Analysis
-
max time kernel
149s -
max time network
134s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
08-11-2020 17:48
Static task
static1
Behavioral task
behavioral1
Sample
60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe
Resource
win10v20201028
General
-
Target
60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe
-
Size
265KB
-
MD5
b256c9ca1a41c2df7c8a26e1f142b89b
-
SHA1
ba3ca7e832774387b13b743b1bf7fe478412c55e
-
SHA256
60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060
-
SHA512
c587185bf7b9fdc8c08c5ee066d3d997b2d15d1f24300cbcf77b050409cfa7b1630fc5d491ebd6904ba7949b76ea0b9f435107735bd3cb1bd489f10650bb9b55
Malware Config
Extracted
C:\Users\Admin\Downloads\# DECRYPT MY FILES #.txt
cerber
http://bqyjebfh25oellur.onion.to/0B35-CA2A-FBAA-0000-0E29
http://bqyjebfh25oellur.onion.cab/0B35-CA2A-FBAA-0000-0E29
http://bqyjebfh25oellur.onion.nu/0B35-CA2A-FBAA-0000-0E29
http://bqyjebfh25oellur.onion.link/0B35-CA2A-FBAA-0000-0E29
http://bqyjebfh25oellur.tor2web.org/0B35-CA2A-FBAA-0000-0E29
http://bqyjebfh25oellur.onion/0B35-CA2A-FBAA-0000-0E29
Extracted
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
http://bqyjebfh25oellur.onion.to/0B35-CA2A-FBAA-0000-0E29(Get
http://bqyjebfh25oellur.onion.cab/0B35-CA2A-FBAA-0000-0E29
http://bqyjebfh25oellur.onion.nu/0B35-CA2A-FBAA-0000-0E29
http://bqyjebfh25oellur.onion.link/0B35-CA2A-FBAA-0000-0E29
http://bqyjebfh25oellur.tor2web.org/0B35-CA2A-FBAA-0000-0E29
http://bqyjebfh25oellur.onion.to/0B35-CA2A-FBAA-0000-0E29);
http://bqyjebfh25oellur.onion.to/0B35-CA2A-FBAA-0000-0E29
http://bqyjebfh25oellur.onion/0B35-CA2A-FBAA-0000-0E29
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exedtdump.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\dtdump.exe\"" 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\dtdump.exe\"" dtdump.exe -
Executes dropped EXE 2 IoCs
Processes:
dtdump.exedtdump.exepid process 3788 dtdump.exe 2184 dtdump.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
dtdump.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\EnterApprove.tiff dtdump.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
dtdump.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation dtdump.exe -
Drops startup file 2 IoCs
Processes:
60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exedtdump.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\dtdump.lnk 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\dtdump.lnk dtdump.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
dtdump.exe60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce dtdump.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dtdump = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\dtdump.exe\"" dtdump.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\dtdump = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\dtdump.exe\"" 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dtdump = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\dtdump.exe\"" 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run dtdump.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\dtdump = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\dtdump.exe\"" dtdump.exe -
JavaScript code in executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html js -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 ip-api.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
dtdump.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp5351.bmp" dtdump.exe -
Drops file in Windows directory 1 IoCs
Processes:
MicrosoftEdge.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 788 taskkill.exe 1192 taskkill.exe -
Modifies Control Panel 5 IoCs
Processes:
60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exedtdump.exeMicrosoftEdge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\dtdump.exe\"" 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop dtdump.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\dtdump.exe\"" dtdump.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Colors MicrosoftEdge.exe -
Processes:
MicrosoftEdgeCP.exeMicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 275 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000aadd982ec42d3ba86c69ec486732c02d8a637e1b182cc76a79bed22b5f43aeb2b20011fcafe43892b2e44014bb8334f777bf2623b1c603137324 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 86a695f10fb6d601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileCountryCode = "US" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 6c3a3b6c55add601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersio = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{344405F8-5760-45E4-9CE9-7732AA987F51} = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\ImageStoreRandomFolder = "50quqdb" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4f6e5cf10fb6d601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\Md5FileCheck = 9fa75725855604a758366c6a1d9f0311 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = c22561f60fb6d601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberCompleted = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = fe7a0af20fb6d601 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 6c96cd0410b6d601 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\Enabled = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "311689059" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = 80ec935642b6d601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration MicrosoftEdge.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 405 IoCs
Processes:
dtdump.exepid process 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe 3788 dtdump.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
MicrosoftEdgeCP.exepid process 4688 MicrosoftEdgeCP.exe 4688 MicrosoftEdgeCP.exe 4688 MicrosoftEdgeCP.exe 4688 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exedtdump.exetaskkill.exedtdump.exeMicrosoftEdge.exeAUDIODG.EXEMicrosoftEdgeCP.exeMicrosoftEdgeCP.exetaskkill.exedescription pid process Token: SeDebugPrivilege 4760 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe Token: SeDebugPrivilege 3788 dtdump.exe Token: SeDebugPrivilege 788 taskkill.exe Token: SeDebugPrivilege 2184 dtdump.exe Token: SeDebugPrivilege 4540 MicrosoftEdge.exe Token: SeDebugPrivilege 4540 MicrosoftEdge.exe Token: SeDebugPrivilege 4540 MicrosoftEdge.exe Token: SeDebugPrivilege 4540 MicrosoftEdge.exe Token: 33 1064 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1064 AUDIODG.EXE Token: SeDebugPrivilege 4240 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4240 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4240 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4240 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1412 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1412 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1412 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1412 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1192 taskkill.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exepid process 4540 MicrosoftEdge.exe 4688 MicrosoftEdgeCP.exe 4688 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.execmd.exedtdump.exeMicrosoftEdgeCP.execmd.exedescription pid process target process PID 4760 wrote to memory of 3788 4760 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe dtdump.exe PID 4760 wrote to memory of 3788 4760 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe dtdump.exe PID 4760 wrote to memory of 3788 4760 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe dtdump.exe PID 4760 wrote to memory of 4252 4760 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe cmd.exe PID 4760 wrote to memory of 4252 4760 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe cmd.exe PID 4760 wrote to memory of 4252 4760 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe cmd.exe PID 4252 wrote to memory of 788 4252 cmd.exe taskkill.exe PID 4252 wrote to memory of 788 4252 cmd.exe taskkill.exe PID 4252 wrote to memory of 788 4252 cmd.exe taskkill.exe PID 4252 wrote to memory of 4028 4252 cmd.exe PING.EXE PID 4252 wrote to memory of 4028 4252 cmd.exe PING.EXE PID 4252 wrote to memory of 4028 4252 cmd.exe PING.EXE PID 3788 wrote to memory of 4472 3788 dtdump.exe NOTEPAD.EXE PID 3788 wrote to memory of 4472 3788 dtdump.exe NOTEPAD.EXE PID 3788 wrote to memory of 4908 3788 dtdump.exe WScript.exe PID 3788 wrote to memory of 4908 3788 dtdump.exe WScript.exe PID 4688 wrote to memory of 1412 4688 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4688 wrote to memory of 1412 4688 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4688 wrote to memory of 1412 4688 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4688 wrote to memory of 1412 4688 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4688 wrote to memory of 1412 4688 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4688 wrote to memory of 1412 4688 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4688 wrote to memory of 1412 4688 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4688 wrote to memory of 1412 4688 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4688 wrote to memory of 1412 4688 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4688 wrote to memory of 1412 4688 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3788 wrote to memory of 2748 3788 dtdump.exe cmd.exe PID 3788 wrote to memory of 2748 3788 dtdump.exe cmd.exe PID 2748 wrote to memory of 1192 2748 cmd.exe taskkill.exe PID 2748 wrote to memory of 1192 2748 cmd.exe taskkill.exe PID 2748 wrote to memory of 2216 2748 cmd.exe PING.EXE PID 2748 wrote to memory of 2216 2748 cmd.exe PING.EXE PID 4688 wrote to memory of 4240 4688 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4688 wrote to memory of 4240 4688 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe"C:\Users\Admin\AppData\Local\Temp\60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\dtdump.exe"C:\Users\Admin\AppData\Roaming\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\dtdump.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "dtdump.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\dtdump.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "dtdump.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe" > NUL2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\dtdump.exeC:\Users\Admin\AppData\Roaming\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\dtdump.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4081⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\dtdump.lnkMD5
c5e00bcb160bf6ec3c80b4fd4065589e
SHA189d11e6f539f7e33ec5e285f0591d634b9fdf2c2
SHA256c77c810e23be56708b2d808044bf0b2f960e864314a4ce224202e0cb98e0145f
SHA5128781be503afe9e53dfaed459e49ff49b4521b65faead8434c69d4f89f21dc79b3633d39a2ca140f3d50412737df45f4c259cdeeca3fcba90aecdd253317bb5e5
-
C:\Users\Admin\AppData\Roaming\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\dtdump.exeMD5
b256c9ca1a41c2df7c8a26e1f142b89b
SHA1ba3ca7e832774387b13b743b1bf7fe478412c55e
SHA25660d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060
SHA512c587185bf7b9fdc8c08c5ee066d3d997b2d15d1f24300cbcf77b050409cfa7b1630fc5d491ebd6904ba7949b76ea0b9f435107735bd3cb1bd489f10650bb9b55
-
C:\Users\Admin\AppData\Roaming\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\dtdump.exeMD5
b256c9ca1a41c2df7c8a26e1f142b89b
SHA1ba3ca7e832774387b13b743b1bf7fe478412c55e
SHA25660d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060
SHA512c587185bf7b9fdc8c08c5ee066d3d997b2d15d1f24300cbcf77b050409cfa7b1630fc5d491ebd6904ba7949b76ea0b9f435107735bd3cb1bd489f10650bb9b55
-
C:\Users\Admin\AppData\Roaming\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\dtdump.exeMD5
b256c9ca1a41c2df7c8a26e1f142b89b
SHA1ba3ca7e832774387b13b743b1bf7fe478412c55e
SHA25660d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060
SHA512c587185bf7b9fdc8c08c5ee066d3d997b2d15d1f24300cbcf77b050409cfa7b1630fc5d491ebd6904ba7949b76ea0b9f435107735bd3cb1bd489f10650bb9b55
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.htmlMD5
60bd477c1331eed5819ef55a209968fd
SHA1c045e147beedce322c8bb27ed45c3d1d563e38be
SHA25607625774a40fb3e90d1ea06f28e4bd6c11c52a6813bcff5e5e8cb7fc096a2561
SHA5128b40c95a5af1cb22281c04ddbdc1460a38f208161170252c94117771735054301271d88b23ffcd0202efc975da4ca03d586830517603f39f1ceef0d6fdc37db1
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txtMD5
adcda37aa03e55b786bf8384065fa279
SHA1d5a1a931d60d64352f0ff77398b4e66feb255fd3
SHA2560019b06fccada84b64a728e6d8638f214f2b09d5b614d802ee28dee63c034ec7
SHA512c3dfbb05ace268e9fea643e0f7d3f3bc72f3b045d333fa8ecef5b3925112507158b7e8215f952600766c881ae4f779ebefc9aa02a55559be25393d098abd312f
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbsMD5
1c2a24505278e661eca32666d4311ce5
SHA1d1deb57023bbe38a33f0894b6a9a7bbffbfdeeee
SHA2563f0dc6126cf33e7aa725df926a1b7d434eaf62a69f42e1b8ae4c110fd3572628
SHA512ce866f2c4b96c6c7c090f4bf1708bfebdfcd58ce65a23bdc124a13402ef4941377c7e286e6156a28bd229e422685454052382f1f532545bc2edf07be4861b36c
-
memory/788-4-0x0000000000000000-mapping.dmp
-
memory/1192-43-0x0000000000000000-mapping.dmp
-
memory/2216-44-0x0000000000000000-mapping.dmp
-
memory/2748-42-0x0000000000000000-mapping.dmp
-
memory/3788-0-0x0000000000000000-mapping.dmp
-
memory/4028-6-0x0000000000000000-mapping.dmp
-
memory/4252-3-0x0000000000000000-mapping.dmp
-
memory/4472-9-0x0000000000000000-mapping.dmp
-
memory/4908-28-0x0000000000000000-mapping.dmp