buran | 39016358b939b83cf9997c447458ae2d13186c3f66e66784c9e8ff4031b60c7e

Analysis

max time kernel
104s
max time network
105s
platform
windows7_x64
resource
win7v20201028
submitted
04-11-2020 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mesager43.exe
Size

511KB
MD5

3163bba8a4861d47aafa1667d3082fee
SHA1

32824014c8740b8fef306e742c891bec0ef068d3
SHA256

39016358b939b83cf9997c447458ae2d13186c3f66e66784c9e8ff4031b60c7e
SHA512

e25f77dd78df4a80ec02f01c8c6ed85fa0f9028ea87b899ffa0a5a87d211cb8c861d4e7912bb8d3cc3ee0a7240eb130f0abd6ffa0d3698b3d416c70de52eb450

Score

10^/10

buran persistence ransomware upx

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: kassmaster@danwin1210.me and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: kassmaster@danwin1210.me Reserved email: kassmaster@tutanota.com Your personal ID: 41D-439-C1B Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

kassmaster@danwin1210.me

kassmaster@tutanota.com

Signatures

Buran
Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
ransomware buran
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Executes dropped EXE 2 IoCs

Processes:

TrustedInstaller.exeTrustedInstaller.exe

pid process

340 TrustedInstaller.exe
1692 TrustedInstaller.exe

pid	process
340	TrustedInstaller.exe
1692	TrustedInstaller.exe

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

TrustedInstaller.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\ResizeAdd.tiff	TrustedInstaller.exe
File opened for modification	C:\Users\Admin\Pictures\ResolveGroup.tiff	TrustedInstaller.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe	upx
\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe	upx
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe	upx
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe	upx
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe	upx

Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

580 notepad.exe
Loads dropped DLL 2 IoCs

Processes:

mesager43.exe

pid process

1776 mesager43.exe
1776 mesager43.exe

pid	process
580	notepad.exe

pid	process
1776	mesager43.exe
1776	mesager43.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

mesager43.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\TrustedInstaller.exe\" -start"	mesager43.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run	mesager43.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

TrustedInstaller.exe

description	ioc	process
File opened (read-only)	\??\O:	TrustedInstaller.exe
File opened (read-only)	\??\Y:	TrustedInstaller.exe
File opened (read-only)	\??\R:	TrustedInstaller.exe
File opened (read-only)	\??\K:	TrustedInstaller.exe
File opened (read-only)	\??\I:	TrustedInstaller.exe
File opened (read-only)	\??\E:	TrustedInstaller.exe
File opened (read-only)	\??\B:	TrustedInstaller.exe
File opened (read-only)	\??\A:	TrustedInstaller.exe
File opened (read-only)	\??\T:	TrustedInstaller.exe
File opened (read-only)	\??\S:	TrustedInstaller.exe
File opened (read-only)	\??\V:	TrustedInstaller.exe
File opened (read-only)	\??\U:	TrustedInstaller.exe
File opened (read-only)	\??\P:	TrustedInstaller.exe
File opened (read-only)	\??\N:	TrustedInstaller.exe
File opened (read-only)	\??\M:	TrustedInstaller.exe
File opened (read-only)	\??\G:	TrustedInstaller.exe
File opened (read-only)	\??\Z:	TrustedInstaller.exe
File opened (read-only)	\??\X:	TrustedInstaller.exe
File opened (read-only)	\??\L:	TrustedInstaller.exe
File opened (read-only)	\??\J:	TrustedInstaller.exe
File opened (read-only)	\??\H:	TrustedInstaller.exe
File opened (read-only)	\??\F:	TrustedInstaller.exe
File opened (read-only)	\??\W:	TrustedInstaller.exe
File opened (read-only)	\??\Q:	TrustedInstaller.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 geoiptool.com

flow	ioc
5	geoiptool.com

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe

Drops file in Program Files directory 15074 IoCs

Processes:

TrustedInstaller.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0222019.WMF	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18245_.WMF.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_ja.jar.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02085_.GIF	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewTemplate.html.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BANNER.DPV.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIGN.XML	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14868_.GIF.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\PRODIGY.NET.XML	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01035U.BMP.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLOOK.HXS.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090779.WMF.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00100_.WMF	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0240695.WMF	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\RESUME.XML.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\New_Salem	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0179963.JPG	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\Management.cer	TrustedInstaller.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0175428.JPG.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03795_.WMF.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL00345_.WMF	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR17F.GIF.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Cocos.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SIGNS.ICO	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\2 Right.accdt	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0304933.WMF.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\modules\common.luac.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\Form_StatusImageMask.bmp	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\POSTCD98.POC	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18191_.WMF.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\ODBC.SAM.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Installed_resources14.xss	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02439_.WMF	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PROGRAM.DPV.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01777_.WMF	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107526.WMF.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02233_.WMF.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBAD.XML.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.ibm.icu_52.1.0.v201404241930.jar	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0183198.WMF.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\HEADER.GIF.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\XDPFile_8.ico	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00916_.WMF.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Formal.dotx	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CRANINST.WMF	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0235241.WMF	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0251871.WMF	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_right.gif.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.PL.XML.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\MANIFEST.MF	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115841.GIF	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02466U.BMP.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf.41D-439-C1B	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0332364.WMF	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CNFNOT.ICO	TrustedInstaller.exe

Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

1948 vssadmin.exe
1428 vssadmin.exe

pid	process
1948	vssadmin.exe
1428	vssadmin.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

mesager43.exeTrustedInstaller.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	mesager43.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	TrustedInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	TrustedInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	TrustedInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	TrustedInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	mesager43.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	mesager43.exe

Suspicious use of AdjustPrivilegeToken 87 IoCs

Processes:

mesager43.exeWMIC.exeWMIC.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1776	mesager43.exe
Token: SeDebugPrivilege	1776	mesager43.exe
Token: SeIncreaseQuotaPrivilege	1128	WMIC.exe
Token: SeSecurityPrivilege	1128	WMIC.exe
Token: SeTakeOwnershipPrivilege	1128	WMIC.exe
Token: SeLoadDriverPrivilege	1128	WMIC.exe
Token: SeSystemProfilePrivilege	1128	WMIC.exe
Token: SeSystemtimePrivilege	1128	WMIC.exe
Token: SeProfSingleProcessPrivilege	1128	WMIC.exe
Token: SeIncBasePriorityPrivilege	1128	WMIC.exe
Token: SeCreatePagefilePrivilege	1128	WMIC.exe
Token: SeBackupPrivilege	1128	WMIC.exe
Token: SeRestorePrivilege	1128	WMIC.exe
Token: SeShutdownPrivilege	1128	WMIC.exe
Token: SeDebugPrivilege	1128	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1128	WMIC.exe
Token: SeRemoteShutdownPrivilege	1128	WMIC.exe
Token: SeUndockPrivilege	1128	WMIC.exe
Token: SeManageVolumePrivilege	1128	WMIC.exe
Token: 33	1128	WMIC.exe
Token: 34	1128	WMIC.exe
Token: 35	1128	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1952	WMIC.exe
Token: SeSecurityPrivilege	1952	WMIC.exe
Token: SeTakeOwnershipPrivilege	1952	WMIC.exe
Token: SeLoadDriverPrivilege	1952	WMIC.exe
Token: SeSystemProfilePrivilege	1952	WMIC.exe
Token: SeSystemtimePrivilege	1952	WMIC.exe
Token: SeProfSingleProcessPrivilege	1952	WMIC.exe
Token: SeIncBasePriorityPrivilege	1952	WMIC.exe
Token: SeCreatePagefilePrivilege	1952	WMIC.exe
Token: SeBackupPrivilege	1952	WMIC.exe
Token: SeRestorePrivilege	1952	WMIC.exe
Token: SeShutdownPrivilege	1952	WMIC.exe
Token: SeDebugPrivilege	1952	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1952	WMIC.exe
Token: SeRemoteShutdownPrivilege	1952	WMIC.exe
Token: SeUndockPrivilege	1952	WMIC.exe
Token: SeManageVolumePrivilege	1952	WMIC.exe
Token: 33	1952	WMIC.exe
Token: 34	1952	WMIC.exe
Token: 35	1952	WMIC.exe
Token: SeBackupPrivilege	1496	vssvc.exe
Token: SeRestorePrivilege	1496	vssvc.exe
Token: SeAuditPrivilege	1496	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1128	WMIC.exe
Token: SeSecurityPrivilege	1128	WMIC.exe
Token: SeTakeOwnershipPrivilege	1128	WMIC.exe
Token: SeLoadDriverPrivilege	1128	WMIC.exe
Token: SeSystemProfilePrivilege	1128	WMIC.exe
Token: SeSystemtimePrivilege	1128	WMIC.exe
Token: SeProfSingleProcessPrivilege	1128	WMIC.exe
Token: SeIncBasePriorityPrivilege	1128	WMIC.exe
Token: SeCreatePagefilePrivilege	1128	WMIC.exe
Token: SeBackupPrivilege	1128	WMIC.exe
Token: SeRestorePrivilege	1128	WMIC.exe
Token: SeShutdownPrivilege	1128	WMIC.exe
Token: SeDebugPrivilege	1128	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1128	WMIC.exe
Token: SeRemoteShutdownPrivilege	1128	WMIC.exe
Token: SeUndockPrivilege	1128	WMIC.exe
Token: SeManageVolumePrivilege	1128	WMIC.exe
Token: 33	1128	WMIC.exe
Token: 34	1128	WMIC.exe

Suspicious use of WriteProcessMemory 62 IoCs

Processes:

mesager43.exeTrustedInstaller.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1776 wrote to memory of 340	1776	mesager43.exe	TrustedInstaller.exe
PID 1776 wrote to memory of 340	1776	mesager43.exe	TrustedInstaller.exe
PID 1776 wrote to memory of 340	1776	mesager43.exe	TrustedInstaller.exe
PID 1776 wrote to memory of 340	1776	mesager43.exe	TrustedInstaller.exe
PID 1776 wrote to memory of 580	1776	mesager43.exe	notepad.exe
PID 1776 wrote to memory of 580	1776	mesager43.exe	notepad.exe
PID 1776 wrote to memory of 580	1776	mesager43.exe	notepad.exe
PID 1776 wrote to memory of 580	1776	mesager43.exe	notepad.exe
PID 1776 wrote to memory of 580	1776	mesager43.exe	notepad.exe
PID 1776 wrote to memory of 580	1776	mesager43.exe	notepad.exe
PID 1776 wrote to memory of 580	1776	mesager43.exe	notepad.exe
PID 340 wrote to memory of 1916	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 1916	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 1916	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 1916	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 880	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 880	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 880	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 880	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 1200	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 1200	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 1200	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 1200	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 1436	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 1436	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 1436	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 1436	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 840	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 840	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 840	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 840	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 1576	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 1576	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 1576	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 1576	340	TrustedInstaller.exe	cmd.exe
PID 340 wrote to memory of 1692	340	TrustedInstaller.exe	TrustedInstaller.exe
PID 340 wrote to memory of 1692	340	TrustedInstaller.exe	TrustedInstaller.exe
PID 340 wrote to memory of 1692	340	TrustedInstaller.exe	TrustedInstaller.exe
PID 340 wrote to memory of 1692	340	TrustedInstaller.exe	TrustedInstaller.exe
PID 1916 wrote to memory of 1952	1916	cmd.exe	WMIC.exe
PID 1916 wrote to memory of 1952	1916	cmd.exe	WMIC.exe
PID 1916 wrote to memory of 1952	1916	cmd.exe	WMIC.exe
PID 1916 wrote to memory of 1952	1916	cmd.exe	WMIC.exe
PID 840 wrote to memory of 1948	840	cmd.exe	vssadmin.exe
PID 840 wrote to memory of 1948	840	cmd.exe	vssadmin.exe
PID 840 wrote to memory of 1948	840	cmd.exe	vssadmin.exe
PID 840 wrote to memory of 1948	840	cmd.exe	vssadmin.exe
PID 1576 wrote to memory of 1128	1576	cmd.exe	WMIC.exe
PID 1576 wrote to memory of 1128	1576	cmd.exe	WMIC.exe
PID 1576 wrote to memory of 1128	1576	cmd.exe	WMIC.exe
PID 1576 wrote to memory of 1128	1576	cmd.exe	WMIC.exe
PID 1576 wrote to memory of 1428	1576	cmd.exe	vssadmin.exe
PID 1576 wrote to memory of 1428	1576	cmd.exe	vssadmin.exe
PID 1576 wrote to memory of 1428	1576	cmd.exe	vssadmin.exe
PID 1576 wrote to memory of 1428	1576	cmd.exe	vssadmin.exe
PID 340 wrote to memory of 1744	340	TrustedInstaller.exe	notepad.exe
PID 340 wrote to memory of 1744	340	TrustedInstaller.exe	notepad.exe
PID 340 wrote to memory of 1744	340	TrustedInstaller.exe	notepad.exe
PID 340 wrote to memory of 1744	340	TrustedInstaller.exe	notepad.exe
PID 340 wrote to memory of 1744	340	TrustedInstaller.exe	notepad.exe
PID 340 wrote to memory of 1744	340	TrustedInstaller.exe	notepad.exe
PID 340 wrote to memory of 1744	340	TrustedInstaller.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\mesager43.exe
"C:\Users\Admin\AppData\Local\Temp\mesager43.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe" -start
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:340

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
3⤵
- Suspicious use of WriteProcessMemory
PID:1916

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
3⤵
PID:880

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
PID:1200

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
3⤵
PID:1436

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
3⤵
- Suspicious use of WriteProcessMemory
PID:840

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:1948

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
3⤵
- Suspicious use of WriteProcessMemory
PID:1576

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1128

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:1428

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe" -agent 0
3⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops file in Program Files directory
PID:1692

C:\Windows\SysWOW64\notepad.exe
notepad.exe
3⤵
PID:1744

C:\Windows\SysWOW64\notepad.exe
notepad.exe
2⤵
- Deletes itself
PID:580

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1496

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
MD5
9d538c0560b32800760c81848d63c768

SHA1
0347de3203f816ec681476bad1ba61a9d617933d

SHA256
ff250295947988215771c7277792f7678cbb6c8d0db006a034622ae50090cc07

SHA512
14e728259be57440bf8b497884cb376c2f1b7bde2b9c8ffc3c9f3804dbe59f12899a57e434b2f8b3ca03a215eda40c434eec21064b93bdbbc75c4951ec7b3c45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
MD5
61faf9608aef25c78ecec385617c1fe5

SHA1
475cb92095f1ee2c19a6eaa4615697b1b9f0c21e

SHA256
efa2e7c480e2cdeb6834fd1afca56ceb66f814e2b8da59ba6df4569d2b397ef4

SHA512
1b9226545cc39585a4a18b52227cdd7e6b8ff889dd40e9e186cce8d52c10abe1686fd8c799f52656f8b33ba47fa809d0f8369b1ef28207ebcc0d23e26a1d13dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
f3b3ba3b8527743bfe3ae7feb9de6a4d

SHA1
65a5fc2851514d5867a6726768f03d956142185e

SHA256
49a00de339c432d57e5ec170f091b5995fa8bc4eb4121344642d25d22408b0aa

SHA512
961f899691646528b86bdea736ed59e7ea78137c2346b709aa0e98ed6ffad1466678efbccfc210be448634f979f5e97bde90cada0cf43f98f27c2afbd19562f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
MD5
1b7841dbe3f4fb411100d651a04ddadf

SHA1
25fd972751edb6a35d0730afc4fd51d4d6296a90

SHA256
28c3aab2b2cdf271cb4b30c3c6248c05222ec04680e25be208e99bb99cec32a5

SHA512
cfc0a055656fdc27619f767018636d8ad6e41eac2325d480b6418efe3925400a6895da162a47b206b7d20f1cf210a07216c7ee035e314e7385f34599c63b04f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
MD5
e6c855c882c0fa41a5a55b90bb89db60

SHA1
57aa7a47df9185dc62c0de0d8200dfb6aae33707

SHA256
02cb9e63505ab1f4ffbe24a27e34d8e8a5a232205a7fc246633616cb5f7fee89

SHA512
445dbe2a51a412326e82a28d21e3b7b53fdab361dad37cdbc712962d13babc385a9efe583e95f1f29cc1d86388f5e079c99e225231680f3ea0e39b3a2c56a455

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
d7ae840914b8a58ec33d61352e7fcaee

SHA1
6fd4d91e06cce5e8a36415e459eb60bb4dd32fb3

SHA256
5a9ae3a8dff40d536571e884a4057ceb21bff905e0638ceeb195d7335b2e132c

SHA512
a780cbcdb744275e7ad6964091503b632f3222861e9aae555c22badb2fb7a30030902626e592912164fc1c5e582c1fe752c80dfa839e425ecc17376742f2a8fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
53f3e8b0727de1684d8a3bc24ecae3b6

SHA1
c5b080655bb54d02951a42b070f6c24661300ae5

SHA256
f43b5b9e84c8884d6c5150bb7464f7dbbf3e72b6baba61f7de701c1e165fe1bb

SHA512
4ab67ec888e1ca7c3c8b2340690de2920647f810defc5c0966184d2383866fc276f938b53794121ee7681abed210b4721c92114660b06c4d4b0c5ceaea4131f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3O0J2C38\H1Z65TU6.htm
MD5
8615e70875c2cc0b9db16027b9adf11d

SHA1
4ed62cf405311c0ff562a3c59334a15ddc4f1bf9

SHA256
da96949ba6b0567343f144486505c8c8fa1d892fd88c9cbc3ef3d751a570724d

SHA512
cd9dfc88dc2af9438b7d6b618d1b62029b3bdf739fc4daa5b37397afd12c4528561b3bf2fc3f3f2adf3fd1f582d5524332441fd30248fcd078e41aa91e17cb73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7ISB2KAC\WTQQCWUW.htm
MD5
b1cd7c031debba3a5c77b39b6791c1a7

SHA1
e5d91e14e9c685b06f00e550d9e189deb2075f76

SHA256
57ba053f075e0b80f747f3102ed985687c16a8754d109e7c4d33633269a36aaa

SHA512
d2bbefdc1effb52a38964c4cec5990a5a226248eca36f99e446c0c5704436f666bf1cb514e73b8991411d497d3325ecc646cbd5065c364e92ab6b9c5f1ad4a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\~temp001.bat
MD5
ef572e2c7b1bbd57654b36e8dcfdc37a

SHA1
b84c4db6d0dfd415c289d0c8ae099aea4001e3b7

SHA256
e6e609db3f387f42bfd16dd9e5695ddc2b73d86ae12baf4f0dfc4edda4a96a64

SHA512
b8c014b242e8e8f42da37b75fe96c52cd25ebd366d0b5103bcba5ac041806d13142a62351edecdee583d494d2a120f9b330f6229b1b5fe820e1c7d98981089e9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
MD5
3163bba8a4861d47aafa1667d3082fee

SHA1
32824014c8740b8fef306e742c891bec0ef068d3

SHA256
39016358b939b83cf9997c447458ae2d13186c3f66e66784c9e8ff4031b60c7e

SHA512
e25f77dd78df4a80ec02f01c8c6ed85fa0f9028ea87b899ffa0a5a87d211cb8c861d4e7912bb8d3cc3ee0a7240eb130f0abd6ffa0d3698b3d416c70de52eb450

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
MD5
3163bba8a4861d47aafa1667d3082fee

SHA1
32824014c8740b8fef306e742c891bec0ef068d3

SHA256
39016358b939b83cf9997c447458ae2d13186c3f66e66784c9e8ff4031b60c7e

SHA512
e25f77dd78df4a80ec02f01c8c6ed85fa0f9028ea87b899ffa0a5a87d211cb8c861d4e7912bb8d3cc3ee0a7240eb130f0abd6ffa0d3698b3d416c70de52eb450

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
MD5
3163bba8a4861d47aafa1667d3082fee

SHA1
32824014c8740b8fef306e742c891bec0ef068d3

SHA256
39016358b939b83cf9997c447458ae2d13186c3f66e66784c9e8ff4031b60c7e

SHA512
e25f77dd78df4a80ec02f01c8c6ed85fa0f9028ea87b899ffa0a5a87d211cb8c861d4e7912bb8d3cc3ee0a7240eb130f0abd6ffa0d3698b3d416c70de52eb450

Download Submit
C:\Users\Admin\Desktop\CheckpointMeasure.docx.41D-439-C1B
MD5
bf1d635cc06b4d94bbff04b948fd072d

SHA1
3e0b8dea7eb64efeda8ddf3a39e26b44eec29a6b

SHA256
9427569a792a35ab10dd15eec545fe04ad3460e92f5f042fbfa9a93bc6244923

SHA512
b6740fefac0cda519fcd1b34a552d7732d34bf9cbd556b413177273304f77a159b4c39c2a865de80e0129aff85bd8bdb61a59b3c7b0dd45286ae879e568f6abe

Download Submit
C:\Users\Admin\Desktop\CloseRead.zip.41D-439-C1B
MD5
77393afd64cf2c1ce860c5c00ad36424

SHA1
360041aa9d06bf008a41dc7cc31d9542047a47fe

SHA256
1bbfa229dd859134484e7e499c2f0ee99de5d0e6d63f270a06c6fe6a277a12e5

SHA512
e783aef37a9491165019daa9ac2569a48db69facf502708cc0128bcafbe24bce7b2106731d98dcda1a7ac3553beb768a8343f6be03c3248ea82025438bfdb29d

Download Submit
C:\Users\Admin\Desktop\ConvertFromSkip.DVR.41D-439-C1B
MD5
c8db7949281b7f1e8edfe67bbad1a40a

SHA1
0141fc34dca789f7b13a3918a39d27a8af24e986

SHA256
0acd39ee5a073f7f82e27de55db25e9c49c92362b79a303300ddff553d8e6aef

SHA512
ab85acdc53ff5b466b0ab41651e394369534f04fb4a8296b73d3f18872145e01d4e35d95f46b55906a10d3bde56ef4a3674dd171689012218faf06099e02ca53

Download Submit
C:\Users\Admin\Desktop\CopyMount.contact.41D-439-C1B
MD5
b84f1f04eea1b0b5faaf622c71f30a8d

SHA1
0dd2c117c664f718ed4ddf311d0f0437b8d4b970

SHA256
746b39a83f61254952cad1bedd919e79a536ee2407a1e5f500ecfb8eb4d0dbd3

SHA512
828dc4aec0bfc076b1798455d2155bbddd8419a2fa5a034649c2bf1af07ccad26ca27879cce6fcace5c5d5850dca8474b03d184ea1d33f81cc8c73f5f6778089

Download Submit
C:\Users\Admin\Desktop\DismountMerge.bmp.41D-439-C1B
MD5
43c62b8c9de0037b64e2a1b7f4b8a877

SHA1
7ca97c6334842d12675533f66d84179ed9f17338

SHA256
77cff9bb823fae59035388278d913d747d2979ac631f402ec204198b4fd6d577

SHA512
be133a20dfe184e4a7825f1c609972354f414bce392de7325f13c31405cebdc6ffbf69fd0c3252d4d0f5da57260cb3b59f03a0a30f827d147f50c17940f059e3

Download Submit
C:\Users\Admin\Desktop\GroupConfirm.cab.41D-439-C1B
MD5
0cda78e0e8014f35c0be4318b8a2d6b1

SHA1
f67c9916f099c41e9c3ce2bcea2afa1442185dac

SHA256
19fed5e75861cbf08190d105975a21baf2686327f193fbedb09fdc9b16fea826

SHA512
e8922bfbe3846cf96d496f459795e58ce1f49145713b0fe5b5c5013a7602041e1cd6e33253065625fbd854f6abc2017f538543bfed8d466dc452ae9ef0ab85ba

Download Submit
C:\Users\Admin\Desktop\InstallSplit.mp2v.41D-439-C1B
MD5
0fb55843c6b079d6e6531b75eb755ee9

SHA1
c4bb08958b5622bbbad7c5c2d62398a1b280e318

SHA256
2c7fd20f629804d05a85e5d2572d93904e538d07abbd59ed8e805fcdc1c5f40e

SHA512
209bccf60f87e320d5eb17c1ab1b4f42bd3f0e287d5b0ee3527767d444dd2809518332584d4ef70665e07074f22be8df9ff4b1cd4a4f25867a1b2b48c99efe29

Download Submit
C:\Users\Admin\Desktop\MeasureJoin.xps.41D-439-C1B
MD5
c411fd4bae80cf75d5aabc00bc12b171

SHA1
eb262a09530ff85ed7358b543832fcdec6986023

SHA256
efdbed1cd81b49511833de667bfd209b928a761445415258301ae3c33754e8ef

SHA512
1922318f75f6b6e0908c1ac7ede86d921e8e4df833818fad269254d5e7e8a50874ad485b6d032c76dc623734ad7c13dcd43c2434690df8910b608329ff8b768e

Download Submit
C:\Users\Admin\Desktop\NewConvertTo.wmf.41D-439-C1B
MD5
0bb5aba2ffd7d075053cd703054a602e

SHA1
2ecb1b75f39750d7a71c6495f1e28eba39ac3e14

SHA256
28954440565ebb0c44bd55b773c97d58e513d5533b6b7a91180cd6485f1d385d

SHA512
1f76e5608db2d658a5f0ca062537cbfb67454d728b8f4e494901065dcf22c9a69c4a8a61ad6b2c25f8e84ffeb1ce71063d8db679927692a911bb8b030903175b

Download Submit
C:\Users\Admin\Desktop\RenameReceive.css.41D-439-C1B
MD5
2f295b1eee4d6d16328059017d0af4b4

SHA1
97fe60ff2ac91a0a297896ae45fdfed43b9addae

SHA256
e73109f9343b5025dceecc161838ddc2a7b4cd440f1ec329a4a9c1ae281db957

SHA512
d5f87bd2aa8b4a02f644e19e334f4a01dde1f6d9ddcdd68e193f3e05c00dd3329969f841e75842dcd2bf3965ab115b5b9f7f485febda8021744538e400954f14

Download Submit
C:\Users\Admin\Desktop\RepairTest.pptm.41D-439-C1B
MD5
151a7025ac46635cd3233f19df8f9b1b

SHA1
1add86d0c1309ae5dae19233c4fc9f892add5b89

SHA256
f588ab96b705661b87c365711fb42a0b515f71745ee7b99f3d110ce0c4202141

SHA512
55fdb829b6df99a37f163eaca722196cf524860ba87e54edb5748cf720f5e87d470573c0ff95ef9b14992ddd60d0b612bb0349bbf5c022d800c275cc95ae5dc0

Download Submit
C:\Users\Admin\Desktop\ResumeBackup.docm.41D-439-C1B
MD5
ef4ddfefdd3269abb335aeadfb08ddcf

SHA1
64b37500b508455f11d12430ef40c5b4bee0a868

SHA256
a78f5a6741f3b7ab297cf5940e92fb23fefeec96931ba94c8d003942e75dd9c2

SHA512
d71ac6e319a60b48c3f73af39baa48b3d1065a6f30c7cbb754508b229d0e20829195f6055dcde1ad59a483f7568c0e232bf913d8b1ee15eda44d9520374207a8

Download Submit
C:\Users\Admin\Desktop\ResumeConnect.wmv.41D-439-C1B
MD5
0f07f850f96f9408b68da3454f21d356

SHA1
63afcf794289a334a5a830612ce9cd1239faebb0

SHA256
8fa6d9be50b2ba6759c0a7176212c1627d48c804bb633a8e6002353abea58238

SHA512
a88002384a1781effcc383e5f5311c288b1d7687519e8b32f14124d4dbf33d4dbecd8923eeb70fad0ae8582331cd4e6376ae8725fd9fe10d7d4643a3fe0b75c2

Download Submit
C:\Users\Admin\Desktop\ResumeUse.xps.41D-439-C1B
MD5
4f3cc5e98a29ab7790fca0b6d2b37d5c

SHA1
479964975749772d064a2527f94d7ae79ac5f31f

SHA256
6f5fde00b765510ee9b7cdbba59fd91929e5af2796346d5a37f333b43115f4df

SHA512
193694b49926640a0f0bf6b4c4a60157be8de02caf6f8315aaaab4a5d3a129bbf20ed52d47249315d64e7a25b194a0ffc14a2322213a2e7c74ade4f08c97ad25

Download Submit
C:\Users\Admin\Desktop\RevokeTest.vsw.41D-439-C1B
MD5
13d36ef3860fe0a5c9a16b527c0ec7a7

SHA1
7f209c59cc4e4095cfce51c5026178700529928d

SHA256
15437f12d85409e0e2347b53655774df5cc6811758a1234cb2e40afd76334147

SHA512
1a4fe9b3d9927210b7468faf1a1f7336a2a1e3ae13ccfbb336b3148ab6f86c0a86e739e2d1c2714391b6085facafdc4c0e5e77dff5ae8778db8f5492d1a88aa6

Download Submit
C:\Users\Admin\Desktop\SendConvertTo.kix.41D-439-C1B
MD5
4963ce744ef9aa2488d744ef30d53b3f

SHA1
f8b365c345ee4b3ff0b16a06f70d9cbc683c5936

SHA256
d5c2b962c44a8621ec7005ff029c00d99f3adc0d8e531fda9e0db7f8f7b85817

SHA512
f4ee0eaa9c4f4c2cf679638bee4fb37911813710c3b22625d8a19788d1f8a184dfd9651ed39664612589835a27bde4ef0a4cb673f2f99b2cd95d01c3b4f1f0cf

Download Submit
C:\Users\Admin\Desktop\SubmitAdd.tmp.41D-439-C1B
MD5
aa5b9c73edd1a1be75722a3ba5ad7ae4

SHA1
822a9c13c23124fafd9a2e4e37157252f080302d

SHA256
19f4b9b84cb24cce85abb0bc1287e97b302dbd945d8baab51dfb33ea41543cf3

SHA512
6886348af9ce5a7a54ce6df9032b6f0b8b736bc3b11abce206dd95a780636bd5a88ac7a6262e3fb82992d65b74dd3630f9bef13464adc0be1b2a2c3cdb948324

Download Submit
C:\Users\Admin\Desktop\SubmitAssert.txt.41D-439-C1B
MD5
41ef4c54177f6d773d487e52757e9dd2

SHA1
19099d60f683d75904a14509af7228613bee8f97

SHA256
7b9177c2bc5655dd9d0d90a9d6061c2c2385e94214d02ab0ba979c26622fa518

SHA512
1e2a4ec752ab6322ba5acea24f08af39d5e5acfdf191941f93486531ea8491c6f3474cf5161474adf1dc1fffb2c1b6b643bb7ccbb7d8d4d6dde05e82374c925f

Download Submit
C:\Users\Admin\Desktop\TestSubmit.asf.41D-439-C1B
MD5
d0b33e9e2c7a137fb63dd0ab079be540

SHA1
0cb0dbd8ebc28df220ea098a5355291f5d31c2d4

SHA256
85146f7fbfa7a3ef40be294c2f38e82f25cf11b5eda7c917755bdaf055ba1d68

SHA512
0fbd41f83792c01b60529d0a575a4bc7fc0fb3d297a356bc143c00a453b8f03d603f25b724de99947bb43ac86bbad3a3c4fe6f23179152c44ee866f23cf3f2dd

Download Submit
C:\Users\Admin\Desktop\UsePop.raw.41D-439-C1B
MD5
5b7046867a59b35d984f2f2fec2ef2d7

SHA1
cff8fa3298d173e6f09c5435be0cb8412bf85132

SHA256
178574441e2008420aadf72e66db79d7f0f6ef994e70708636002afb31455d25

SHA512
28eb4b5a454b414bd7bf8718cf00bf57a6409e9b3d33c37399cc4aecd41c24bee25f7d8e825a8c807ed9ea4cb0317ad57413bf21581efa9bae3bb11549f2d746

Download Submit
C:\Users\Admin\Desktop\WaitInstall.eps.41D-439-C1B
MD5
a2d297718f060de03d529d54136f10bb

SHA1
e3a1b334e5ae53163aba44951469b7f64a1630a5

SHA256
765aa2a9521e97abfb6e057684d1049ec7430eb3e1c79cd14dea5b9d3230da1a

SHA512
22d946702fa2ae18171686c12516110b46fbde9b4aeac77e9229a2fbcdb90a4c311affa01e41550748ad479776be357717ae19841494ce30ab439b2a7013d160

Download Submit
C:\Users\Admin\Desktop\WaitOpen.cab.41D-439-C1B
MD5
9fefdfd903e1f70b61da20965dec49da

SHA1
37bd6b79bc28d8b56702232c9d3d1d4b0d86166f

SHA256
156c5025ed58708454ebb9c324b53979355b43a71e180d33fe703780c8be093a

SHA512
050b302d9fdfc95cdb7eb61d4e5c507cc61772ec2b97d00ab79292a3f3b286428662c9c03f47fb335eeeae1aefc5ac4664e7688a3ef926863156b8bca556520c

Download Submit
C:\Users\Admin\Desktop\WatchOpen.ico.41D-439-C1B
MD5
984174f0f9e336b4a7123906afb2f1ca

SHA1
94b7006463a6f515521313782ab9b1f2d55ed3b3

SHA256
538b749f404b9f13afbb37035a4932539176100954c4ff50515bf00ab7352d78

SHA512
b0ce9c49da188d1d15a47000fd05c4b0a177f381f753c8e29cc93f6512ee72485c3bb0cc1b602b841eabd60164003f20a9dbcf62db938982e97a34c624f237c2

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
MD5
3163bba8a4861d47aafa1667d3082fee

SHA1
32824014c8740b8fef306e742c891bec0ef068d3

SHA256
39016358b939b83cf9997c447458ae2d13186c3f66e66784c9e8ff4031b60c7e

SHA512
e25f77dd78df4a80ec02f01c8c6ed85fa0f9028ea87b899ffa0a5a87d211cb8c861d4e7912bb8d3cc3ee0a7240eb130f0abd6ffa0d3698b3d416c70de52eb450

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
MD5
3163bba8a4861d47aafa1667d3082fee

SHA1
32824014c8740b8fef306e742c891bec0ef068d3

SHA256
39016358b939b83cf9997c447458ae2d13186c3f66e66784c9e8ff4031b60c7e

SHA512
e25f77dd78df4a80ec02f01c8c6ed85fa0f9028ea87b899ffa0a5a87d211cb8c861d4e7912bb8d3cc3ee0a7240eb130f0abd6ffa0d3698b3d416c70de52eb450

Download Submit
memory/340-3-0x0000000000000000-mapping.dmp

Download
memory/580-5-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/580-6-0x0000000000000000-mapping.dmp

Download
memory/840-20-0x0000000000000000-mapping.dmp

Download
memory/880-17-0x0000000000000000-mapping.dmp

Download
memory/1128-28-0x0000000000000000-mapping.dmp

Download
memory/1200-18-0x0000000000000000-mapping.dmp

Download
memory/1276-0-0x000007FEF7DF0000-0x000007FEF806A000-memory.dmp

Filesize
2.5MB

Download
memory/1428-29-0x0000000000000000-mapping.dmp

Download
memory/1436-19-0x0000000000000000-mapping.dmp

Download
memory/1576-21-0x0000000000000000-mapping.dmp

Download
memory/1692-23-0x0000000000000000-mapping.dmp

Download
memory/1744-54-0x0000000000000000-mapping.dmp

Download
memory/1916-16-0x0000000000000000-mapping.dmp

Download
memory/1948-27-0x0000000000000000-mapping.dmp

Download
memory/1952-25-0x0000000000000000-mapping.dmp

Download