Overview

overview

10

Static

static

10

2024-12-18...ta.exe

windows7-x64

10

2024-12-18...ta.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2024 14:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-18_69045be037a5cf8195966f57bb30e5c5_darkside_neshta.exe

  • Size

    188KB

  • MD5

    69045be037a5cf8195966f57bb30e5c5

  • SHA1

    d4f157136a1b8f43c474b2eaf6cbe86ead68ff62

  • SHA256

    f6c31b093d8940526584290954905d42e87bd16dd88fb64a876216a4e7a3805a

  • SHA512

    dd02da0a0f0aa40324c0717848899deb8d83d48edcaf3ab021eea431764d6efeb52b7943fe04e5987dd92b7f4d8c960a9586906ad0785e78aa990f787e66b398

  • SSDEEP

    3072:sr85CDcSNm9V7DzY07RiY/JhsUogtP9bW3KVu5RTfqJogYg:k9Dc4m9tDzY079sUocPCIm1q2g

Score
10/10
lockbitneshtadefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Qoi6ifOVU.README.txt

Ransom Note
~~~ Cerber 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom EMAIL US - [email protected] >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> Your personal DECRYPTION ID: AD7936094A57E9729819A0D540A6D376 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. If you want to contact us, write in EMAIL [email protected]

Signatures

  • Detect Neshta payload 39 IoCs
  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Lockbit family
    lockbit
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Neshta family
    neshta
  • Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
  • Renames multiple (639) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-18_69045be037a5cf8195966f57bb30e5c5_darkside_neshta.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-18_69045be037a5cf8195966f57bb30e5c5_darkside_neshta.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3620
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2024-12-18_69045be037a5cf8195966f57bb30e5c5_darkside_neshta.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-12-18_69045be037a5cf8195966f57bb30e5c5_darkside_neshta.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Sets desktop wallpaper using registry
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2264
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
        • Drops file in System32 directory
        PID:2468
      • C:\ProgramData\EFA1.tmp
        "C:\ProgramData\EFA1.tmp"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5332
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\EFA1.tmp >> NUL
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6024
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\System32\cmd.exe /C DEL /F /Q C:\PROGRA~3\EFA1.tmp >> NUL
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5548
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
    1⤵
      PID:2052
    • C:\Windows\system32\printfilterpipelinesvc.exe
      C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
      1⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2132
      • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
        /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{0298C828-A057-41AB-B2C0-EC751CC9052C}.xps" 133790054332940000
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of SetWindowsHookEx
        PID:5212

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-493223053-2004649691-1575712786-1000\desktop.ini
      Filesize

      129B

      MD5

      bd833fd2aae71f62127f4376605a9819

      SHA1

      63670037a3882e74fecd07e0dd20a140d909e0a6

      SHA256

      276d2d775ff6de9ea07571aa544c469041fb962a298f502333388b4b122b2859

      SHA512

      38f2a45646b2e4a2d1b576c2a229aa574dc3208c8af73bf03d16c383a059bc036c1206c6f9f60d74dd060e1d77dc12f587e008e02348bfd3afe7afc4df14906c

      Download Submit

    • C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE
      Filesize

      485KB

      MD5

      86749cd13537a694795be5d87ef7106d

      SHA1

      538030845680a8be8219618daee29e368dc1e06c

      SHA256

      8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5

      SHA512

      7b6ae20515fb6b13701df422cbb0844d26c8a98087b2758427781f0bf11eb9ec5da029096e42960bf99ddd3d4f817db6e29ac172039110df6ea92547d331db4c

      Download Submit

    • C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE
      Filesize

      674KB

      MD5

      97510a7d9bf0811a6ea89fad85a9f3f3

      SHA1

      2ac0c49b66a92789be65580a38ae9798237711db

      SHA256

      c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea

      SHA512

      2a93e2a3bd187fdde160f87ef777ccd1d1c398d547b7c869e6b64469b9418ad04d887cdfe94af7407476377bf2d009f576de3935c025b7aefbab26fbcd8f90fb

      Download Submit

    • C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{57A73~1\VC_RED~1.EXE
      Filesize

      674KB

      MD5

      9c10a5ec52c145d340df7eafdb69c478

      SHA1

      57f3d99e41d123ad5f185fc21454367a7285db42

      SHA256

      ccf37e88447a7afdb0ba4351b8c5606dbb05b984fb133194d71bcc00d7be4e36

      SHA512

      2704cfd1a708bfca6db7c52467d3abf0b09313db0cdd1ea8e5d48504c8240c4bf24e677f17c5df9e3ac1f6a678e0328e73e951dc4481f35027cb03b2966dc38f

      Download Submit

    • C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{61087~1\VCREDI~1.EXE
      Filesize

      495KB

      MD5

      9597098cfbc45fae685d9480d135ed13

      SHA1

      84401f03a7942a7e4fcd26e4414b227edd9b0f09

      SHA256

      45966655baaed42df92cd6d8094b4172c0e7a0320528b59cf63fca7c25d66e9c

      SHA512

      16afbdffe4b4b2e54b4cc96fe74e49ca367dea50752321ddf334756519812ba8ce147ef5459e421dc42e103bc3456aab1d185588cc86b35fa2315ac86b2a0164

      Download Submit

    • C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{CA675~1\VCREDI~1.EXE
      Filesize

      485KB

      MD5

      87f15006aea3b4433e226882a56f188d

      SHA1

      e3ad6beb8229af62b0824151dbf546c0506d4f65

      SHA256

      8d0045c74270281c705009d49441167c8a51ac70b720f84ff941b39fad220919

      SHA512

      b01a8af6dc836044d2adc6828654fa7a187c3f7ffe2a4db4c73021be6d121f9c1c47b1643513c3f25c0e1b5123b8ce2dc78b2ca8ce638a09c2171f158762c7c1

      Download Submit

    • C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
      Filesize

      495KB

      MD5

      07e194ce831b1846111eb6c8b176c86e

      SHA1

      b9c83ec3b0949cb661878fb1a8b43a073e15baf1

      SHA256

      d882f673ddf40a7ea6d89ce25e4ee55d94a5ef0b5403aa8d86656fd960d0e4ac

      SHA512

      55f9b6d3199aa60d836b6792ae55731236fb2a99c79ce8522e07e579c64eabb88fa413c02632deb87a361dd8490361aa1424beed2e01ba28be220f8c676a1bb5

      Download Submit

    • C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE
      Filesize

      6.7MB

      MD5

      63dc05e27a0b43bf25f151751b481b8c

      SHA1

      b20321483dac62bce0aa0cef1d193d247747e189

      SHA256

      7d607fb69c69a72a5bf4305599279f46318312ce1082b6a34ac9100b8c7762ce

      SHA512

      374d705704d456cc5f9f79b7f465f6ec7c775dc43001c840e9d6efbbdef20926ed1fa97f8a9b1e73161e17f72520b96c05fa58ac86b3945208b405f9166e7ba3

      Download Submit

    • C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{63880~1\WINDOW~1.EXE
      Filesize

      650KB

      MD5

      558fdb0b9f097118b0c928bb6062370a

      SHA1

      ad971a9a4cac3112a494a167e1b7736dcd6718b3

      SHA256

      90cee4a89cc1401ac464818226b7df69aa930804cefce56758d4e2ea0009d924

      SHA512

      5d08d5428e82fb3dad55c19e2c029de8f16e121faac87575b97f468b0ec312b3e0696225546cba91addaaf8f2451d44ae6386b4e4f7f621ce45055f3be797d7c

      Download Submit

    • C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{D87AE~1\WINDOW~1.EXE
      Filesize

      650KB

      MD5

      2f826daacb184077b67aad3fe30e3413

      SHA1

      981d415fe70414aaac3a11024e65ae2e949aced8

      SHA256

      a6180f0aa9c56c32e71fe8dc150131177e4036a5a2111d0f3ec3c341fd813222

      SHA512

      2a6d9bdf4b7be9b766008e522cbb2c21921ba55d84dfde653ca977f70639e342a9d5548768de29ae2a85031c11dac2ae4b3c76b9136c020a6e7c9a9a5879caeb

      Download Submit

    • C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{EF5AF~1\WINDOW~1.EXE
      Filesize

      650KB

      MD5

      72d0addae57f28c993b319bfafa190ac

      SHA1

      8082ad7a004a399f0edbf447425f6a0f6c772ff3

      SHA256

      671be498af4e13872784eeae4bae2e462dfac62d51d7057b2b3bebff511b7d18

      SHA512

      98bcde1133edbff713aa43b944dceb5dae20a9cbdf8009f5b758da20ccfbcdf6d617f609a7094aa52a514373f6695b0fd43c3d601538483816cd08832edd15ab

      Download Submit

    • C:\DOCUME~1\ALLUSE~1\Adobe\Setup\{AC76B~1\setup.exe
      Filesize

      494KB

      MD5

      05bdfd8a3128ab14d96818f43ebe9c0e

      SHA1

      495cbbd020391e05d11c52aa23bdae7b89532eb7

      SHA256

      7b945c7e6b8bfbb489f003ecd1d0dcd4803042003de4646d4206114361a0fbbb

      SHA512

      8d9b9fc407986bd53fe3b56c96b7371cc782b4bac705253bfb0a2b0b1e6883fdb022f1ac87b8bfd7005291991b6a3dfbaceab54f5d494e0af70f0435a0b8b0da

      Download Submit

    • C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\OneDrive\OneDrive.exe
      Filesize

      1.6MB

      MD5

      3a3a71a5df2d162555fcda9bc0993d74

      SHA1

      95c7400f85325eba9b0a92abd80ea64b76917a1a

      SHA256

      0a023355d1cc0a2348475d63aaf6aa0521d11e12a5c70102d7b3ebde092849e8

      SHA512

      9ad76ccce76ccfe8292bca8def5bc7255e7ea0ba6d92130c4350da49a3d7faef2d46b08aaef1955f3f4ea0a2e22451562b5e08783a79f794724584e409cf7837

      Download Submit

    • C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\OneDrive\181510~1.001\FILECO~1.EXE
      Filesize

      499KB

      MD5

      346d2ff654d6257364a7c32b1ec53c09

      SHA1

      224301c0f56a870f20383c45801ec16d01dc48d1

      SHA256

      a811042693bc2b31be7e3f454b12312f67bc97f2b15335a97e8d8f2ba0a6b255

      SHA512

      223545e3fc9f3cd66c5cbcb50dd7103743788f03a9db398da6dd2744ccaeee291f385ce4f2758d4504fc0f6b968fabbfe16ba03b5f546b743c51dacad7a049c3

      Download Submit

    • C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\OneDrive\181510~1.001\FILESY~1.EXE
      Filesize

      293KB

      MD5

      f3228c24035b3f54f78bb4fd11c36aeb

      SHA1

      2fe73d1f64575bc4abf1d47a9dddfe7e2d9c9cbb

      SHA256

      d2767c9c52835f19f6695c604081bf03cdd772a3731cd2e320d9db5e477d8af7

      SHA512

      b526c63338d9167060bc40ffa1d13a8c2e871f46680cd4a0efc2333d9f15bf21ae75af45f8932de857678c5bf785011a28862ce7879f4bffdb9753c8bc2c19b5

      Download Submit

    • C:\DOCUME~1\Admin\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\MICROS~1\OneDrive\ONEDRI~1.EXE
      Filesize

      2.4MB

      MD5

      1319acbba64ecbcd5e3f16fc3acd693c

      SHA1

      f5d64f97194846bd0564d20ee290d35dd3df40b0

      SHA256

      8c6f9493c2045bb7c08630cf3709a63e221001f04289b311efb259de3eb76bce

      SHA512

      abbbb0abfff1698e2d3c4d27d84421b90abba1238b45884b82ace20d11ddfdd92bf206519fc01714235fb840258bb1c647c544b9a19d36f155bf3224916805b8

      Download Submit

    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
      Filesize

      328KB

      MD5

      39c8a4c2c3984b64b701b85cb724533b

      SHA1

      c911f4c4070dfe9a35d9adcb7de6e6fb1482ce00

      SHA256

      888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d

      SHA512

      f42ca2962fe60cff1a13dea8b81ff0647b317c785ee4f5159c38487c34d33aecba8478757047d31ab2ee893fbdcb91a21655353456ba6a018fc71b2278db4db2

      Download Submit

    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
      Filesize

      86KB

      MD5

      3b73078a714bf61d1c19ebc3afc0e454

      SHA1

      9abeabd74613a2f533e2244c9ee6f967188e4e7e

      SHA256

      ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

      SHA512

      75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

      Download Submit

    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
      Filesize

      5.7MB

      MD5

      09acdc5bbec5a47e8ae47f4a348541e2

      SHA1

      658f64967b2a9372c1c0bdd59c6fb2a18301d891

      SHA256

      1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403

      SHA512

      3867bf98e1a0e253114a98b78b047b0d8282b5abf4aaf836f31cc0e26224e2a1b802c65df9d90dc7696a6dbcb9a8e4b900f1d1299e1b11e36f095ebaf8a2e5b8

      Download Submit

    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
      Filesize

      175KB

      MD5

      576410de51e63c3b5442540c8fdacbee

      SHA1

      8de673b679e0fee6e460cbf4f21ab728e41e0973

      SHA256

      3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe

      SHA512

      f7761f3878775b30cc3d756fa122e74548dfc0a27e38fa4109e34a59a009df333d074bf14a227549ae347605f271be47984c55148685faac479aeb481f7191db

      Download Submit

    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
      Filesize

      9.4MB

      MD5

      322302633e36360a24252f6291cdfc91

      SHA1

      238ed62353776c646957efefc0174c545c2afa3d

      SHA256

      31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c

      SHA512

      5a1f7c44ce7f5036bffc18ebac39e2bf70e6f35fa252617d665b26448f4c4473adfa115467b7e2d9b7068823e448f74410cdcdfef1ac1c09021e051921787373

      Download Submit

    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
      Filesize

      2.4MB

      MD5

      8ffc3bdf4a1903d9e28b99d1643fc9c7

      SHA1

      919ba8594db0ae245a8abd80f9f3698826fc6fe5

      SHA256

      8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6

      SHA512

      0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427

      Download Submit

    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
      Filesize

      183KB

      MD5

      9dfcdd1ab508b26917bb2461488d8605

      SHA1

      4ba6342bcf4942ade05fb12db83da89dc8c56a21

      SHA256

      ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5

      SHA512

      1afc1b95f160333f1ff2fa14b3f22a28ae33850699c6b5498915a8b6bec1cfc40f33cb69583240aa9206bc2ea7ab14e05e071275b836502a92aa8c529fc1b137

      Download Submit

    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
      Filesize

      131KB

      MD5

      5791075058b526842f4601c46abd59f5

      SHA1

      b2748f7542e2eebcd0353c3720d92bbffad8678f

      SHA256

      5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394

      SHA512

      83e303971ed64019fde9e4ba6f6e889f8fb105088490dfa7dcf579a12baff20ef491f563d132d60c7b24a4fd3cac29bd9dc974571cd162000fae8fba4e0e54fb

      Download Submit

    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
      Filesize

      254KB

      MD5

      4ddc609ae13a777493f3eeda70a81d40

      SHA1

      8957c390f9b2c136d37190e32bccae3ae671c80a

      SHA256

      16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950

      SHA512

      9d7f90d1529cab20078c2690bf7bffab5a451a41d8993781effe807e619da0e7292f991da2f0c5c131b111d028b3e6084e5648c90816e74dfb664e7f78181bc5

      Download Submit

    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
      Filesize

      386KB

      MD5

      8c753d6448183dea5269445738486e01

      SHA1

      ebbbdc0022ca7487cd6294714cd3fbcb70923af9

      SHA256

      473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997

      SHA512

      4f6fddefc42455540448eac0b693a4847e21b68467486376a4186776bfe137337733d3075b7b87ed7dac532478dc9afc63883607ec8205df3f155fee64c7a9be

      Download Submit

    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
      Filesize

      92KB

      MD5

      176436d406fd1aabebae353963b3ebcf

      SHA1

      9ffdfdb8cc832a0c6501c4c0e85b23a0f7eff57a

      SHA256

      2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f

      SHA512

      a2d1a714e0c1e5463260c64048ba8fd5064cfa06d4a43d02fc04a30748102ff5ba86d20a08e611e200dc778e2b7b3ae808da48132a05a61aa09ac424a182a06a

      Download Submit

    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
      Filesize

      147KB

      MD5

      3b35b268659965ab93b6ee42f8193395

      SHA1

      8faefc346e99c9b2488f2414234c9e4740b96d88

      SHA256

      750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb

      SHA512

      035259a7598584ddb770db3da4e066b64dc65638501cdd8ff9f8e2646f23b76e3dfffa1fb5ed57c9bd15bb4efa3f7dd33fdc2e769e5cc195c25de0e340eb89ab

      Download Submit

    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
      Filesize

      125KB

      MD5

      cce8964848413b49f18a44da9cb0a79b

      SHA1

      0b7452100d400acebb1c1887542f322a92cbd7ae

      SHA256

      fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5

      SHA512

      bf8fc270229d46a083ced30da6637f3ca510b0ce44624a9b21ec6aacac81666dffd41855053a936aa9e8ea6e745a09b820b506ec7bf1173b6f1837828a35103d

      Download Submit

    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
      Filesize

      142KB

      MD5

      92dc0a5b61c98ac6ca3c9e09711e0a5d

      SHA1

      f809f50cfdfbc469561bced921d0bad343a0d7b4

      SHA256

      3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc

      SHA512

      d9eefb19f82e0786d9be0dbe5e339d25473fb3a09682f40c6d190d4c320cca5556abb72b5d97c6b0da4f8faefdc6d39ac9d0415fdf94ebcc90ecdf2e513c6a31

      Download Submit

    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
      Filesize

      278KB

      MD5

      12c29dd57aa69f45ddd2e47620e0a8d9

      SHA1

      ba297aa3fe237ca916257bc46370b360a2db2223

      SHA256

      22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880

      SHA512

      255176cd1a88dfa2af3838769cc20dc7ad9d969344801f07b9ebb372c12cee3f47f2dba3559f391deab10650875cad245d9724acfa23a42b336bfa96559a5488

      Download Submit

    • C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
      Filesize

      454KB

      MD5

      bcd0f32f28d3c2ba8f53d1052d05252d

      SHA1

      c29b4591df930dabc1a4bd0fa2c0ad91500eafb2

      SHA256

      bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb

      SHA512

      79f407735853f82f46870c52058ceee4d91857a89db14868ee1169abd5c0fd2e3fa1ed230ab90b5f479a9581b88998643d69b0df498defea29e73b0d487f3b10

      Download Submit

    • C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
      Filesize

      1.2MB

      MD5

      d47ed8961782d9e27f359447fa86c266

      SHA1

      d37d3f962c8d302b18ec468b4abe94f792f72a3b

      SHA256

      b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a

      SHA512

      3e33f2cdf35024868b183449019de9278035e7966b342ba320a6c601b5629792cbb98a19850d4ca80b906c85d10e8503b0193794d1f1efa849fa33d26cff0669

      Download Submit

    • C:\ProgramData\EFA1.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • C:\Qoi6ifOVU.README.txt
      Filesize

      1KB

      MD5

      52e7dd2c153a67f3cd13adc86a17f593

      SHA1

      492ee333e0b4027630dc961868cf8e020e3e1740

      SHA256

      69bae520d3f873e2e65bfec75e7593430603bb9456e91cf8de96470baf20079e

      SHA512

      c1dba810c6bd2b481595640be1943d0e5bc47f2270863c32421c26124576b8d879c9436f9d232d14a6436ea7c3a6d54b71cf5c15c7ad99efb9a03924785a6e3f

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\3582-490\2024-12-18_69045be037a5cf8195966f57bb30e5c5_darkside_neshta.exe
      Filesize

      147KB

      MD5

      1d2ac566e1352e8934f62c2fcc212ca8

      SHA1

      fd15acde40a86dd0c8fbc47f22a74771d4f2f049

      SHA256

      a752c27ff76b8a4dee4748d5ac7cf57ae416ddb6acef7346ca2b2d333123699c

      SHA512

      814c409428c679c881f524d9a45f8ca000c6e9dc181314682a6db209140643642d6eaf9515f4e6d7d1f6bc2f24dc453ca96d71657dd16e47929f5dda345b1ef5

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      147KB

      MD5

      9edb9f62816de3bba274c45247e36391

      SHA1

      8bc16ca250e4b1b221099c909e93447df8c88f66

      SHA256

      8dbfe21b9d0b397730ecdb99b14cb0ea8b5d65dc590e65f4867217694a12116a

      SHA512

      4563fd24a4d5291b5cd0281e987dfe2a35a3116e261ca1b318034b3abb6bffed5fa56eea3e49a2d40ab001db3e883936f59aac62de4abdae3723caffd886b6a2

      Download Submit

    • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
      Filesize

      4KB

      MD5

      25c37a590c7eb1dd6d315f50f652be5b

      SHA1

      eff29dd48a80e2c63229797e56853a14543d1d44

      SHA256

      1236377c58a17b394aeb06c192dc669d3268ccb8cfadafb75e0c7d4227d20a33

      SHA512

      cb77bcc94da7c5fce17af63234c6215d517009d0e1139a6c33e4a64da040032cfbd42e7a65455d7bf38e029233774f8862224b3d7e9d46dd22f6eb3c6caf4967

      Download Submit

    • C:\Windows\svchost.com
      Filesize

      40KB

      MD5

      36fd5e09c417c767a952b4609d73a54b

      SHA1

      299399c5a2403080a5bf67fb46faec210025b36d

      SHA256

      980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

      SHA512

      1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-493223053-2004649691-1575712786-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      4e8248b160086cb24e3d20d0a14c528c

      SHA1

      8a655cfaa4910de234938e8b3589ba2b583f8dd9

      SHA256

      e7298c69b970cf68533fe1e0997e336fcd3dba472081f497a35f8fa34e9c31e1

      SHA512

      e39e5f5ae396e96aaa7a35e94c1c3dad03bdd7a97a9e028f592eb07c4bd8d6062fd6b9dd47e8177a81807927f96491d990d0ffc4127d99e4be2652af64e89ba8

      Download Submit

    • memory/2264-11-0x0000000001170000-0x0000000001180000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2264-3007-0x0000000001170000-0x0000000001180000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2264-9-0x0000000001170000-0x0000000001180000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2264-10-0x0000000001170000-0x0000000001180000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2264-3009-0x0000000001170000-0x0000000001180000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2264-3008-0x0000000001170000-0x0000000001180000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3620-3075-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/3620-3010-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/3620-3006-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/3620-3126-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/5212-3022-0x00007FFBF6A10000-0x00007FFBF6A20000-memory.dmp

      Filesize

      64KB

      Download

    • memory/5212-3023-0x00007FFBF6A10000-0x00007FFBF6A20000-memory.dmp

      Filesize

      64KB

      Download

    • memory/5212-3024-0x00007FFBF6A10000-0x00007FFBF6A20000-memory.dmp

      Filesize

      64KB

      Download

    • memory/5212-3066-0x00007FFBF40B0000-0x00007FFBF40C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/5212-3059-0x00007FFBF40B0000-0x00007FFBF40C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/5212-3025-0x00007FFBF6A10000-0x00007FFBF6A20000-memory.dmp

      Filesize

      64KB

      Download

    • memory/5212-3028-0x00007FFBF6A10000-0x00007FFBF6A20000-memory.dmp

      Filesize

      64KB

      Download

    • memory/6024-3121-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/6024-3128-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download