Analysis
-
max time kernel
133s -
max time network
140s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
06-11-2020 10:40
Static task
static1
Behavioral task
behavioral1
Sample
1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe
Resource
win10v20201028
General
-
Target
1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe
-
Size
265KB
-
MD5
fabda8e31024cb3b78870ff8d6c091c4
-
SHA1
04b3bb677dcc069ec6c664fe6858514ac4bb7305
-
SHA256
1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9
-
SHA512
9fa93c6ce215af70969269cade65bcf2596c302f7322022befbc617b81e73f478fb96b7520847248248927db79360206c450618a2c41369f5845e96990fed223
Malware Config
Extracted
C:\Users\Admin\Music\# DECRYPT MY FILES #.txt
cerber
http://bqyjebfh25oellur.onion.to/B530-9DF9-D264-0000-063F
http://bqyjebfh25oellur.onion.cab/B530-9DF9-D264-0000-063F
http://bqyjebfh25oellur.onion.nu/B530-9DF9-D264-0000-063F
http://bqyjebfh25oellur.onion.link/B530-9DF9-D264-0000-063F
http://bqyjebfh25oellur.tor2web.org/B530-9DF9-D264-0000-063F
http://bqyjebfh25oellur.onion/B530-9DF9-D264-0000-063F
Extracted
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
http://bqyjebfh25oellur.onion.to/B530-9DF9-D264-0000-063F(Get
http://bqyjebfh25oellur.onion.cab/B530-9DF9-D264-0000-063F
http://bqyjebfh25oellur.onion.nu/B530-9DF9-D264-0000-063F
http://bqyjebfh25oellur.onion.link/B530-9DF9-D264-0000-063F
http://bqyjebfh25oellur.tor2web.org/B530-9DF9-D264-0000-063F
http://bqyjebfh25oellur.onion.to/B530-9DF9-D264-0000-063F);
http://bqyjebfh25oellur.onion.to/B530-9DF9-D264-0000-063F
http://bqyjebfh25oellur.onion/B530-9DF9-D264-0000-063F
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Ursnif RM3
A heavily modified version of Ursnif discovered in the wild.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exemountvol.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\mountvol.exe\"" 1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\mountvol.exe\"" mountvol.exe -
Executes dropped EXE 2 IoCs
Processes:
mountvol.exemountvol.exepid process 2008 mountvol.exe 1624 mountvol.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1528 cmd.exe -
Drops startup file 2 IoCs
Processes:
1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exemountvol.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\mountvol.lnk 1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\mountvol.lnk mountvol.exe -
Loads dropped DLL 2 IoCs
Processes:
1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exemountvol.exepid process 784 1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe 2008 mountvol.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
mountvol.exe1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\mountvol = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\mountvol.exe\"" mountvol.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce mountvol.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mountvol = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\mountvol.exe\"" mountvol.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run 1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\mountvol = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\mountvol.exe\"" 1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mountvol = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\mountvol.exe\"" 1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run mountvol.exe -
Processes:
mountvol.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mountvol.exe -
JavaScript code in executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html js -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 ip-api.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
mountvol.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp18BE.bmp" mountvol.exe -
Drops file in Program Files directory 15 IoCs
Processes:
mountvol.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE mountvol.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE mountvol.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE mountvol.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.html mountvol.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.txt mountvol.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE mountvol.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.vbs mountvol.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.vbs mountvol.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE mountvol.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote-PipelineConfig.xml mountvol.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.url mountvol.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote.ini mountvol.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.html mountvol.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.txt mountvol.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.url mountvol.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 1972 taskkill.exe 2228 taskkill.exe -
Modifies Control Panel 4 IoCs
Processes:
1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exemountvol.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop 1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\mountvol.exe\"" 1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop mountvol.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\mountvol.exe\"" mountvol.exe -
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000f56429e8f525efff9ae6d4aa3ed0ea9c98aa5d4e51161698b4cf8312e5191c4d000000000e80000000020000200000002c274856ec2b049216c072bf23745080c8660923bb6559a868e5e1b7c5d1d653900000000129b3f4da007cfd8f1f12db3651f0e6ca080e4deb63ecd817e36562410f29e411cf1ce837a61ae36e32224f2f51aceb5d5a3a73a4aa9c4328f8d54f8aa9889edc958222733f09d8ca5ec89bcab820b55e99ea3a97081e1b636ff703a6b1f8e10e2abd4cbe94bc56f6411409ac5658459ad42dd74465a1e9b150fbc3b73a6e6d4a7ac3c7dea0b11b948b1fdd0e7adc87400000000305428ebca6becf242b605fc6d02b372ff4495526a085015768e03fefcf57e98e16015edc4a27cf8de72a97d47bc05f005870f6fad603524710e243fd818939 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000cbada497754e43f91a06facebc454cfdf08d5286a44d0d6c3286e3abd4e1506b000000000e8000000002000020000000434118e12b14a65bf54800d3b5d6666830df7a5fe3662b7209ff83d60e462a99200000004dca5eb19591fbae20f823b688de0d701c3c70b8f9f06253ce239cc70dbd300540000000912f1a379247e1080a104910f3a6c9ac1d43ec2c5f8c15b03b7d01db254c9e0d87e40f77c0769fb7d45ea299a72450a290e7fd15aeb6f8ca571a5a83e4d90d98 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{288D3C81-201E-11EB-A309-520DDC0DB10A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0df2bed2ab4d601 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "311424921" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{286263C1-201E-11EB-A309-520DDC0DB10A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 270 IoCs
Processes:
mountvol.exepid process 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe 2008 mountvol.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exetaskkill.exemountvol.exemountvol.exeAUDIODG.EXEtaskkill.exedescription pid process Token: SeDebugPrivilege 784 1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe Token: SeDebugPrivilege 1972 taskkill.exe Token: SeDebugPrivilege 2008 mountvol.exe Token: SeDebugPrivilege 1624 mountvol.exe Token: 33 2092 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2092 AUDIODG.EXE Token: 33 2092 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2092 AUDIODG.EXE Token: SeDebugPrivilege 2228 taskkill.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
iexplore.exeiexplore.exepid process 1356 iexplore.exe 1904 iexplore.exe 1904 iexplore.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEpid process 1904 iexplore.exe 1904 iexplore.exe 1356 iexplore.exe 1356 iexplore.exe 1904 iexplore.exe 1904 iexplore.exe 1716 IEXPLORE.EXE 1716 IEXPLORE.EXE 304 IEXPLORE.EXE 304 IEXPLORE.EXE 1008 IEXPLORE.EXE 1008 IEXPLORE.EXE 1008 IEXPLORE.EXE 1008 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 3 IoCs
Processes:
1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exemountvol.exemountvol.exepid process 784 1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe 2008 mountvol.exe 1624 mountvol.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.execmd.exetaskeng.exemountvol.exeiexplore.exeiexplore.execmd.exedescription pid process target process PID 784 wrote to memory of 2008 784 1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe mountvol.exe PID 784 wrote to memory of 2008 784 1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe mountvol.exe PID 784 wrote to memory of 2008 784 1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe mountvol.exe PID 784 wrote to memory of 2008 784 1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe mountvol.exe PID 784 wrote to memory of 1528 784 1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe cmd.exe PID 784 wrote to memory of 1528 784 1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe cmd.exe PID 784 wrote to memory of 1528 784 1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe cmd.exe PID 784 wrote to memory of 1528 784 1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe cmd.exe PID 1528 wrote to memory of 1972 1528 cmd.exe taskkill.exe PID 1528 wrote to memory of 1972 1528 cmd.exe taskkill.exe PID 1528 wrote to memory of 1972 1528 cmd.exe taskkill.exe PID 1528 wrote to memory of 1972 1528 cmd.exe taskkill.exe PID 1528 wrote to memory of 1424 1528 cmd.exe PING.EXE PID 1528 wrote to memory of 1424 1528 cmd.exe PING.EXE PID 1528 wrote to memory of 1424 1528 cmd.exe PING.EXE PID 1528 wrote to memory of 1424 1528 cmd.exe PING.EXE PID 2044 wrote to memory of 1624 2044 taskeng.exe mountvol.exe PID 2044 wrote to memory of 1624 2044 taskeng.exe mountvol.exe PID 2044 wrote to memory of 1624 2044 taskeng.exe mountvol.exe PID 2044 wrote to memory of 1624 2044 taskeng.exe mountvol.exe PID 2008 wrote to memory of 1904 2008 mountvol.exe iexplore.exe PID 2008 wrote to memory of 1904 2008 mountvol.exe iexplore.exe PID 2008 wrote to memory of 1904 2008 mountvol.exe iexplore.exe PID 2008 wrote to memory of 1904 2008 mountvol.exe iexplore.exe PID 2008 wrote to memory of 1200 2008 mountvol.exe NOTEPAD.EXE PID 2008 wrote to memory of 1200 2008 mountvol.exe NOTEPAD.EXE PID 2008 wrote to memory of 1200 2008 mountvol.exe NOTEPAD.EXE PID 2008 wrote to memory of 1200 2008 mountvol.exe NOTEPAD.EXE PID 1904 wrote to memory of 304 1904 iexplore.exe IEXPLORE.EXE PID 1904 wrote to memory of 304 1904 iexplore.exe IEXPLORE.EXE PID 1904 wrote to memory of 304 1904 iexplore.exe IEXPLORE.EXE PID 1904 wrote to memory of 304 1904 iexplore.exe IEXPLORE.EXE PID 1356 wrote to memory of 1716 1356 iexplore.exe IEXPLORE.EXE PID 1356 wrote to memory of 1716 1356 iexplore.exe IEXPLORE.EXE PID 1356 wrote to memory of 1716 1356 iexplore.exe IEXPLORE.EXE PID 1356 wrote to memory of 1716 1356 iexplore.exe IEXPLORE.EXE PID 1904 wrote to memory of 1008 1904 iexplore.exe IEXPLORE.EXE PID 1904 wrote to memory of 1008 1904 iexplore.exe IEXPLORE.EXE PID 1904 wrote to memory of 1008 1904 iexplore.exe IEXPLORE.EXE PID 1904 wrote to memory of 1008 1904 iexplore.exe IEXPLORE.EXE PID 2008 wrote to memory of 968 2008 mountvol.exe WScript.exe PID 2008 wrote to memory of 968 2008 mountvol.exe WScript.exe PID 2008 wrote to memory of 968 2008 mountvol.exe WScript.exe PID 2008 wrote to memory of 968 2008 mountvol.exe WScript.exe PID 2008 wrote to memory of 2188 2008 mountvol.exe cmd.exe PID 2008 wrote to memory of 2188 2008 mountvol.exe cmd.exe PID 2008 wrote to memory of 2188 2008 mountvol.exe cmd.exe PID 2008 wrote to memory of 2188 2008 mountvol.exe cmd.exe PID 2188 wrote to memory of 2228 2188 cmd.exe taskkill.exe PID 2188 wrote to memory of 2228 2188 cmd.exe taskkill.exe PID 2188 wrote to memory of 2228 2188 cmd.exe taskkill.exe PID 2188 wrote to memory of 2304 2188 cmd.exe PING.EXE PID 2188 wrote to memory of 2304 2188 cmd.exe PING.EXE PID 2188 wrote to memory of 2304 2188 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe"C:\Users\Admin\AppData\Local\Temp\1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\mountvol.exe"C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\mountvol.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1904 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1904 CREDAT:209922 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "mountvol.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\mountvol.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "mountvol.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "1cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
C:\Windows\system32\taskeng.exetaskeng.exe {5B271823-96E5-469D-89BF-824A5A2A4839} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\mountvol.exeC:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\mountvol.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1356 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x57c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
0d39317840024ee9d5ca2cf0089584b6
SHA11538e6c7e96fdc2e86bdb154e16269339593f765
SHA256fccae0334e97d3df3d879d4a7a7616bcc0384ad634f607e29e82d9482e16430f
SHA512b35bf744d0186c4955f904009988f3dfc5225b61549eb12f19917d6b10325611abeb2200a2ba3e6130e436e14aee6c002f4263565e4e41bd3ce108f7252fe447
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{286263C1-201E-11EB-A309-520DDC0DB10A}.datMD5
452b97f83bba1eec48591f32aa2bf7ab
SHA11a3dcf95d00efbe6e5d0c71abbe9316ab215bc07
SHA2568c054b748c8aa603572bc6e06482e44c1ba4ae248dae2cb86e1eaaa44845392b
SHA5128055bf6444500bc5f84fe53ab962caa39c383ca5e2434731b02f3bde81d378205f6f29ed6972e696b7f93e5cb802bbbdbc22304cd02ee1e751cb6d13af68b531
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\4AA3BRW1.txtMD5
476b9398f60a1bee4b58bc245fb676ca
SHA1dba005d9ef4af1500cae3464470f35a9d7766e8f
SHA256bf6847271261dbc2bf15d375907b8f516bef9ac747f68b14c05bfbd6250d3248
SHA5122a50ec02edf3b6f33cd5078158b8b6eaf6fc6ffd25c796ec67fc21e5043ce0d618b739f2143d01ad7f05a7459e71771200bdf478b5d87b2e803ee8b812f2319e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\S8TNL5S3.txtMD5
477cde7d49c7034418405d23e1ba7281
SHA19d0d3ecac5b4c3237526c22dcac4f47eff2d6ce4
SHA256746aad4268bfc11a102d2d16f0dd277ed33b207e50685e28b8309af419b4c144
SHA5127e1c33af54bffb00c54e321d7aaa68a213823d7b8796c1d28915d60df37d75618dd03d9749f42f72171dfa242a4902957cabe2002bd462b0cc8497ee63ca5a62
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\mountvol.lnkMD5
25d90d9f3ef3da022a32a1c28675f869
SHA11c2ef8f55fd4214f66f1f91eb4d29cf86fdf9973
SHA256b3ece9a658cdb57332f755a872575b4a1609c33148fc2ae912c1352c2f2a873e
SHA512f4e6abd02bd4b1218f738b49cea8c483dd9c7c51bd3ebe90559ce23123a94396bed4eea9432e70f26fb6740786856a4826d8fa9aa921d80df793c980b05f86c0
-
C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\mountvol.exeMD5
fabda8e31024cb3b78870ff8d6c091c4
SHA104b3bb677dcc069ec6c664fe6858514ac4bb7305
SHA2561cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9
SHA5129fa93c6ce215af70969269cade65bcf2596c302f7322022befbc617b81e73f478fb96b7520847248248927db79360206c450618a2c41369f5845e96990fed223
-
C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\mountvol.exeMD5
fabda8e31024cb3b78870ff8d6c091c4
SHA104b3bb677dcc069ec6c664fe6858514ac4bb7305
SHA2561cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9
SHA5129fa93c6ce215af70969269cade65bcf2596c302f7322022befbc617b81e73f478fb96b7520847248248927db79360206c450618a2c41369f5845e96990fed223
-
C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\mountvol.exeMD5
fabda8e31024cb3b78870ff8d6c091c4
SHA104b3bb677dcc069ec6c664fe6858514ac4bb7305
SHA2561cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9
SHA5129fa93c6ce215af70969269cade65bcf2596c302f7322022befbc617b81e73f478fb96b7520847248248927db79360206c450618a2c41369f5845e96990fed223
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.htmlMD5
4eea70be4c3447209f08bbf35fc5dfa5
SHA174420dbd99fc43723d7f155b2ecd70c9dc6319c2
SHA256068f02db8e44895633a6f55f50b3784052d4b5c1e062e1e23db9adf0e7b0d57f
SHA5124fd7679f28e714ed49726ee39b14374972fa43209cd9bfb76abb1e47ae77e86fb235d08fdb95624e675bd536737cd51af6c2ab6c901abe9225e9c4898dda3419
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txtMD5
d383f7ee48a193367a08028d6cb1dbd1
SHA160043de0429982453aadcc58f4220cef7e852b99
SHA25646585833bc8c6e28198b8089a09825b5d206aa0329c58bd6afcd2cafaffeff26
SHA5123805406750da38016a49921c25e51c05386fea2b7c3c2d778e64a499f401ad70ae27fa0b18915169d75f09b03b389952b9192a29e712b5e53b73be5211d2c964
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.urlMD5
e76dd0a1727bdcd38394b9e0d3e8c1f0
SHA17f88559b3500bce71456e4036830a309016440fc
SHA2561d131acac7bc8cbf7b5845d56a4a09d10a97988ede799895351b6e15170cbf01
SHA512eb8778410593dc73159dd9c12775842afe157e0caf27bd19c86925926b2aa73d75e87192119cef9ed6c87681e787b93764b52971e631bd770161a4ad1480079a
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbsMD5
1c2a24505278e661eca32666d4311ce5
SHA1d1deb57023bbe38a33f0894b6a9a7bbffbfdeeee
SHA2563f0dc6126cf33e7aa725df926a1b7d434eaf62a69f42e1b8ae4c110fd3572628
SHA512ce866f2c4b96c6c7c090f4bf1708bfebdfcd58ce65a23bdc124a13402ef4941377c7e286e6156a28bd229e422685454052382f1f532545bc2edf07be4861b36c
-
\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\mountvol.exeMD5
fabda8e31024cb3b78870ff8d6c091c4
SHA104b3bb677dcc069ec6c664fe6858514ac4bb7305
SHA2561cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9
SHA5129fa93c6ce215af70969269cade65bcf2596c302f7322022befbc617b81e73f478fb96b7520847248248927db79360206c450618a2c41369f5845e96990fed223
-
\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\mountvol.exeMD5
fabda8e31024cb3b78870ff8d6c091c4
SHA104b3bb677dcc069ec6c664fe6858514ac4bb7305
SHA2561cb6e2a2526f332fe132ab8905cd4cae65a1f7ef7aa4f9bf351f7f323f3b32c9
SHA5129fa93c6ce215af70969269cade65bcf2596c302f7322022befbc617b81e73f478fb96b7520847248248927db79360206c450618a2c41369f5845e96990fed223
-
memory/304-15-0x0000000000000000-mapping.dmp
-
memory/968-21-0x0000000000000000-mapping.dmp
-
memory/1008-18-0x0000000000000000-mapping.dmp
-
memory/1200-13-0x0000000000000000-mapping.dmp
-
memory/1424-7-0x0000000000000000-mapping.dmp
-
memory/1528-3-0x0000000000000000-mapping.dmp
-
memory/1624-9-0x0000000000000000-mapping.dmp
-
memory/1716-16-0x0000000000000000-mapping.dmp
-
memory/1764-6-0x000007FEF7EB0000-0x000007FEF812A000-memory.dmpFilesize
2.5MB
-
memory/1904-12-0x0000000000000000-mapping.dmp
-
memory/1972-4-0x0000000000000000-mapping.dmp
-
memory/2008-1-0x0000000000000000-mapping.dmp
-
memory/2188-26-0x0000000000000000-mapping.dmp
-
memory/2228-27-0x0000000000000000-mapping.dmp
-
memory/2304-28-0x0000000000000000-mapping.dmp