buran | 1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070

Analysis

max time kernel
151s
max time network
131s
platform
windows7_x64
resource
win7v20201028
submitted
29-12-2020 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe
Size

2.7MB
MD5

4301b4d1cb937816ffe288401d8938bf
SHA1

14126bcc7b1a7ec96114fb28a74c6a4d7e008246
SHA256

1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070
SHA512

82b0ebf62016f0b578384858b4d88fa97c70022a6e5e67871d93da5de2777553f949d40e6968ab9755cec4b48c8e40bdbc2ef4a1bd7a2db3ce52070e12b292bd

Score

10^/10

buran persistence ransomware

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: kassmaster@danwin1210.me and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: kassmaster@danwin1210.me Reserved email: kassmaster@tutanota.com Your personal ID: 12B-487-530 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

kassmaster@danwin1210.me

kassmaster@tutanota.com

Signatures

Buran
Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
ransomware buran
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Executes dropped EXE 2 IoCs

Processes:

csrss.execsrss.exe

pid process

744 csrss.exe
952 csrss.exe
Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

1088 notepad.exe

pid	process
744	csrss.exe
952	csrss.exe

pid	process
1088	notepad.exe

Loads dropped DLL 2 IoCs

Processes:

1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe

pid	process
1376	1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe
1376	1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run	1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\csrss.exe\" -start"	1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

csrss.exe

description	ioc	process
File opened (read-only)	\??\V:	csrss.exe
File opened (read-only)	\??\S:	csrss.exe
File opened (read-only)	\??\R:	csrss.exe
File opened (read-only)	\??\Q:	csrss.exe
File opened (read-only)	\??\L:	csrss.exe
File opened (read-only)	\??\K:	csrss.exe
File opened (read-only)	\??\Z:	csrss.exe
File opened (read-only)	\??\Y:	csrss.exe
File opened (read-only)	\??\J:	csrss.exe
File opened (read-only)	\??\F:	csrss.exe
File opened (read-only)	\??\X:	csrss.exe
File opened (read-only)	\??\W:	csrss.exe
File opened (read-only)	\??\E:	csrss.exe
File opened (read-only)	\??\O:	csrss.exe
File opened (read-only)	\??\N:	csrss.exe
File opened (read-only)	\??\P:	csrss.exe
File opened (read-only)	\??\M:	csrss.exe
File opened (read-only)	\??\I:	csrss.exe
File opened (read-only)	\??\H:	csrss.exe
File opened (read-only)	\??\G:	csrss.exe
File opened (read-only)	\??\B:	csrss.exe
File opened (read-only)	\??\U:	csrss.exe
File opened (read-only)	\??\T:	csrss.exe
File opened (read-only)	\??\A:	csrss.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 geoiptool.com

flow	ioc
6	geoiptool.com

Drops file in Program Files directory 12667 IoCs

Processes:

csrss.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\+NewSQLServerConnection.odc.12B-487-530	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR49B.GIF.12B-487-530	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\IPMS.ICO	csrss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar	csrss.exe
File opened for modification	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099187.JPG	csrss.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Australia\Brisbane.12B-487-530	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00513_.WMF.12B-487-530	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02252_.WMF.12B-487-530	csrss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml.12B-487-530	csrss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml	csrss.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Center.12B-487-530	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01744_.GIF.12B-487-530	csrss.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Costa_Rica	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00898_.WMF	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL00286_.WMF	csrss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF.12B-487-530	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00236_.WMF.12B-487-530	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287018.WMF	csrss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe.12B-487-530	csrss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Jujuy.12B-487-530	csrss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_ja.jar	csrss.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0233992.WMF	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18206_.WMF	csrss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bangkok	csrss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar.12B-487-530	csrss.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287645.JPG	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02116_.GIF.12B-487-530	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PSRCHSRN.DAT.12B-487-530	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\EXITEML.ICO	csrss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.12B-487-530	csrss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson.12B-487-530	csrss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar.12B-487-530	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099160.JPG.12B-487-530	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0292248.WMF.12B-487-530	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0297269.WMF.12B-487-530	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\TAB_OFF.GIF.12B-487-530	csrss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_zh_CN.jar.12B-487-530	csrss.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-5	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0093905.WMF.12B-487-530	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14514_.GIF	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099148.JPG.12B-487-530	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182689.JPG	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382963.JPG.12B-487-530	csrss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_zh_CN.jar.12B-487-530	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382962.JPG.12B-487-530	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02567J.JPG	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\SignedComponents.cer	csrss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt.12B-487-530	csrss.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png	csrss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.conf	csrss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar	csrss.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0178460.JPG	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\XLMACRO.CHM	csrss.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv	csrss.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	csrss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pitcairn	csrss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR9F.GIF	csrss.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml.12B-487-530	csrss.exe

Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

1296 vssadmin.exe
864 vssadmin.exe

pid	process
1296	vssadmin.exe
864	vssadmin.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.execsrss.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	csrss.exe

Suspicious use of AdjustPrivilegeToken 85 IoCs

Processes:

1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exeWMIC.exeWMIC.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1376	1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe
Token: SeDebugPrivilege	1376	1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe
Token: SeIncreaseQuotaPrivilege	920	WMIC.exe
Token: SeSecurityPrivilege	920	WMIC.exe
Token: SeTakeOwnershipPrivilege	920	WMIC.exe
Token: SeLoadDriverPrivilege	920	WMIC.exe
Token: SeSystemProfilePrivilege	920	WMIC.exe
Token: SeSystemtimePrivilege	920	WMIC.exe
Token: SeProfSingleProcessPrivilege	920	WMIC.exe
Token: SeIncBasePriorityPrivilege	920	WMIC.exe
Token: SeCreatePagefilePrivilege	920	WMIC.exe
Token: SeBackupPrivilege	920	WMIC.exe
Token: SeRestorePrivilege	920	WMIC.exe
Token: SeShutdownPrivilege	920	WMIC.exe
Token: SeDebugPrivilege	920	WMIC.exe
Token: SeSystemEnvironmentPrivilege	920	WMIC.exe
Token: SeRemoteShutdownPrivilege	920	WMIC.exe
Token: SeUndockPrivilege	920	WMIC.exe
Token: SeManageVolumePrivilege	920	WMIC.exe
Token: 33	920	WMIC.exe
Token: 34	920	WMIC.exe
Token: 35	920	WMIC.exe
Token: SeIncreaseQuotaPrivilege	628	WMIC.exe
Token: SeSecurityPrivilege	628	WMIC.exe
Token: SeTakeOwnershipPrivilege	628	WMIC.exe
Token: SeLoadDriverPrivilege	628	WMIC.exe
Token: SeSystemProfilePrivilege	628	WMIC.exe
Token: SeSystemtimePrivilege	628	WMIC.exe
Token: SeProfSingleProcessPrivilege	628	WMIC.exe
Token: SeIncBasePriorityPrivilege	628	WMIC.exe
Token: SeCreatePagefilePrivilege	628	WMIC.exe
Token: SeBackupPrivilege	628	WMIC.exe
Token: SeRestorePrivilege	628	WMIC.exe
Token: SeShutdownPrivilege	628	WMIC.exe
Token: SeDebugPrivilege	628	WMIC.exe
Token: SeSystemEnvironmentPrivilege	628	WMIC.exe
Token: SeRemoteShutdownPrivilege	628	WMIC.exe
Token: SeUndockPrivilege	628	WMIC.exe
Token: SeManageVolumePrivilege	628	WMIC.exe
Token: 33	628	WMIC.exe
Token: 34	628	WMIC.exe
Token: 35	628	WMIC.exe
Token: SeBackupPrivilege	1640	vssvc.exe
Token: SeRestorePrivilege	1640	vssvc.exe
Token: SeAuditPrivilege	1640	vssvc.exe
Token: SeIncreaseQuotaPrivilege	628	WMIC.exe
Token: SeSecurityPrivilege	628	WMIC.exe
Token: SeTakeOwnershipPrivilege	628	WMIC.exe
Token: SeLoadDriverPrivilege	628	WMIC.exe
Token: SeSystemProfilePrivilege	628	WMIC.exe
Token: SeSystemtimePrivilege	628	WMIC.exe
Token: SeProfSingleProcessPrivilege	628	WMIC.exe
Token: SeIncBasePriorityPrivilege	628	WMIC.exe
Token: SeCreatePagefilePrivilege	628	WMIC.exe
Token: SeBackupPrivilege	628	WMIC.exe
Token: SeRestorePrivilege	628	WMIC.exe
Token: SeShutdownPrivilege	628	WMIC.exe
Token: SeDebugPrivilege	628	WMIC.exe
Token: SeSystemEnvironmentPrivilege	628	WMIC.exe
Token: SeRemoteShutdownPrivilege	628	WMIC.exe
Token: SeUndockPrivilege	628	WMIC.exe
Token: SeManageVolumePrivilege	628	WMIC.exe
Token: 33	628	WMIC.exe
Token: 34	628	WMIC.exe

Suspicious use of WriteProcessMemory 55 IoCs

Processes:

1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.execsrss.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1376 wrote to memory of 744	1376	1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe	csrss.exe
PID 1376 wrote to memory of 744	1376	1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe	csrss.exe
PID 1376 wrote to memory of 744	1376	1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe	csrss.exe
PID 1376 wrote to memory of 744	1376	1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe	csrss.exe
PID 1376 wrote to memory of 1088	1376	1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe	notepad.exe
PID 1376 wrote to memory of 1088	1376	1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe	notepad.exe
PID 1376 wrote to memory of 1088	1376	1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe	notepad.exe
PID 1376 wrote to memory of 1088	1376	1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe	notepad.exe
PID 1376 wrote to memory of 1088	1376	1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe	notepad.exe
PID 1376 wrote to memory of 1088	1376	1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe	notepad.exe
PID 1376 wrote to memory of 1088	1376	1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe	notepad.exe
PID 744 wrote to memory of 1608	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 1608	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 1608	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 1608	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 1712	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 1712	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 1712	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 1712	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 1020	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 1020	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 1020	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 1020	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 964	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 964	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 964	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 964	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 860	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 860	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 860	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 860	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 1172	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 1172	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 1172	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 1172	744	csrss.exe	cmd.exe
PID 744 wrote to memory of 952	744	csrss.exe	csrss.exe
PID 744 wrote to memory of 952	744	csrss.exe	csrss.exe
PID 744 wrote to memory of 952	744	csrss.exe	csrss.exe
PID 744 wrote to memory of 952	744	csrss.exe	csrss.exe
PID 860 wrote to memory of 1296	860	cmd.exe	vssadmin.exe
PID 860 wrote to memory of 1296	860	cmd.exe	vssadmin.exe
PID 860 wrote to memory of 1296	860	cmd.exe	vssadmin.exe
PID 860 wrote to memory of 1296	860	cmd.exe	vssadmin.exe
PID 1608 wrote to memory of 628	1608	cmd.exe	WMIC.exe
PID 1608 wrote to memory of 628	1608	cmd.exe	WMIC.exe
PID 1608 wrote to memory of 628	1608	cmd.exe	WMIC.exe
PID 1608 wrote to memory of 628	1608	cmd.exe	WMIC.exe
PID 1172 wrote to memory of 920	1172	cmd.exe	WMIC.exe
PID 1172 wrote to memory of 920	1172	cmd.exe	WMIC.exe
PID 1172 wrote to memory of 920	1172	cmd.exe	WMIC.exe
PID 1172 wrote to memory of 920	1172	cmd.exe	WMIC.exe
PID 1172 wrote to memory of 864	1172	cmd.exe	vssadmin.exe
PID 1172 wrote to memory of 864	1172	cmd.exe	vssadmin.exe
PID 1172 wrote to memory of 864	1172	cmd.exe	vssadmin.exe
PID 1172 wrote to memory of 864	1172	cmd.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe
"C:\Users\Admin\AppData\Local\Temp\1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe" -start
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
3⤵
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:628

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
3⤵
PID:1712

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
PID:1020

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
3⤵
PID:964

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe" -agent 0
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:952

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
3⤵
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:920

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:864

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
3⤵
- Suspicious use of WriteProcessMemory
PID:860

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:1296

C:\Windows\SysWOW64\notepad.exe
notepad.exe
2⤵
- Deletes itself
PID:1088

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1640

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
MD5
61466c45ced4d83183fdb25396d4031c

SHA1
28a0f84a224cfddee721d7aa7cc5b54176358108

SHA256
1c3119bf6b52b905a989b256f6d40bf6d0150eb5485f5c416362a439e620e4f9

SHA512
152535df0af05a287d4435e702c9fc86195e61296e825b9bd67311054524bbeeb898aa4b23393c5af5d4f5fa2471fbe56b3d85964036d22b5ba751c8b3423e9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
MD5
21ef137d48d04fc9be98c2674223aa7d

SHA1
2c596c1c53112a535400e16fe124987aa665055c

SHA256
d265ed9b6513b4a1bc4b7b26f3f59b1ed4d0cf1aeb37bc0d38ec91b4658cc0e0

SHA512
f95cf62b52edf668adf1779d07bde1c68c29b848ec713270111b3fa2bc01edbdbbc5cfc958229c6e92567f4196285e935a2f922bbdcac80f9103ba15e832491a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
9d7369bfa72ae89d1d752ba17df6c22e

SHA1
ec6dad338b059d7bffbf47f84cf3c638226a0d82

SHA256
8ba91b47832e7c92ce4aec0255ae6511d12f7f92201d8d1db21d37f81a190030

SHA512
3cc58981fdaffa95022fbf13d7b0535ef0d1700fffda235a46902f9b9d9ac83458d8444aedae99b8392ee62d0151eea5f67d991bf538aa0919fcd5b6f7ae41f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
MD5
bfa8f146b8e4b0bc602a3b911b74a10d

SHA1
83ae143ff3a8afc7fab91ddb7e67104696518dfc

SHA256
26b1f0df9830c129deedd3eddf3f98c8d84c442e65ed74de4ca4b39ba5c405fa

SHA512
11c1a23b71075c03313d9ff5f2ce8cb92250fe3048499c8c90ce0be182a0bb73a9a67fd1865eae36418e5f5aea8b7fdf47462b9323933feeb68452c233995c28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
MD5
cbdff8e3f8930080454e4af43c250d67

SHA1
6a2f793c8fea7035c4f0475bf17ae83cae12a88f

SHA256
e336d536b227024d4cfe5d20077405444e3f523e013fd6b5e22837269c1ffe5d

SHA512
2ce4f3824b575fac3642e85db705c030a18b01be94bd839fcd02339f1ae924d96ddf62a045f1d8aa1b2fb27fa04a746d50472238fd420fcb8350d3439066fb90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
1848c039b553e41b866afb3b37181c9f

SHA1
9971c22127f630edef3350e420cdfd53c0eb738a

SHA256
4cdd2051c8fda214d16b4fea38f15cecb4e9ac987ebc64b927925dcf164bbf26

SHA512
bbcb253997f1182f2ce1d039bd0f29cef833a2923844b5ac1dbe3d718035f03590fa993872226910e9d257ff2d1d4d0d53e52d19fc4e3be1a874c87bb2e33e06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
ad44806829628106b34b720e2ea3eba4

SHA1
d18682a8ae454846a2f7daf972b55d91b0627266

SHA256
0687275b365c90f0a10130d0bb5cc5723e2527ab81f81792ea332a0358ca3db9

SHA512
1cc8894f2745b88e2bbc24025b65666bb5fd4a82d2d12bbb60313fc5167983da3d23897bc186d97a4f82e63b7d4d0bea0190757209b1c2b08b22f251a599e735

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3O0J2C38\CJV9S6QC.htm
MD5
8615e70875c2cc0b9db16027b9adf11d

SHA1
4ed62cf405311c0ff562a3c59334a15ddc4f1bf9

SHA256
da96949ba6b0567343f144486505c8c8fa1d892fd88c9cbc3ef3d751a570724d

SHA512
cd9dfc88dc2af9438b7d6b618d1b62029b3bdf739fc4daa5b37397afd12c4528561b3bf2fc3f3f2adf3fd1f582d5524332441fd30248fcd078e41aa91e17cb73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7ISB2KAC\OM5ATRI4.htm
MD5
b1cd7c031debba3a5c77b39b6791c1a7

SHA1
e5d91e14e9c685b06f00e550d9e189deb2075f76

SHA256
57ba053f075e0b80f747f3102ed985687c16a8754d109e7c4d33633269a36aaa

SHA512
d2bbefdc1effb52a38964c4cec5990a5a226248eca36f99e446c0c5704436f666bf1cb514e73b8991411d497d3325ecc646cbd5065c364e92ab6b9c5f1ad4a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\~temp001.bat
MD5
ef572e2c7b1bbd57654b36e8dcfdc37a

SHA1
b84c4db6d0dfd415c289d0c8ae099aea4001e3b7

SHA256
e6e609db3f387f42bfd16dd9e5695ddc2b73d86ae12baf4f0dfc4edda4a96a64

SHA512
b8c014b242e8e8f42da37b75fe96c52cd25ebd366d0b5103bcba5ac041806d13142a62351edecdee583d494d2a120f9b330f6229b1b5fe820e1c7d98981089e9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
MD5
4301b4d1cb937816ffe288401d8938bf

SHA1
14126bcc7b1a7ec96114fb28a74c6a4d7e008246

SHA256
1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070

SHA512
82b0ebf62016f0b578384858b4d88fa97c70022a6e5e67871d93da5de2777553f949d40e6968ab9755cec4b48c8e40bdbc2ef4a1bd7a2db3ce52070e12b292bd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
MD5
4301b4d1cb937816ffe288401d8938bf

SHA1
14126bcc7b1a7ec96114fb28a74c6a4d7e008246

SHA256
1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070

SHA512
82b0ebf62016f0b578384858b4d88fa97c70022a6e5e67871d93da5de2777553f949d40e6968ab9755cec4b48c8e40bdbc2ef4a1bd7a2db3ce52070e12b292bd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
MD5
4301b4d1cb937816ffe288401d8938bf

SHA1
14126bcc7b1a7ec96114fb28a74c6a4d7e008246

SHA256
1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070

SHA512
82b0ebf62016f0b578384858b4d88fa97c70022a6e5e67871d93da5de2777553f949d40e6968ab9755cec4b48c8e40bdbc2ef4a1bd7a2db3ce52070e12b292bd

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
MD5
4301b4d1cb937816ffe288401d8938bf

SHA1
14126bcc7b1a7ec96114fb28a74c6a4d7e008246

SHA256
1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070

SHA512
82b0ebf62016f0b578384858b4d88fa97c70022a6e5e67871d93da5de2777553f949d40e6968ab9755cec4b48c8e40bdbc2ef4a1bd7a2db3ce52070e12b292bd

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
MD5
4301b4d1cb937816ffe288401d8938bf

SHA1
14126bcc7b1a7ec96114fb28a74c6a4d7e008246

SHA256
1016366f5a33b98470c591bda8b65c421c2bfc690aa9fd51d8049abd605c0070

SHA512
82b0ebf62016f0b578384858b4d88fa97c70022a6e5e67871d93da5de2777553f949d40e6968ab9755cec4b48c8e40bdbc2ef4a1bd7a2db3ce52070e12b292bd

Download Submit
memory/628-29-0x0000000000000000-mapping.dmp

Download
memory/744-5-0x0000000000000000-mapping.dmp

Download
memory/860-22-0x0000000000000000-mapping.dmp

Download
memory/864-31-0x0000000000000000-mapping.dmp

Download
memory/920-30-0x0000000000000000-mapping.dmp

Download
memory/952-25-0x0000000000000000-mapping.dmp

Download
memory/964-21-0x0000000000000000-mapping.dmp

Download
memory/1020-20-0x0000000000000000-mapping.dmp

Download
memory/1088-9-0x0000000000000000-mapping.dmp

Download
memory/1088-7-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/1172-23-0x0000000000000000-mapping.dmp

Download
memory/1296-28-0x0000000000000000-mapping.dmp

Download
memory/1520-2-0x000007FEF7120000-0x000007FEF739A000-memory.dmp

Filesize
2.5MB

Download
memory/1608-18-0x0000000000000000-mapping.dmp

Download
memory/1712-19-0x0000000000000000-mapping.dmp

Download