlayvRN0CAwEAAQ== -----END PUBLIC KEY----- votre clé privée rsa: en bas pour voir vos clés 안녕 친구! 우리는 귀하의 모든 컴퓨터 파일을 암호화했습니다. 바이러스 백신 소프트웨어를 사용하지 마십시오. 그렇지 않으면 귀하의 파일은 절대 복구되지 않습니다. 암호화 알고리즘은 CHACHA20+RSA4096을 사용하며 귀하의 키는 이 세상 어느 누구도 사용하지 않습니다. 우리를 제외한 모든 파일을 해독할 수 있습니다. 슈퍼컴퓨터를 사용해도 파일을 해독할 수 없습니다. 어떻게 하면 $5,000 상당의 XMR을 지불해야 합니까? 파일을 해독하려면 Google에서 모네로 가상 화폐를 검색하면 해당 가격과 가상 화폐 거래 방법을 확인할 수 있습니다. 이메일을 보낼 수 있는 기회는 7번뿐이므로 우리와 흥정하려고 하지 마세요. 전혀 도움이 되지 않지만 우리를 짜증나게 할 뿐입니다. 7일 이내에 거래를 완료하지 않으면 우리는 귀하의 키를 삭제하고 모든 파일을 공개할 것입니다. 물론 우리에게 보낼 수 있습니다! 3MB 미만의 파일 3개, 암호 해독이 완료되면 이메일을 보낼 때 제공한 주소로 XMR을 보내주십시오. 귀하의 요청을 받은 후 키와 거래 기록을 함께 보내주십시오. 24시간 안에 행복한 삶을 기원합니다! 이메일: [email protected] XMR 주소: 48hDBzD7J8fMVxcy7J6gTy3tJ3gZDgBgigrzrKVDuK8o2FYbv6CjWeJFU6ar3Mp8oFUtXDZExcoH41wqA1x8cnuVUkbqDai 귀하의 RSA 공개 키: -----BEGIN PUBLIC KEY----- MIICIjANBgkqhki
Emails

[email protected]

我們的電子郵件：[email protected]

我们的邮箱:[email protected]

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (1198) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 12 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Starcat ransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\Starcat ransomware.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2640
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2904
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:1848
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c schtasks /create /tn "CopyFileTask" /tr "cmd.exe / c copy "C:\star_cat.txt" "C:\Users\Admin\Desktop\recover files,view here.txt"" / sc minute / mo 10 / f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4092
      • C:\Windows\system32\schtasks.exe
        schtasks /create /tn "CopyFileTask" /tr "cmd.exe / c copy "C:\star_cat.txt" "C:\Users\Admin\Desktop\recover files,view here.txt"" / sc minute / mo 10 / f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4056
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2084
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2772
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:5876
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2620
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:5200
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
      PID:5216
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5292
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:5804
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2932
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:3996
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:6692
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:6924
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4340
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:5512
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:5508
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2140
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:6732
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:6556
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:6852
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3148
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:6776
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3260
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4616
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4296
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:5892
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2468
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Modifies registry class
      PID:5796
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:5628
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:4816
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:6572
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:5928
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:4480
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:6012
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:3468
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:6156
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:1504
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:776
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4140
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:6108
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:5604
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:4480
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:6916
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:1592
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:3764
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:5872
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:5496
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:5284
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:4124
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:6240
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:2008
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:5716
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:1560
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:6752
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:6368
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:6856
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:2320
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:5440
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:1116
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:6040
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:1336
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:3544
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:6048
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:6924
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:5496
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:6392
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:6688
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:3728
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:3900
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:5996
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:4360

                                                                                          Network

                                                                                          MITRE ATT&CK Enterprise v15

                                                                                          Reconnaissance

                                                                                          Resource Development

                                                                                          Initial Access

                                                                                          Execution

                                                                                          Scheduled Task/Job

                                                                                          1
                                                                                          T1053

                                                                                          Scheduled Task

                                                                                          1
                                                                                          T1053.005

                                                                                          Windows Management Instrumentation

                                                                                          1
                                                                                          T1047

                                                                                          Persistence

                                                                                          Boot or Logon Autostart Execution

                                                                                          2
                                                                                          T1547

                                                                                          Active Setup

                                                                                          1
                                                                                          T1547.014

                                                                                          Registry Run Keys / Startup Folder

                                                                                          1
                                                                                          T1547.001

                                                                                          Scheduled Task/Job

                                                                                          1
                                                                                          T1053

                                                                                          Scheduled Task

                                                                                          1
                                                                                          T1053.005

                                                                                          Privilege Escalation

                                                                                          Boot or Logon Autostart Execution

                                                                                          2
                                                                                          T1547

                                                                                          Active Setup

                                                                                          1
                                                                                          T1547.014

                                                                                          Registry Run Keys / Startup Folder

                                                                                          1
                                                                                          T1547.001

                                                                                          Scheduled Task/Job

                                                                                          1
                                                                                          T1053

                                                                                          Scheduled Task

                                                                                          1
                                                                                          T1053.005

                                                                                          Defense Evasion

                                                                                          Direct Volume Access

                                                                                          1
                                                                                          T1006

                                                                                          Indicator Removal

                                                                                          2
                                                                                          T1070

                                                                                          File Deletion

                                                                                          2
                                                                                          T1070.004

                                                                                          Modify Registry

                                                                                          4
                                                                                          T1112

                                                                                          Credential Access

                                                                                          Credentials from Password Stores

                                                                                          1
                                                                                          T1555

                                                                                          Credentials from Web Browsers

                                                                                          1
                                                                                          T1555.003

                                                                                          Unsecured Credentials

                                                                                          1
                                                                                          T1552

                                                                                          Credentials In Files

                                                                                          1
                                                                                          T1552.001

                                                                                          Discovery

                                                                                          Peripheral Device Discovery

                                                                                          2
                                                                                          T1120

                                                                                          Query Registry

                                                                                          4
                                                                                          T1012

                                                                                          System Information Discovery

                                                                                          4
                                                                                          T1082

                                                                                          Lateral Movement

                                                                                          Collection

                                                                                          Data from Local System

                                                                                          1
                                                                                          T1005

                                                                                          Command and Control

                                                                                          Exfiltration

                                                                                          Impact

                                                                                          Defacement

                                                                                          1
                                                                                          T1491

                                                                                          Inhibit System Recovery

                                                                                          2
                                                                                          T1490

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          • C:\USERS\ADMIN\DESKTOP\RECOVER FILES,VIEW HERE.TXT
                                                                                            Filesize

                                                                                            63KB

                                                                                            MD5

                                                                                            4c51557e0283e5dc0fedf6c4fb0268d6

                                                                                            SHA1

                                                                                            a528c9c04f8a3939a1ff36bee0290b516fca446a

                                                                                            SHA256

                                                                                            5a305f97a98bec55f77ca5c1c57613c9c42b087b4517695e4b7b53127b26a141

                                                                                            SHA512

                                                                                            9d81ba5ccefbca99f18d9354bc66071d40ca59c373abe3968f0787224db95bd449b0218bcaeb45c9eca3f7890927c27d9f4431c6ed8732484e29ef4fd09fcfca

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                            Filesize

                                                                                            471B

                                                                                            MD5

                                                                                            bb71b013e563b7ae869761fe2b37c4e5

                                                                                            SHA1

                                                                                            f8e1fc825c466058acc909f5c4f1ffc640b87779

                                                                                            SHA256

                                                                                            114eb2409b821e694df21047f77fb8b36d212d2c4766ac8abf6814d6d594a274

                                                                                            SHA512

                                                                                            7bbc40233ccd7f4ac97eb1646001eca79fbad892f45de131047e8a1a8c07196dc6ee1eb11aab56f87f29c40c24273ec63db132260cacdd83546709bf0ce5d3ab

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                            Filesize

                                                                                            412B

                                                                                            MD5

                                                                                            6003fbf12ec403293a4bafc8aa7a5550

                                                                                            SHA1

                                                                                            6a2cdc1ca48eb62eb4b2010e08d75545bca1eb88

                                                                                            SHA256

                                                                                            2d505833b23f1dac7317da3ad1cec4147aee122883803264ce9bd05171c4cf0b

                                                                                            SHA512

                                                                                            7eb69eca86bdd194bd28e17faeb5bb89a79a613531064249454b2bd6cf21ba01dcbe4c155bbe128f725acdfdd5b203cbf8bc1921f759f0c4086a34c6f9be4088

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.starcat
                                                                                            Filesize

                                                                                            423KB

                                                                                            MD5

                                                                                            ce60910cf06a324a1abdf42801bd8fc2

                                                                                            SHA1

                                                                                            00013342469335521758cb6edbe5bc02cca2149f

                                                                                            SHA256

                                                                                            a1b0f3cb8124a63f901ea25e35f223804a140082b7edee3196398f395c875698

                                                                                            SHA512

                                                                                            0f0eb6959d759a377bfcddbc63ab767e2215ed86229b5fe5d7022e75411cb8959adf0e8e8939898b619bc78da8156bfea2568e466c96be65378a0fbe17b9a82a

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db
                                                                                            Filesize

                                                                                            1024KB

                                                                                            MD5

                                                                                            e7f91026df1bd7b20694c01a0b34dd38

                                                                                            SHA1

                                                                                            8074d4b3c3118afa0b7f84f10fd94b5df0c02682

                                                                                            SHA256

                                                                                            4b1aba5070b2f93e9698b5bcfb3f2ef36bb06c2499214742fae298b8c75fccdc

                                                                                            SHA512

                                                                                            419f08ac855e844ac3439882b7e9a821c05b08fa90092e63d00174803908354b6619649de80edcfe600851a775962b4919c4cc25e3c6e9049cc7420eed6be776

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db
                                                                                            Filesize

                                                                                            1024KB

                                                                                            MD5

                                                                                            2b9d68996030647ebc4ab9dba3253096

                                                                                            SHA1

                                                                                            ebfd906c71d017d0323fbdd6854ce8df3740783f

                                                                                            SHA256

                                                                                            c584ac6af0779e9852491219c42b5ffc7fa2c273070fe10bdc7bae027ece208d

                                                                                            SHA512

                                                                                            f1aa43c09f9cbddc6104d61a29d6710aea4e7173b258c2c56ec6e8813030d7fa1c15a26ec65dcf953dc949c392226ef3fd91f57f431694f6df3337801c0cd68b

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
                                                                                            Filesize

                                                                                            1024KB

                                                                                            MD5

                                                                                            ef92a54af04644ceb56342fe47799181

                                                                                            SHA1

                                                                                            b4635a850139fb69fe47de236457fe332cbe42a2

                                                                                            SHA256

                                                                                            cd081062e6650055031ecf59a2f81ef0c32f6a0741aed2f46d55d923171eb8f1

                                                                                            SHA512

                                                                                            2e44dc7fb710de7e6c7f6e6ff9160fbac5879d5ff8b4d2df3ce84ea575233a3924f7b4d9cc22c7708fa18e44e9c4fd539aa8dc27dd23ffa0d12f4e25fed47898

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
                                                                                            Filesize

                                                                                            1024KB

                                                                                            MD5

                                                                                            7def491602fd7a8f3594c4be137a755f

                                                                                            SHA1

                                                                                            7c5e3f06d95bd032f2cf38f62ec387ee827d34e1

                                                                                            SHA256

                                                                                            a5fc564b2a38ec4a3b7bcc443798930f04d33ff7992017b2eb71cf15937c4a60

                                                                                            SHA512

                                                                                            4f417da42f09075415067abda0611fbb31f38f983ea28122e7cfb2aaa7056fd8095f3661b219a886c3522d23fe3970c78ed9d74d62e00f3b39b2b525a5df8b37

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
                                                                                            Filesize

                                                                                            1024KB

                                                                                            MD5

                                                                                            777dd969da3dd17026244668b774e058

                                                                                            SHA1

                                                                                            e0a066d28dfc6bcca1c13a50bfc4b35a37541b7a

                                                                                            SHA256

                                                                                            221f1bd7bad281fe93374736df606e52ce7393ae4fe0bdd4682935b90f184e59

                                                                                            SHA512

                                                                                            1f1a19b1a969a62cd8c83622e89077492457dd00f28505f0fe49a600688b18bf0407cae61e0da9f0d23fd0f6d874125fe83a5666ca7975976d612743fda08158

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
                                                                                            Filesize

                                                                                            1024KB

                                                                                            MD5

                                                                                            909d80096b77f5e6a2f3d781b16b2433

                                                                                            SHA1

                                                                                            e42543e298d70153f8065d8709d6c474787b5ac7

                                                                                            SHA256

                                                                                            fe2d49a08a9a644954e4b95f50cf7a79e69e7c4df86883ef5662d78a86738842

                                                                                            SHA512

                                                                                            6ca3763abe635ddb7ccc7d0b54bed11a9ceaabd99526869da290cbdb7ec6eb11dbe9e9955de1c889aebffb30946150e7b5a706c178169b85868f8b8798a9dcfd

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                                                            Filesize

                                                                                            7KB

                                                                                            MD5

                                                                                            77b65a77cac00fe47b16dd4819c4a4c7

                                                                                            SHA1

                                                                                            5d174cc05cfc487ee35db8aaa770930a26529bc0

                                                                                            SHA256

                                                                                            31aa3f7fa15dc18c49e4e36554fbaed761808284a0fa4a792a48e46d267e0383

                                                                                            SHA512

                                                                                            abcc320916161427a5b5683edd9242ad065680eee55f35b770e24c58f3ddb5b77bc1f58bc4c5fb851bec15b441a8de904a10dbb7eeaf6dcdf9460470d3d33d78

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                                                            Filesize

                                                                                            7KB

                                                                                            MD5

                                                                                            c93e81733b6dc2767b6a67269186d009

                                                                                            SHA1

                                                                                            439e7176e7f49a9dee82ceee6a1ba4ba8e38976d

                                                                                            SHA256

                                                                                            692915c6edf9764c823e2d6b5ef89557e2425e9e7b550570b4b08c2966ee1d30

                                                                                            SHA512

                                                                                            1f0a0a7dbe478503e5e78521ae95663157f309c94d326ef157631a06933b77af82273933a33ade1fbf674bfbe2127fa7e94dd0b3157936db3db8a9e9fdfee471

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db
                                                                                            Filesize

                                                                                            1024KB

                                                                                            MD5

                                                                                            3f3c08348497d4e4573237ce9a933186

                                                                                            SHA1

                                                                                            9f1693cf73f9b1a56a94f3fe68ac67bf28395157

                                                                                            SHA256

                                                                                            2a336d53fc37e2b70c5ecae84425d45b069bcf815e534dd857658ecd146817a1

                                                                                            SHA512

                                                                                            bba231f581e8546c056123fab5baec8c1c8fb35850e970bc37ff2c677f43b0a6c69ffff96ea19ed0a0d685c007fdbd4f51788a5d0241223f2482390734b694fd

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
                                                                                            Filesize

                                                                                            1024KB

                                                                                            MD5

                                                                                            8788a429578bbd0ffecd1da90881a45e

                                                                                            SHA1

                                                                                            114c81c89dcc9e0566e97d5a9eb1ac400a426c17

                                                                                            SHA256

                                                                                            4a9c780ba623637c0733460fab7bafd9e307ca46d4fde2bca81f39db3852cf3e

                                                                                            SHA512

                                                                                            7fa7fc8ef81851e0ce3fd508ae72f62e4be16b9ce3ddf0eb512a34edff9e39b5f12e596fc5731715e21fe522cf2770eda377cf69515c46f3e56a326af09b2fe7

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
                                                                                            Filesize

                                                                                            24B

                                                                                            MD5

                                                                                            ae6fbded57f9f7d048b95468ddee47ca

                                                                                            SHA1

                                                                                            c4473ea845be2fb5d28a61efd72f19d74d5fc82e

                                                                                            SHA256

                                                                                            d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9

                                                                                            SHA512

                                                                                            f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
                                                                                            Filesize

                                                                                            7KB

                                                                                            MD5

                                                                                            37a95caa189e315ea62b4f9223e6f73e

                                                                                            SHA1

                                                                                            460e747f374e71eb45d5200b6b9acc318ce5866e

                                                                                            SHA256

                                                                                            57e3768f85162b1ba3aea79e83f4941a180290295590fc36dcd5efa3232c0feb

                                                                                            SHA512

                                                                                            450a08d3cf659d63d638bbd44e8853f1658858f234fe170d29eb2d3046c9fb74f5e0e123cfb2e45094a3634e2d4df5a4def50889f42b2961663f59927feeaa89

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                            Filesize

                                                                                            2KB

                                                                                            MD5

                                                                                            939b792ea78ab1b65e884f12530eac7c

                                                                                            SHA1

                                                                                            894651a47e587a1cb731ded02417ad0a9fbd1739

                                                                                            SHA256

                                                                                            07a5c47d105741e724fcc67889764b700d855c23cec1e2deed24162529d0444e

                                                                                            SHA512

                                                                                            60b8cc4ca6675b9010fce12743ee395e536ae301b3e585c754408cd062c983847bb4ce338c35df8c2e10f917383086e7d449488448c5af5875b2d788990f10c2

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
                                                                                            Filesize

                                                                                            4KB

                                                                                            MD5

                                                                                            be51320d634658e42e3fb58144cb2e9f

                                                                                            SHA1

                                                                                            6c78fe0baddc89d5d37e9edc5c3b03b8913599f2

                                                                                            SHA256

                                                                                            e7ce42da61c21016b435039acdcf665d978b1bce0cb9c6971a3a3dd3147bdcf3

                                                                                            SHA512

                                                                                            34aaff698f1cb591d24720bf39ef4e7eafb23b903e6c36c17456f57dd1dfe6fa188cd3d8c689f1935bdaa7a1242019ab363b2f91348a42d2d9f0ae0f81f8bac1

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\M6JCG2RK\microsoft.windows[1].xml
                                                                                            Filesize

                                                                                            96B

                                                                                            MD5

                                                                                            732a32ad072ef786d816a4f85b1b6bea

                                                                                            SHA1

                                                                                            fe1945717c160ac3266f291564a003c044d409b0

                                                                                            SHA256

                                                                                            7dd2262373fcd6ebe2ed2c6e66242c85b1434c3fe23ca92ba41ae328ce8b941e

                                                                                            SHA512

                                                                                            55b57d5bf942f20a3557f20adeebb4c01cde4aec9d7a4fa8bfe6281fe0981773d8ce637fdbd1dc64f25abe72d75fad2a6538fadc86483ede9fdc5b59c0d36b79

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\temp.jpg
                                                                                            Filesize

                                                                                            19KB

                                                                                            MD5

                                                                                            dca98809d43472c8353e6c52912c57fa

                                                                                            SHA1

                                                                                            47b611bd17dfaed08f96cc85a851169335c287ae

                                                                                            SHA256

                                                                                            ebd2558bfac96284600e1c35851ab46c2f846d24d3f2b192a55f04f5c88e9afb

                                                                                            SHA512

                                                                                            d3c86ab96b7054d80ff3e17dac66e11b6ac78d1cf3f35f5a56286d7ad5f2198bbcdc88521f6457e18d6263db31c100d8826455f4ba2b0e09bcf5f24cb5e2b574

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg
                                                                                            Filesize

                                                                                            51KB

                                                                                            MD5

                                                                                            bd74a3c50fd08981e89d96859e176d68

                                                                                            SHA1

                                                                                            0a98b96aefe60b96722d587b7c3aabcd15927618

                                                                                            SHA256

                                                                                            ab305218ee0e95fa553885fa52f3a25dcc13b4deade8b7993ccb9f230a272837

                                                                                            SHA512

                                                                                            0704243904abc3691177e34606fe2741945f69cf7ecb898655d98e81b145bf707d20cfa0af01fb3aa1cd170e2f3ce8f625b1612e0fcf5eba01f770617ffc9f1e

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg
                                                                                            Filesize

                                                                                            71KB

                                                                                            MD5

                                                                                            5866436beb81607d55502974b7e55ee8

                                                                                            SHA1

                                                                                            e0071b16b3b1e05bdd90fdb472043ee91f6168b4

                                                                                            SHA256

                                                                                            e71b2c9dcb96810033f7950e8e07cd83b0e9a460f70fc161d3676fe58b95babc

                                                                                            SHA512

                                                                                            6100ce131714422aa6178ae1388224ac6e56dfaaeb8fd9eecc71ed388ad903a1fba97148bf2d20ab94d4d90829d6c921b12aaa5c31f84978ef181e2548583abd

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg.starcat
                                                                                            Filesize

                                                                                            53KB

                                                                                            MD5

                                                                                            888754421753fa8d7cd6bb4c9a3784c9

                                                                                            SHA1

                                                                                            56c29a73fa832e4337f2859c83f2bab0002c41d3

                                                                                            SHA256

                                                                                            3901d0ca731791608696b61b8d43b88d2155549dfb23debf53d56e702fae2981

                                                                                            SHA512

                                                                                            ac19996bf9486f8feef2a67dddbaf5d71016f7d9a8ab98b6ff2a1b6789154ea6e5d71f31d9284aa5f6b2af0f14817ff59d0baf5244f4e62abbbc9bfc488f1dc2

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
                                                                                            Filesize

                                                                                            24KB

                                                                                            MD5

                                                                                            7e93852ca29d9683dcbc288093ce7e67

                                                                                            SHA1

                                                                                            62b2903846c969aa772df37505ecfc0a4c851e26

                                                                                            SHA256

                                                                                            4058ba0c855d399503b9f1d472bfaac21df42d3463ef19ddbf885b926f62d40c

                                                                                            SHA512

                                                                                            8c75a882bbf081e1e68d36c79a4c394e45ae5f6e5569abb00f780b57757de0824e632ec260d16e24e4c9559dbf4555b36fa55ed80b4c8dee9aa8f6dcb1ac3daa

                                                                                            Download Submit

                                                                                          • memory/1504-2385-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/2140-1475-0x0000023DADF00000-0x0000023DAE000000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/2140-1473-0x0000023DADF00000-0x0000023DAE000000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/2140-1505-0x0000023DAF4C0000-0x0000023DAF4E0000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/2140-1478-0x0000023DAEEF0000-0x0000023DAEF10000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/2140-1490-0x0000023DAEEB0000-0x0000023DAEED0000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/2140-1474-0x0000023DADF00000-0x0000023DAE000000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/2932-1465-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/3260-1794-0x0000000002D10000-0x0000000002D11000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/3764-2692-0x000002095C300000-0x000002095C400000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/3764-2727-0x000002095D6B0000-0x000002095D6D0000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/3764-2705-0x000002095D2A0000-0x000002095D2C0000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/3764-2696-0x000002095D2E0000-0x000002095D300000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4140-2414-0x000001D2D6840000-0x000001D2D6860000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4140-2402-0x000001D2D6430000-0x000001D2D6450000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4140-2392-0x000001D2D6470000-0x000001D2D6490000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4140-2389-0x000001D2D5450000-0x000001D2D5550000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4140-2387-0x000001D2D5450000-0x000001D2D5550000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4296-1801-0x00000195A5860000-0x00000195A5880000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4296-1811-0x00000195A5820000-0x00000195A5840000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4296-1798-0x0000018DA3840000-0x0000018DA3940000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4296-1797-0x0000018DA3840000-0x0000018DA3940000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4296-1796-0x0000018DA3840000-0x0000018DA3940000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4296-1823-0x00000195A5C30000-0x00000195A5C50000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4340-1469-0x00000000020C0000-0x00000000020C1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/4480-2092-0x0000016174E80000-0x0000016174EA0000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4480-2543-0x00000243E6000000-0x00000243E6100000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4480-2087-0x0000016173F00000-0x0000016174000000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4480-2563-0x00000243E6FE0000-0x00000243E7000000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4480-2114-0x0000016175250000-0x0000016175270000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4480-2103-0x0000016174E40000-0x0000016174E60000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4480-2575-0x00000243E73F0000-0x00000243E7410000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4480-2541-0x00000243E6000000-0x00000243E6100000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4480-2542-0x00000243E6000000-0x00000243E6100000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4480-2546-0x00000243E7020000-0x00000243E7040000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4816-1945-0x000002157D700000-0x000002157D800000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4816-1944-0x000002157D700000-0x000002157D800000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4816-1958-0x000002157E6A0000-0x000002157E6C0000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4816-1970-0x000002157EAB0000-0x000002157EAD0000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4816-1949-0x000002157E6E0000-0x000002157E700000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/5284-2838-0x00000255AB000000-0x00000255AB100000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/5284-2839-0x00000255AB000000-0x00000255AB100000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/5512-1471-0x0000000003770000-0x0000000003771000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/5796-1943-0x0000000004560000-0x0000000004561000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/5872-2837-0x0000000004A00000-0x0000000004A01000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/6012-2233-0x0000000004120000-0x0000000004121000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/6108-2540-0x0000000004610000-0x0000000004611000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/6156-2236-0x000001E66DD00000-0x000001E66DE00000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/6156-2235-0x000001E66DD00000-0x000001E66DE00000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/6156-2264-0x000001E66F030000-0x000001E66F050000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/6156-2240-0x000001E66EC60000-0x000001E66EC80000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/6156-2252-0x000001E66EC20000-0x000001E66EC40000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/6572-2086-0x00000000041D0000-0x00000000041D1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/6732-1639-0x0000000004410000-0x0000000004411000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/6852-1678-0x0000024CC8A00000-0x0000024CC8A20000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/6852-1646-0x0000024CC8640000-0x0000024CC8660000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/6852-1658-0x0000024CC8600000-0x0000024CC8620000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/6916-2688-0x00000000042B0000-0x00000000042B1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download