chaos | 3730e9cba4a93bc985ef7cd2368ccbf5eccd4724f514b38b20e320e5553dd08d

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
25/03/2025, 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe
Size

71KB
MD5

8f033c07f57f8ce2e62e3a327f423d55
SHA1

57ac411652d7b1d9accaa8a1af5f4b6a45ef7448
SHA256

6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b
SHA512

f3712e7d5d55b27a4c20de07cce136e6d58ce62fa146d29b34dece6248e4456139703c50df10cb318346311cfeee0a8449d49163e821744efcde3ecfe8b880df
SSDEEP

768:zncoLkaCbCq2l52DbnoPV0Yglwlu1y7e7th3BuItxn:QoLkaCb12l0DbCV6Wqyixn

Score

10^/10

chaos defense_evasion discovery evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\ProgramData\Adobe\Updater6\Restore_Files.html

Ransom Note

<img src='https://odkrywcyplanet.pl/wp-content/uploads/2020/05/galaktyka-Cosmos-Redshift-7.jpg' alt='' width='235' height='167' /> A S T R A L O C K E R 2.0   What happened? ---------------------------------------------- All Your files has been succesfully encrypted due to security problem with Your PC. All Your backups are deleted, or encrypted. Can I recover my files? ---------------------------------------------- Sure! But You need special decryptor for that. If You want to recover Your files, you need to cooperate. What can I do to get my files back? ---------------------------------------------- You can buy my decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer. The price for the software is about 50$ (USD). Payment can be made in Monero, or Bitcoin (Cryptocurrency) only. What guarantees? ---------------------------------------------- I value my reputation. If i do not do my work and liabilities, nobody will pay me. This is not in my interests. All my decryption software is perfectly tested and will decrypt your data. How do I pay, where do I get Monero or Bitcoin? ---------------------------------------------- Purchasing Monero or Bitcoin varies by country, it's best to do a quick google search yourself to learn how to buy Monero or Bitcoin. You need to pay 50$ in Bitcoin or Monero. You can buy Bitcoin here: https://localbitcoins.com/ Where i can pay? ---------------------------------------------- Monero Address: 48CEU93NRDqCmH3qfksLRLeQJ9mjbFCUXEyZkStiRDWtDodmAtd7voHF1sHa17MgmoYmMoErrJstV6nC1DqYoKxT38r6TUh Bitcoin Addres: bc1qpawwquwas0gd88u66hgxp222p52madqp5lk5xw Contact ---------------------------------------------- After payment contact: [email protected] and send Your personal ID with transaction ID (if you are paying with Bitcoin) Warning! If you report these emails, they may be suspended and NOBODY gets help. It is in Your INTEREST to get the decryptor. Your personal ID is: ID12_Yashma 1)Don't change the extension of the files. You will harm the files. 2)Don't move encrypted files. 3)Don't try to recover files by Yourself. This is impossible. Your files are encrypted with Curve25519 encryption algorithm, You can't decrypt files without private key. 4)Don't report to authoritaries. If You do it, key will be deleted, and Your files will be encrypted forever. 5)The price will be lower if you email me within 24 hours after encrypting your files.

Emails

/>[email protected]<br

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 3 IoCs

resource	yara_rule
behavioral31/memory/2872-1-0x0000000000EA0000-0x0000000000EB8000-memory.dmp	family_chaos
behavioral31/files/0x000a000000012011-7.dat	family_chaos
behavioral31/memory/2276-10-0x00000000008A0000-0x00000000008B8000-memory.dmp	family_chaos

Chaos family
chaos
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1948	bcdedit.exe
832	bcdedit.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1080	wbadmin.exe

Disables Task Manager via registry modification
defense_evasion

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Restore_Files.html	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2276	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	svchost.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\07ABS1DK\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\KZ8AGS28\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-677481364-2238709445-1347953534-1000\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\8IHN5N04\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Ringtones\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\IIIOELH0\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L8L5LT1I\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GII6F5KT\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SHJ9WA7E\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2416	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000596298383b88f045b768ac3737055a0400000000020000000000106600000001000020000000ba9b0f6e951e02539d486cafcc1a6bcd3e56711b3f1aa48bb0ba1bb598be21f0000000000e80000000020000200000004df9bde6c1b4e7d07b31f16248a00176f1e6e6218a928f1d28f95aaffc5e64192000000094ace0f4d03fc3a9c5c26a0a3adff0fedf6d9010f8e380e4c30b1f360cf5c96040000000258204d0d5ad809afe92b692340b33a887b6d3590f5e4d9d5f3ed8ffba53ef98d788d847185590dcd5fe38883c96042f4f4a68a698b45c784a0128d65afd4e93	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{54CDDDE1-0979-11F0-9446-FE3312B4242D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "449069584"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0a58d37869ddb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000596298383b88f045b768ac3737055a0400000000020000000000106600000001000020000000781e87d884cb19514a2d263ef2ddcb65b0087973f570edf7d9e1b5619974fd5e000000000e8000000002000020000000f2188104f40bde9223267082534d4dc174f6f08c7daf7e4df4785358e637cd7590000000263b64545687269c66045707f0318baf05fadbca05e8a5747b30bc124200b2c33f8c069c6b49817cc5efca028632c8c4e0b54c40ba760d15ebb63bcbe1868119f763bee76c0c865a5d5ac2ee96f17be6ca450c0ec889a943819f7739780a6e35641bcc1f32554cc9c44fac71a8095cd28adab970859293be1ccfc8b5ae767e33a74d7923eb9d5158908bb390e1236e614000000009ec98f1b86028d851284e8ded03d23cbc45d14dba93df52f1c9e06c5463b86136c3a2e25a0d4c974d964b331486e316a723ea94299363fa3bc6a74771b5b820	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2872	6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe
2276	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2872	6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe
2872	6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe
2276	svchost.exe
2276	svchost.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe
Token: SeDebugPrivilege	2276	svchost.exe
Token: SeBackupPrivilege	2424	vssvc.exe
Token: SeRestorePrivilege	2424	vssvc.exe
Token: SeAuditPrivilege	2424	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2580	WMIC.exe
Token: SeSecurityPrivilege	2580	WMIC.exe
Token: SeTakeOwnershipPrivilege	2580	WMIC.exe
Token: SeLoadDriverPrivilege	2580	WMIC.exe
Token: SeSystemProfilePrivilege	2580	WMIC.exe
Token: SeSystemtimePrivilege	2580	WMIC.exe
Token: SeProfSingleProcessPrivilege	2580	WMIC.exe
Token: SeIncBasePriorityPrivilege	2580	WMIC.exe
Token: SeCreatePagefilePrivilege	2580	WMIC.exe
Token: SeBackupPrivilege	2580	WMIC.exe
Token: SeRestorePrivilege	2580	WMIC.exe
Token: SeShutdownPrivilege	2580	WMIC.exe
Token: SeDebugPrivilege	2580	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2580	WMIC.exe
Token: SeRemoteShutdownPrivilege	2580	WMIC.exe
Token: SeUndockPrivilege	2580	WMIC.exe
Token: SeManageVolumePrivilege	2580	WMIC.exe
Token: 33	2580	WMIC.exe
Token: 34	2580	WMIC.exe
Token: 35	2580	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2580	WMIC.exe
Token: SeSecurityPrivilege	2580	WMIC.exe
Token: SeTakeOwnershipPrivilege	2580	WMIC.exe
Token: SeLoadDriverPrivilege	2580	WMIC.exe
Token: SeSystemProfilePrivilege	2580	WMIC.exe
Token: SeSystemtimePrivilege	2580	WMIC.exe
Token: SeProfSingleProcessPrivilege	2580	WMIC.exe
Token: SeIncBasePriorityPrivilege	2580	WMIC.exe
Token: SeCreatePagefilePrivilege	2580	WMIC.exe
Token: SeBackupPrivilege	2580	WMIC.exe
Token: SeRestorePrivilege	2580	WMIC.exe
Token: SeShutdownPrivilege	2580	WMIC.exe
Token: SeDebugPrivilege	2580	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2580	WMIC.exe
Token: SeRemoteShutdownPrivilege	2580	WMIC.exe
Token: SeUndockPrivilege	2580	WMIC.exe
Token: SeManageVolumePrivilege	2580	WMIC.exe
Token: 33	2580	WMIC.exe
Token: 34	2580	WMIC.exe
Token: 35	2580	WMIC.exe
Token: SeBackupPrivilege	1508	wbengine.exe
Token: SeRestorePrivilege	1508	wbengine.exe
Token: SeSecurityPrivilege	1508	wbengine.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2900	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2900	iexplore.exe
2900	iexplore.exe
1148	IEXPLORE.EXE
1148	IEXPLORE.EXE
1148	IEXPLORE.EXE
1148	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2276	2872	6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe	28
PID 2872 wrote to memory of 2276	2872	6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe	28
PID 2872 wrote to memory of 2276	2872	6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe	28
PID 2276 wrote to memory of 2076	2276	svchost.exe	29
PID 2276 wrote to memory of 2076	2276	svchost.exe	29
PID 2276 wrote to memory of 2076	2276	svchost.exe	29
PID 2076 wrote to memory of 2416	2076	cmd.exe	31
PID 2076 wrote to memory of 2416	2076	cmd.exe	31
PID 2076 wrote to memory of 2416	2076	cmd.exe	31
PID 2076 wrote to memory of 2580	2076	cmd.exe	36
PID 2076 wrote to memory of 2580	2076	cmd.exe	36
PID 2076 wrote to memory of 2580	2076	cmd.exe	36
PID 2276 wrote to memory of 2344	2276	svchost.exe	38
PID 2276 wrote to memory of 2344	2276	svchost.exe	38
PID 2276 wrote to memory of 2344	2276	svchost.exe	38
PID 2344 wrote to memory of 1948	2344	cmd.exe	40
PID 2344 wrote to memory of 1948	2344	cmd.exe	40
PID 2344 wrote to memory of 1948	2344	cmd.exe	40
PID 2344 wrote to memory of 832	2344	cmd.exe	41
PID 2344 wrote to memory of 832	2344	cmd.exe	41
PID 2344 wrote to memory of 832	2344	cmd.exe	41
PID 2276 wrote to memory of 768	2276	svchost.exe	42
PID 2276 wrote to memory of 768	2276	svchost.exe	42
PID 2276 wrote to memory of 768	2276	svchost.exe	42
PID 768 wrote to memory of 1080	768	cmd.exe	44
PID 768 wrote to memory of 1080	768	cmd.exe	44
PID 768 wrote to memory of 1080	768	cmd.exe	44
PID 2276 wrote to memory of 2900	2276	svchost.exe	49
PID 2276 wrote to memory of 2900	2276	svchost.exe	49
PID 2276 wrote to memory of 2900	2276	svchost.exe	49
PID 2900 wrote to memory of 1148	2900	iexplore.exe	50
PID 2900 wrote to memory of 1148	2900	iexplore.exe	50
PID 2900 wrote to memory of 1148	2900	iexplore.exe	50
PID 2900 wrote to memory of 1148	2900	iexplore.exe	50

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe
"C:\Users\Admin\AppData\Local\Temp\6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2076
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:2416
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2580
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1948
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:832
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:768
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:1080
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Roaming\Restore_Files.html
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2900 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1148

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2424

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1508

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1324

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Adobe\Updater6\Restore_Files.html

Filesize
3KB

MD5
cf0cc6e9f7b71141a348d2f8a9cc800f

SHA1
bd198c4263359f42901ee30c3c24fc0ee8b2bd9e

SHA256
5a78197d3cd89269832678d0a59244b21fb0d6a8a87c2a080f68975e9c2febb9

SHA512
4dd5ff23ba3401ffc050e34dd83f37aeef6e4e24ff29809309ddd40ffce4b4b9cab2764f53dbf843c4cf870e37590ece34c98d7bce9f50b193f632a3b1db38de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6b2c4b73ed3d00b1e262486449f9193

SHA1
5c7c93e6d645b00598d9585c428dd80fe10002d1

SHA256
e4798523271a812a07a480595b490a1141fb71d0f43a9d4211b6be5f18e19b7e

SHA512
4ee8f0de9e7f646bd3b19113ee2dba1104327cc9cff5d158fdd48c61e5b4f1f3256859dced204e4f47e227f59f49bf7742ed1598352378dec744d1a369ba848c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f438da28f5c19a1b905c8a82c4542d26

SHA1
c6a7a74e9a5fe1effb0b0578dc4e8c21391bb1bb

SHA256
654e82454cd37f7863d543ed820eeb70ce10ab2a2a27c8ffe6a998c949fbb937

SHA512
cc7106f92e723ce254024c22f82e993ad1fd3efcf275d431e44f11d7b699cea3dd74ac90fe3f05b88e1cb751b50ac4531a8cb24f3bf567d6cbb20f796577d669

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f4dedd79aa2502cb69e4a07eaa43e66

SHA1
ee32d6b16271c4ee93710d46bf8368ef02351908

SHA256
e623ad6e48546848e19722eff051b4e6e2fa964df36c30c054b9bfca747a2451

SHA512
9afd98690702896d21600dd5388982214eb7fd4bf54d61d160de877f7109ec3270286610b96f667781aebc9de6a4fda00e5fd45bc21aa16c75324e4c3b63c23b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52a0924153a23d668e6ee66bd91724d3

SHA1
a53e436974890f387476b1ec30aec8c127f4067f

SHA256
df1d1bae5980b8101e6fe36a7779951c5d1463f4efc6dc15cf5a17c62713ec85

SHA512
1c4d0cd9f225dde0c9a53174a5a2b0eb4668e66e7a37c298eef1fc4dfffce709db6be20ddcf98b5dd5804a7ec1fffc81c3bddca40ca829987362fd785e504269

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a1f8e43370f03d0347fcec60c73d9ab

SHA1
b78933dbd7241c04f50b4357837b9275ce2b155d

SHA256
95c14a1334f829c44205697b79af3d1d50ff865a4271d6736aaa65aae942944d

SHA512
0c3396d34cd9c04f3a962fa2eb8a7457af2b641bb6b3973eb4ca3778348461a9208c6f7824f645ab9e3c2a76a6f7473302b12573221a6a79211830d371e0fc98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d90bdd861be39434a814eda90645f59

SHA1
9bb8fe68d41428c77a483e98d2d23d2e214ae2a2

SHA256
2968afa2bf80fa8fa74d945e95174028c263eecb1d3acce2cc3a7b30ffd4719b

SHA512
f6f7a8ec92a0474ea1313718d99908c1747ec7647d32784fd6977324584f264c90b96714872d067d1a19b3ae6d6a6db0802d609b38f5690e0445842168f9b925

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
524cd53ee2fb0bb1e88ebe64ae02fa68

SHA1
951a24bbc5ea1e8612215fb0719a881d7bf7c605

SHA256
bed4ad0ef68cd14ac717f17b6b5f681d9681ec94632c52524923231efc68e1ec

SHA512
63c67131c75e0c2e21ee360756d1b023853f1d2fbb3ff81030d055533eb87785adef0364951cf871cf7a1f9acf85267742ac6aa93db6d9794dc3eb8655726e46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ef74d212348d70bbcda5f92e0c3490e

SHA1
6b800687f67a0689610a7a8ad816032bc75ec59c

SHA256
c6e11c123014fb199aa1a2912e71f6e875d2a7485f8b7ea0e152a95d3bc49fcc

SHA512
54c4eb84ed5591e5ada640e3f142d3aaa173585edfde685657d859a1f652903886487572b1336fe265f12d09a144508edd6fcabe65ba15f802fc41ccbeac4b18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7f71f6cf1f257deb1ea75f4ffca6e65

SHA1
24384119fef5cffdc0aa0ebd33eaa04bc2118183

SHA256
b7b32387b7c544b2dcb6e03400794a8c7d8bf15d139dfa4d79e8de25096b42a3

SHA512
1898831ca6c594ca30789684b8d6167e9063af1ae1e7c789f2b772811b609b7d3f9c49239e4b1b8d0ed960e054da2a8ca087b204ef71b6d1d5e1604e161d482a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aba4eb59bcbbccf359a765664057d45f

SHA1
98ed197cf9d7939e74d4863c0311de02e98b058a

SHA256
3bb49b915e7ab5f302d6bb078f8c2c6d10f0facfd2221e5b61a8dd9509b2c355

SHA512
7ac357ddf20b0a334ae6140a4b5d915e856b3b12f26045ff90b15e7107b8ba766a6c6220be6bdaa7597651f9a6686d125eff94fdaec1ce81ab61d712c40cb1c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ed7d32225a837e6b8f3309ea2d681ef

SHA1
27da6d1e65f329879329cb799eb6e0d4821746b4

SHA256
80588104e5b9cdb24270c10ef6ae74b0e25d88f4b9e1db6348710a79d9fabfe7

SHA512
453e66c56f3f2af41edeb85d8554a6040d0fd1eec0a60cca1e3a1b07cb89bcaeaa8e031125003e48b74d60fa991af53f8a10b2f1a8f0af2641a3e419a719c1dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9417709a605acad9acea577d1044b0aa

SHA1
1f406e5a5ea0957e888fda9e73363d2c59956dbf

SHA256
0293d4e529158489bac886de20555f5381749c2580b504f0553bdbab681e881e

SHA512
8e0954f62ea22f1f2cda852c2f4d6669154e7eda83007af0b285b8ba096a023e4e02e5677e9e673689eb2ace2f95e453a3b4a1b64ba5fa3413581cc4d409f639

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f308892e0b4edba4081640426acdb813

SHA1
4981602de980b4f6d198c899e0be152fb9685a36

SHA256
87b33abebb542b41cf487122d4be56cfb26081fb83efdea6ab08da487430bddb

SHA512
2f6abcf28ee8241531c67276794c54ed77365a5d4be93edd267fce5fa42f862f9c2fbc4d04de765f05317e95e69845e8f6e3ba521c238d26e9a854fbe5012083

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3553e077800c8211bf1661cf28a7aef

SHA1
78200c28f12f23158e17b801868808255868d613

SHA256
5233502f36cde91cef3a73d713bf7756c3cb42a1526ff754e8685b16ce00d541

SHA512
b785fe02de2ae3153a6ef9a97504284d3c42662edf5aaca8a523322cbeedbd5aafeeb9ffd65a33a2fe9d45853cae7a8be1e7d3482c2ec684b8d4bb044ba35bbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3afd800cc9e3da0ee0dee8a7d826878f

SHA1
1fa81f001fcf7e5bf891907d43723f7c1e9dc17e

SHA256
afda43ae6481d107df6bd4a4388f6a263ad35d4b0e93398f32d9da6d5f692fec

SHA512
36c03f512ca210e7ea78762cd17da05854e966660b86f0d6f203c0f256f843928b7ee513e3bcf5ca3ad3a471a467162cd45e61afe2b0aa5e124e2d558404650c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcd2cb9465cfb03caff0ff6fd2ac83ba

SHA1
6892f2f33e85414e9ee418d4c9b8fbc3769073b8

SHA256
2b54bdea7894bd142fb5e5554c806506bf9a08356e31b46958ae45cfb03e7e8a

SHA512
9c6337a21df32d017969c1a14e5d6a1a364a8cf79fefcb24f6503268671e42b5d8ee085eb717c62256cc12512bafd6cd633c4b7aea284f82a1b246cd3cd309bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8995f062073ca6e9ba0c7e37162170f4

SHA1
5537e5784e4379792b81c613a81df087ca978bba

SHA256
64db0338633947fe6b611654d9e93ae3204ec93c82990d4f412098f884b95e32

SHA512
89c77203f6ba16db1ef9825dd94dcc03eac30563bc08c0a3a58dfbebc2351d7e85e1fd0337acc652ea81c143c051e303581e5bf55603cf7c3f7feea9e2252be3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56c553576087959f791768e16694d054

SHA1
8f7105526ba6af622b3fcae99e99afb73a675c2e

SHA256
a9b5097f779db4384fb588ddbc69fe0b9fcd85b6d36ff6507b3d648111c4d7e0

SHA512
e98df2d0c1d06b7d5a7701b466dccb0f6bb348046b8e25730119cf2e80fd9e314cc140523763fd94eef8da6e7a6a28bf117eb5523731a99f51879687338638dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80b7c0f312e391f64980185a4af8b1ef

SHA1
ab282561d7f2745a3bb9f2dac2cc2259cc7667f7

SHA256
0a04439248c51622645fe3ed642e7bdfbf980b3b48746512bd6574704332c8ee

SHA512
f0529a1810a07b789cc5f88998372a2609f51fb7b998c283551df2188eda9bad2e21e29745e684168ce160fca3052381478e1db8300a9a29939b6e74371a39e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4186c3112d27a2e0c0f5f64579cde90

SHA1
ac53a2b5ef72ff71aa1d080b130798866fb15518

SHA256
7e8de4be20a3c2d01aa921c6087aca22bf1ab5fe49a792fe54b0e3c088602018

SHA512
5da80f15492149c30b736719b3c71bde286c38e47346d1f9764a8631d56ec11fbf7578e9c8c40e2d2395e9a3324094da72bb39aef2dc045a0e7bb527ec5766ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5B7A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5C8C.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
71KB

MD5
8f033c07f57f8ce2e62e3a327f423d55

SHA1
57ac411652d7b1d9accaa8a1af5f4b6a45ef7448

SHA256
6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b

SHA512
f3712e7d5d55b27a4c20de07cce136e6d58ce62fa146d29b34dece6248e4456139703c50df10cb318346311cfeee0a8449d49163e821744efcde3ecfe8b880df

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk

Filesize
1B

MD5
d1457b72c3fb323a2671125aef3eab5d

SHA1
5bab61eb53176449e25c2c82f172b82cb13ffb9d

SHA256
8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1

SHA512
ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0

Download Submit
memory/2276-12-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/2276-10-0x00000000008A0000-0x00000000008B8000-memory.dmp

Filesize
96KB

Download
memory/2276-13-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/2276-959-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/2872-0-0x000007FEF5AF3000-0x000007FEF5AF4000-memory.dmp

Filesize
4KB

Download
memory/2872-1-0x0000000000EA0000-0x0000000000EB8000-memory.dmp

Filesize
96KB

Download
memory/2872-2-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/2872-3-0x000007FEF5AF3000-0x000007FEF5AF4000-memory.dmp

Filesize
4KB

Download
memory/2872-4-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/2872-11-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download