buran | 4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a

Analysis

max time kernel
139s
max time network
131s
platform
windows7_x64
resource
win7v20201028
submitted
29-12-2020 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe
Size

214KB
MD5

b130cfd3d346bd719bd1e38f051768d2
SHA1

de29701a3f0d6c24a6e10717e35379ed702db868
SHA256

4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a
SHA512

33811ddb6ff9715e337bcbb0923b23cdc0e8ee8dca1cb7d85a175e5d40e7deb3c23fbe0010b829b8289de86268440e6806ee5df06447c8102707c84e8389222e

Score

10^/10

buran persistence ransomware

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: kevin.2021@yandex.com and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: kevin.2021@yandex.com Reserved email: maarten.2021@yandex.com Your personal ID: EEE-774-9F0 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

kevin.2021@yandex.com

maarten.2021@yandex.com

Signatures

Buran
Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
ransomware buran
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Executes dropped EXE 2 IoCs

Processes:

taskeng.exetaskeng.exe

pid process

1348 taskeng.exe
1888 taskeng.exe
Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

864 notepad.exe

pid	process
864	notepad.exe

Loads dropped DLL 2 IoCs

Processes:

4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe

pid	process
784	4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe
784	4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run	4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskeng.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\taskeng.exe\" -start"	4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskeng.exe

description	ioc	process
File opened (read-only)	\??\V:	taskeng.exe
File opened (read-only)	\??\P:	taskeng.exe
File opened (read-only)	\??\M:	taskeng.exe
File opened (read-only)	\??\J:	taskeng.exe
File opened (read-only)	\??\H:	taskeng.exe
File opened (read-only)	\??\F:	taskeng.exe
File opened (read-only)	\??\W:	taskeng.exe
File opened (read-only)	\??\T:	taskeng.exe
File opened (read-only)	\??\S:	taskeng.exe
File opened (read-only)	\??\K:	taskeng.exe
File opened (read-only)	\??\I:	taskeng.exe
File opened (read-only)	\??\E:	taskeng.exe
File opened (read-only)	\??\B:	taskeng.exe
File opened (read-only)	\??\A:	taskeng.exe
File opened (read-only)	\??\Z:	taskeng.exe
File opened (read-only)	\??\Y:	taskeng.exe
File opened (read-only)	\??\X:	taskeng.exe
File opened (read-only)	\??\U:	taskeng.exe
File opened (read-only)	\??\R:	taskeng.exe
File opened (read-only)	\??\Q:	taskeng.exe
File opened (read-only)	\??\O:	taskeng.exe
File opened (read-only)	\??\N:	taskeng.exe
File opened (read-only)	\??\L:	taskeng.exe
File opened (read-only)	\??\G:	taskeng.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 geoiptool.com

flow	ioc
5	geoiptool.com

Drops file in Program Files directory 15096 IoCs

Processes:

taskeng.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01242_.WMF	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0297725.WMF	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105230.WMF	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0212685.WMF.EEE-774-9F0	taskeng.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Pitchbook.potx	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199483.WMF.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21327_.GIF	taskeng.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Panama	taskeng.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0227558.JPG.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03014_.GIF	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\List.accdt	taskeng.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\tools.jar	taskeng.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml	taskeng.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\VeriSignLogo.jpg	taskeng.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.zh_CN_5.5.0.165303.jar	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105244.WMF.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dili.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\MANIFEST.MF.EEE-774-9F0	taskeng.exe
File created	C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	taskeng.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WEBPAGE.DPV.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files\Java\jre7\lib\psfont.properties.ja	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Civic.thmx	taskeng.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	taskeng.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Bissau.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Brunei.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.zh_CN_5.5.0.165303.jar.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-templates.jar	taskeng.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	taskeng.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Opulent.thmx.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18205_.WMF.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGSIDEBR.XML	taskeng.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Havana.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00524_.WMF	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01123_.WMF	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0286034.WMF.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_VelvetRose.gif.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtobe.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02161_.WMF	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD_F_COL.HXK.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow.css	taskeng.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler.jar.EEE-774-9F0	taskeng.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	taskeng.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02062U.BMP.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files\Java\jre7\lib\meta-index	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\NEWS.XML.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png	taskeng.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jmx.jar.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml	taskeng.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties	taskeng.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-actions.xml	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195320.WMF.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00255_.WMF	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_ON.GIF.EEE-774-9F0	taskeng.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01237_.GIF.EEE-774-9F0	taskeng.exe

Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

1908 vssadmin.exe
432 vssadmin.exe

pid	process
1908	vssadmin.exe
432	vssadmin.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exetaskeng.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	taskeng.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	taskeng.exe

Suspicious behavior: EnumeratesProcesses 1098 IoCs

Processes:

taskeng.exe

pid	process
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe
1348	taskeng.exe

Suspicious use of AdjustPrivilegeToken 87 IoCs

Processes:

4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exeWMIC.exeWMIC.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	784	4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe
Token: SeDebugPrivilege	784	4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe
Token: SeIncreaseQuotaPrivilege	864	WMIC.exe
Token: SeSecurityPrivilege	864	WMIC.exe
Token: SeTakeOwnershipPrivilege	864	WMIC.exe
Token: SeLoadDriverPrivilege	864	WMIC.exe
Token: SeSystemProfilePrivilege	864	WMIC.exe
Token: SeSystemtimePrivilege	864	WMIC.exe
Token: SeProfSingleProcessPrivilege	864	WMIC.exe
Token: SeIncBasePriorityPrivilege	864	WMIC.exe
Token: SeCreatePagefilePrivilege	864	WMIC.exe
Token: SeBackupPrivilege	864	WMIC.exe
Token: SeIncreaseQuotaPrivilege	292	WMIC.exe
Token: SeRestorePrivilege	864	WMIC.exe
Token: SeSecurityPrivilege	292	WMIC.exe
Token: SeShutdownPrivilege	864	WMIC.exe
Token: SeDebugPrivilege	864	WMIC.exe
Token: SeTakeOwnershipPrivilege	292	WMIC.exe
Token: SeLoadDriverPrivilege	292	WMIC.exe
Token: SeSystemEnvironmentPrivilege	864	WMIC.exe
Token: SeSystemProfilePrivilege	292	WMIC.exe
Token: SeRemoteShutdownPrivilege	864	WMIC.exe
Token: SeSystemtimePrivilege	292	WMIC.exe
Token: SeProfSingleProcessPrivilege	292	WMIC.exe
Token: SeUndockPrivilege	864	WMIC.exe
Token: SeIncBasePriorityPrivilege	292	WMIC.exe
Token: SeManageVolumePrivilege	864	WMIC.exe
Token: SeCreatePagefilePrivilege	292	WMIC.exe
Token: 33	864	WMIC.exe
Token: SeBackupPrivilege	292	WMIC.exe
Token: 34	864	WMIC.exe
Token: SeRestorePrivilege	292	WMIC.exe
Token: SeShutdownPrivilege	292	WMIC.exe
Token: 35	864	WMIC.exe
Token: SeDebugPrivilege	292	WMIC.exe
Token: SeSystemEnvironmentPrivilege	292	WMIC.exe
Token: SeRemoteShutdownPrivilege	292	WMIC.exe
Token: SeUndockPrivilege	292	WMIC.exe
Token: SeManageVolumePrivilege	292	WMIC.exe
Token: 33	292	WMIC.exe
Token: 34	292	WMIC.exe
Token: 35	292	WMIC.exe
Token: SeBackupPrivilege	2032	vssvc.exe
Token: SeRestorePrivilege	2032	vssvc.exe
Token: SeAuditPrivilege	2032	vssvc.exe
Token: SeIncreaseQuotaPrivilege	864	WMIC.exe
Token: SeSecurityPrivilege	864	WMIC.exe
Token: SeTakeOwnershipPrivilege	864	WMIC.exe
Token: SeLoadDriverPrivilege	864	WMIC.exe
Token: SeSystemProfilePrivilege	864	WMIC.exe
Token: SeSystemtimePrivilege	864	WMIC.exe
Token: SeProfSingleProcessPrivilege	864	WMIC.exe
Token: SeIncBasePriorityPrivilege	864	WMIC.exe
Token: SeCreatePagefilePrivilege	864	WMIC.exe
Token: SeBackupPrivilege	864	WMIC.exe
Token: SeRestorePrivilege	864	WMIC.exe
Token: SeShutdownPrivilege	864	WMIC.exe
Token: SeDebugPrivilege	864	WMIC.exe
Token: SeSystemEnvironmentPrivilege	864	WMIC.exe
Token: SeRemoteShutdownPrivilege	864	WMIC.exe
Token: SeIncreaseQuotaPrivilege	292	WMIC.exe
Token: SeUndockPrivilege	864	WMIC.exe
Token: SeSecurityPrivilege	292	WMIC.exe
Token: SeManageVolumePrivilege	864	WMIC.exe

Suspicious use of WriteProcessMemory 62 IoCs

Processes:

4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exetaskeng.execmd.execmd.execmd.exe

description	pid	process	target process
PID 784 wrote to memory of 1348	784	4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe	taskeng.exe
PID 784 wrote to memory of 1348	784	4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe	taskeng.exe
PID 784 wrote to memory of 1348	784	4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe	taskeng.exe
PID 784 wrote to memory of 1348	784	4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe	taskeng.exe
PID 784 wrote to memory of 864	784	4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe	notepad.exe
PID 784 wrote to memory of 864	784	4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe	notepad.exe
PID 784 wrote to memory of 864	784	4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe	notepad.exe
PID 784 wrote to memory of 864	784	4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe	notepad.exe
PID 784 wrote to memory of 864	784	4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe	notepad.exe
PID 784 wrote to memory of 864	784	4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe	notepad.exe
PID 784 wrote to memory of 864	784	4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe	notepad.exe
PID 1348 wrote to memory of 1720	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 1720	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 1720	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 1720	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 1808	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 1808	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 1808	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 1808	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 572	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 572	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 572	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 572	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 616	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 616	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 616	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 616	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 1956	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 1956	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 1956	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 1956	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 1364	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 1364	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 1364	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 1364	1348	taskeng.exe	cmd.exe
PID 1348 wrote to memory of 1888	1348	taskeng.exe	taskeng.exe
PID 1348 wrote to memory of 1888	1348	taskeng.exe	taskeng.exe
PID 1348 wrote to memory of 1888	1348	taskeng.exe	taskeng.exe
PID 1348 wrote to memory of 1888	1348	taskeng.exe	taskeng.exe
PID 1364 wrote to memory of 292	1364	cmd.exe	WMIC.exe
PID 1364 wrote to memory of 292	1364	cmd.exe	WMIC.exe
PID 1364 wrote to memory of 292	1364	cmd.exe	WMIC.exe
PID 1364 wrote to memory of 292	1364	cmd.exe	WMIC.exe
PID 1956 wrote to memory of 1908	1956	cmd.exe	vssadmin.exe
PID 1956 wrote to memory of 1908	1956	cmd.exe	vssadmin.exe
PID 1956 wrote to memory of 1908	1956	cmd.exe	vssadmin.exe
PID 1956 wrote to memory of 1908	1956	cmd.exe	vssadmin.exe
PID 1720 wrote to memory of 864	1720	cmd.exe	WMIC.exe
PID 1720 wrote to memory of 864	1720	cmd.exe	WMIC.exe
PID 1720 wrote to memory of 864	1720	cmd.exe	WMIC.exe
PID 1720 wrote to memory of 864	1720	cmd.exe	WMIC.exe
PID 1364 wrote to memory of 432	1364	cmd.exe	vssadmin.exe
PID 1364 wrote to memory of 432	1364	cmd.exe	vssadmin.exe
PID 1364 wrote to memory of 432	1364	cmd.exe	vssadmin.exe
PID 1364 wrote to memory of 432	1364	cmd.exe	vssadmin.exe
PID 1348 wrote to memory of 872	1348	taskeng.exe	notepad.exe
PID 1348 wrote to memory of 872	1348	taskeng.exe	notepad.exe
PID 1348 wrote to memory of 872	1348	taskeng.exe	notepad.exe
PID 1348 wrote to memory of 872	1348	taskeng.exe	notepad.exe
PID 1348 wrote to memory of 872	1348	taskeng.exe	notepad.exe
PID 1348 wrote to memory of 872	1348	taskeng.exe	notepad.exe
PID 1348 wrote to memory of 872	1348	taskeng.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe
"C:\Users\Admin\AppData\Local\Temp\4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:784

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe" -start
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
3⤵
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:864

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
PID:572

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
3⤵
PID:1808

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
3⤵
PID:616

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
3⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:1908

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe" -agent 0
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1888

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
3⤵
- Suspicious use of WriteProcessMemory
PID:1364

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:292

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:432

C:\Windows\SysWOW64\notepad.exe
notepad.exe
3⤵
PID:872

C:\Windows\SysWOW64\notepad.exe
notepad.exe
2⤵
- Deletes itself
PID:864

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2032

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
MD5
61466c45ced4d83183fdb25396d4031c

SHA1
28a0f84a224cfddee721d7aa7cc5b54176358108

SHA256
1c3119bf6b52b905a989b256f6d40bf6d0150eb5485f5c416362a439e620e4f9

SHA512
152535df0af05a287d4435e702c9fc86195e61296e825b9bd67311054524bbeeb898aa4b23393c5af5d4f5fa2471fbe56b3d85964036d22b5ba751c8b3423e9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
MD5
21ef137d48d04fc9be98c2674223aa7d

SHA1
2c596c1c53112a535400e16fe124987aa665055c

SHA256
d265ed9b6513b4a1bc4b7b26f3f59b1ed4d0cf1aeb37bc0d38ec91b4658cc0e0

SHA512
f95cf62b52edf668adf1779d07bde1c68c29b848ec713270111b3fa2bc01edbdbbc5cfc958229c6e92567f4196285e935a2f922bbdcac80f9103ba15e832491a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
9d7369bfa72ae89d1d752ba17df6c22e

SHA1
ec6dad338b059d7bffbf47f84cf3c638226a0d82

SHA256
8ba91b47832e7c92ce4aec0255ae6511d12f7f92201d8d1db21d37f81a190030

SHA512
3cc58981fdaffa95022fbf13d7b0535ef0d1700fffda235a46902f9b9d9ac83458d8444aedae99b8392ee62d0151eea5f67d991bf538aa0919fcd5b6f7ae41f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
MD5
ef3c41e740573a0f1708aa1009df9779

SHA1
99a65e4f736763dd5a0169884beb5ebd5afa10fc

SHA256
8e3c5e053fafb7cfc4d5ad740775da8f3171418bc2ccdb71d9c0f34e2566420c

SHA512
449b9d72ef9d8b068d86d3a1e8fa6d42ca7d6b94a1da6b8b8a3ce83ecdd999acb9418e021d1d3abf724417c10f61ff83dbc0a95d5f59ed88292363d7e0a37a48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
MD5
33ba62a40740226109800fad7440a9fc

SHA1
f86c06b785bddafacd5a1e5128c7709414695579

SHA256
93a4517687bcacd133b49d50abc300423d9a32346183a22aa69dfeafccb77cd0

SHA512
c5f1a0a6e8dc1ece85ec9940c788f0c4b1cc14b8d30ba46155ca8b14753bf8686bdb85c164f10bcc64f2d78bcdcc20ce8bd1f4a7cda3eb4c0ab00a660582a788

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
b793241c272bfd7266e3b182c44dce4e

SHA1
01e0c5290f99efea9b4e4a6bf39d8479aadedbc1

SHA256
4ff4514071487e040633465b05edff18cac13cc3064732d38635eadbd7551b50

SHA512
5fb85ac7717ef2833aacfbc01125eab826ebc6448daf3f047bdc6d54017125f27ce0f38c29acc42abd2c69e162299048784ee84779044d4cdf8b7192967b7242

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
13f3216fd0d7ad2982d5010b567e3619

SHA1
30468940a775d3782c0bc33143fc4294e3f8fc4f

SHA256
e907b4ebc75f812cb3a2707b5d51a9a17bb094c3f8623cdb782e98fac54d9658

SHA512
b719472cd3b6a34b19bc8822b6eb74093f5cd2e1c1fb15ecc6736661a572111c6e14fe556c83fc9f2d4949be39593c2781701cd14cfd9d3e2f4ff55ea2285c27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D73194RS\N4YZI620.htm
MD5
b1cd7c031debba3a5c77b39b6791c1a7

SHA1
e5d91e14e9c685b06f00e550d9e189deb2075f76

SHA256
57ba053f075e0b80f747f3102ed985687c16a8754d109e7c4d33633269a36aaa

SHA512
d2bbefdc1effb52a38964c4cec5990a5a226248eca36f99e446c0c5704436f666bf1cb514e73b8991411d497d3325ecc646cbd5065c364e92ab6b9c5f1ad4a72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\O1R1CL99\6JCSQ10M.htm
MD5
6b17a59cec1a7783febae9aa55c56556

SHA1
01d4581e2b3a6348679147a915a0b22b2a66643a

SHA256
66987b14b90d41632be98836f9601b12e7f329ffab05595887889c9c5716fbeb

SHA512
3337efd12b9c06b7768eb928a78caae243b75257c5aabe7a49e908a2f735af55f7257a40bd2330dc13865ead18ed805b54a6c5105740fdcbbaccacf7997bcbc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\~temp001.bat
MD5
ef572e2c7b1bbd57654b36e8dcfdc37a

SHA1
b84c4db6d0dfd415c289d0c8ae099aea4001e3b7

SHA256
e6e609db3f387f42bfd16dd9e5695ddc2b73d86ae12baf4f0dfc4edda4a96a64

SHA512
b8c014b242e8e8f42da37b75fe96c52cd25ebd366d0b5103bcba5ac041806d13142a62351edecdee583d494d2a120f9b330f6229b1b5fe820e1c7d98981089e9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe
MD5
b130cfd3d346bd719bd1e38f051768d2

SHA1
de29701a3f0d6c24a6e10717e35379ed702db868

SHA256
4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a

SHA512
33811ddb6ff9715e337bcbb0923b23cdc0e8ee8dca1cb7d85a175e5d40e7deb3c23fbe0010b829b8289de86268440e6806ee5df06447c8102707c84e8389222e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe
MD5
b130cfd3d346bd719bd1e38f051768d2

SHA1
de29701a3f0d6c24a6e10717e35379ed702db868

SHA256
4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a

SHA512
33811ddb6ff9715e337bcbb0923b23cdc0e8ee8dca1cb7d85a175e5d40e7deb3c23fbe0010b829b8289de86268440e6806ee5df06447c8102707c84e8389222e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe
MD5
b130cfd3d346bd719bd1e38f051768d2

SHA1
de29701a3f0d6c24a6e10717e35379ed702db868

SHA256
4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a

SHA512
33811ddb6ff9715e337bcbb0923b23cdc0e8ee8dca1cb7d85a175e5d40e7deb3c23fbe0010b829b8289de86268440e6806ee5df06447c8102707c84e8389222e

Download Submit
C:\Users\Admin\Desktop\DisconnectGrant.mpg.EEE-774-9F0
MD5
ec559f47352296d68aeade0d2cb3a97d

SHA1
706c6bfcbd2e2da325d86f3d4c1926e8a5247559

SHA256
05c2c6f81833e6000ca12c6d4b35beb2a6128b8f5ea6797755e08768721c6099

SHA512
0a423079a4ca0b653c6c5f56a3821c49393b22ec848d8db2d2cba698e94a36216601eeda6da55ad9799b042411eec26e8f25f60e2797eb0587feb84f2f428cac

Download Submit
C:\Users\Admin\Desktop\ExitExport.ram.EEE-774-9F0
MD5
246bbc19d586787925b8633aa954ff95

SHA1
1531b8872714199088b3272554f15675e9a38659

SHA256
76c039b90364859c70d1b0d52dc0e806162ea4b31b0121ff6bb2a52b0e316737

SHA512
f0c745f15cb2dadf8f049b0abc9bb3289cc3584c1c797165e37b2ddae60c54594354fab7a8563241a2ec7d1cd0aa2378111cc8fddecf4a0c3057ecce5e1ae0d3

Download Submit
C:\Users\Admin\Desktop\ExpandUpdate.ini.EEE-774-9F0
MD5
7a209b7f3bf2eba11cc8fcfbd1da8fcc

SHA1
08d628800bdab534af4f1a0eb9b2a6ec685da21f

SHA256
13b99eaf15f6a621d3a3398c77b3360a25109a1b99933939b2323abf9b393866

SHA512
7965407d33613c7d737f6a7721e9f8e94620142a77600305cec048792438db231de03f22aedf0d20b05eec6e0c081d7ba5eff07e5f48a37c65d42b7337755f34

Download Submit
C:\Users\Admin\Desktop\NewLock.mov.EEE-774-9F0
MD5
6032a0bbab2ba0757c94d30772097bc6

SHA1
e92a07bcd9c93a7dba99659b25ee1daaa7d30a06

SHA256
4bae199fac01f5661892b261133cc35df2a6bce2af5768ae3c175a1327fb8fe6

SHA512
5cfb49a5727ea010a2cd79b944ec70fd50c28fc1f12c5ebed761df7ea3afbf6ba769a0c1a585f5f9d5ebf5d177627fe364f1d3adcb4bcf9824c99dafe7af6b66

Download Submit
C:\Users\Admin\Desktop\OpenRevoke.dib.EEE-774-9F0
MD5
fc12a413621ec74227e2494bfdf1418a

SHA1
93568a2b8c343b8b1cd2baffc03f14dd9f1888bc

SHA256
cbea2f53a59ca22241b3670b184a7a172f36bdbcc94f21269d4bba84aa649c6b

SHA512
14b7de1b63a3fda66e4b0832dfc20f8a791da18fa5e56258bd0c5292308a10ec1fc09c5572e5ebfd678726d60784ad4e84b7ea1016bce2ea76695cc161ca230b

Download Submit
C:\Users\Admin\Desktop\OpenTest.pdf.EEE-774-9F0
MD5
a663ca167c8a4b940753f7eba68a1ba2

SHA1
b6dd80aa160a5c3abee1f63a35eda6128e3f5dda

SHA256
f8e6de7fd3cab274fa3c07826e2972fc010d25b82c5fabbb105a4d22ddb153ee

SHA512
e761df0b2da7a728185470eec0c2a40a1f24baf52a0b53299598736674c98266bd6c3cb554d8f755864be257606ecc1088a9de89c53cf9e1a4e0f6b8a6089208

Download Submit
C:\Users\Admin\Desktop\ReceiveComplete.vdw.EEE-774-9F0
MD5
68c2bff2066c5863f480fd7c6b655b98

SHA1
ecfebe328cf085ba4e6617869a33ec4542b5e734

SHA256
45b537c3d0a14f4951d837ac7f1a39a6550364eb1a064d8931a14120167ab9a7

SHA512
af8856d04aec23ac43948408ae8d056e19d97018a9455db63d60c42b1d959bd4b2d5d5d2cae3282d35132657b119af50e48e71dbb7e8a686007f5c863547fbeb

Download Submit
C:\Users\Admin\Desktop\ReceiveConvertFrom.reg.EEE-774-9F0
MD5
2fa5d04290649b7795882c8853b97bf3

SHA1
5d1b689ac0fad1006f244e3a413720410b8928da

SHA256
ee223c573398906145e69ce837175125cff4012775a4856b431ad9097b2db614

SHA512
c8a3403e58d7df58e29dadbea7eec7a1803ddf5d10572bccce2df03ec30d62e3cfa2c54935d098d1110739e41c485583a9cf25e0b0e4e705c0a52d2d569abb31

Download Submit
C:\Users\Admin\Desktop\RegisterGrant.cab.EEE-774-9F0
MD5
fb0d07de5fef1e36dce28776ceeb4267

SHA1
e185afa53698c12c9e17b590c3073d708d4aabe4

SHA256
cc1594c7a26f33701f18954efc392f4e7314a4309ebfac512322f7466d46b599

SHA512
89e62e0f9ad9a4573f916290404a49477f173859cbe0b79a1c77a3b6c9aef872eb045e7c13f1d177dc89648cfe2a505023b25f788169b10f6836bb5ea4a5ceab

Download Submit
C:\Users\Admin\Desktop\RemoveRequest.potm.EEE-774-9F0
MD5
3a04739d5e8abf445eed7b3b7d6c119d

SHA1
b3ed979b24a12aed6ec8ff34d2b1c4099fa60478

SHA256
7e8689eac66529f4c31616bc6a96c6ddb02a641596e3d1cc89bd0342e488c989

SHA512
4d8bca78bd920a775c2bebd22770a5f3b256a4226d99af40a26ef1ff76ee169cb796754416bacc5ad81931f68fbca3526b08bb4754c8d188a1e913fba1d9924c

Download Submit
C:\Users\Admin\Desktop\RequestSkip.htm.EEE-774-9F0
MD5
d57d923fe93b2bc47aee44c40b77f80e

SHA1
33a3b916d823c27f087acdefc92b5913142ff58e

SHA256
8a6b677b04f987b7dad4e11cb779ca4dc8a28340f29272a2c807b17267e142a7

SHA512
a70280c188b3f3bfd498187e9cf70fd8df8ba93f7b912ee9d28e4d6f7bf53e3198648c90c7703ced0daff751efdd2902a20ace8998c832a47ef6f0bde2352ed6

Download Submit
C:\Users\Admin\Desktop\ResetUnpublish.vssm.EEE-774-9F0
MD5
6b655c3ad9299319c25e9d68b1a6447d

SHA1
68a550d546f334f21c5602a9fc6e1acf4431efa4

SHA256
1d9b2500a58e5ec93a3f3f28ef23a88e02b3c9f42d61d7758b21ea5f59a57cff

SHA512
f0de75552e855cf7bb0e67f25f7fce1dc33659c884642162b531d5abed673fb66ad022c34c174f574745a7fe2c5ef824a440c752c3d2f027ff0892f51b730590

Download Submit
C:\Users\Admin\Desktop\RestartGrant.xls.EEE-774-9F0
MD5
2bac52ae57c4572c57800bf2d5e37248

SHA1
70e22e59e9e74672becbae5859aedaaebb416a6c

SHA256
f3b1af63dbc7659090aab055c45b983a33e28966069cf486448789e138e86947

SHA512
472149d67d560f7995cc5ecb1aa7668b1454992be5c1adff2191e15333bfb1ab754178788833488bd741938dd69a9e197911ca9edc8caef07fc9c17bb6a7d234

Download Submit
C:\Users\Admin\Desktop\ResumeInstall.m4a.EEE-774-9F0
MD5
abf6eb642392c7184a801cf26da328f8

SHA1
68a2e14c8ebe0fc2df30c32b36ce61ca98bdf58d

SHA256
df27946a02394069c003de3d3249230d5e38f22c2cda22cde770531ef536c805

SHA512
06a27734b89666f954d5edb51f404233469b791bbd3553bca8fe2be24735f8fa7a4082f6f707a0d22e0ce7f303d8052b3c5272f79ce0c17cdc3467d048c14daa

Download Submit
C:\Users\Admin\Desktop\SaveMove.3gpp.EEE-774-9F0
MD5
b96f0fbc724e4f8a6109c35b4f9bee3d

SHA1
2c1e583e617130b91d067f92cf09e11668f9af26

SHA256
67a70466371fc125d54130847bc1384b5e5ff035afe22b79dfdf50a4195f11b9

SHA512
19098de024f5a73c2622156cdb2c1a50fa64725fcb4b4ec41e29975dc87294c06c16c0d733494265d61e41e562f00b9cb09f0eadf785f2a44b7526289c4cc819

Download Submit
C:\Users\Admin\Desktop\SendStep.mht.EEE-774-9F0
MD5
333268078ac344722cb46fd8a1746008

SHA1
748dff625706de9bbe07d681718754e77aa3042d

SHA256
cc721c402f594219f32156afde25d59d741db86d47849ee537542a333b0742f6

SHA512
d4b6b6517c3c5749c4b46428859e86b1aa583a7d2febfdb846481f5d6b5a0c14c17629e54bc5c4190fc50a76c4f663bb17c207f8f08d928a92d103ca31012229

Download Submit
C:\Users\Admin\Desktop\StartClose.mp2v.EEE-774-9F0
MD5
b23c002564f03bc7c2d04308b6e9d850

SHA1
53b87e7cda056ae3ad9e026a6977960676d04b06

SHA256
68b429b6725dd8936c235bf6c279021c03b48378e400a08546fe37f51abc1b3c

SHA512
4c84e86eec131b59b6fbfe9cb19df4ef91a2bc177c9b3620f26216e4cafdeacce7a861f64dbf416654459f5835e9c3e10c0bb18c07d50bf50d0d4fe0efe309f8

Download Submit
C:\Users\Admin\Desktop\StopLimit.doc.EEE-774-9F0
MD5
843f9c3c8af7efd12207e9b1da18ee5f

SHA1
ba12f546dc2c5d6aa2d2d764547b243799f24c69

SHA256
08bbf0aaac55c383cb630923e19f5c5b1b7d0a050bd7542672320c75e8955ef0

SHA512
7ec7178776a34afee76242533d7d1daede0145d0ca829dc5bbb92aafa4b074b511af18612a685d78e03d53030605660e4f1030f3048f29f0b815b139881034c0

Download Submit
C:\Users\Admin\Desktop\UninstallSet.vsdx.EEE-774-9F0
MD5
6de47939916e84f0aca5691d763007c4

SHA1
0a09b6ae85ebe002f03e58dbdf80238fdf2d7266

SHA256
b63103ca5d1ef5b1075e4cb519163377afc3e5ac4a825472430fd917020a0556

SHA512
d34a6493ffe5b785d76c02b7038e61399b0d78528c1f91073103f6eb3c4e03fb65610289ab74d117d28e8fddb2f1ebdae3d9939e6316cd892f804300efdf1a65

Download Submit
C:\Users\Admin\Desktop\UnlockRevoke.asf.EEE-774-9F0
MD5
a758c7a54d6bf89997a9ee145714b241

SHA1
5a1e11badb7c073164c6d55fbee8d352bd294c13

SHA256
7eed5e113f1f5e9a41b7a3b015ea002a0057cce9e927ed2ed4a161b74c5d90f4

SHA512
dde48bdf711230ff6c6fe125f5a7c616c0dc1ec92f5a0be969947bd1f08ba9429472168134919b6ab98a5eaa4e35ceedaee45b5ce378a456ad85386b6e1c3414

Download Submit
C:\Users\Admin\Desktop\UsePush.3g2.EEE-774-9F0
MD5
757cd8729522845c2be0ef59770ecda5

SHA1
f8436a9cbae0373228872871046f551ed011b47a

SHA256
c85981713eb1d8200918389f4648263bf487423a431fca000ed4cbe00ddf8431

SHA512
b660319e5e196d78df9d6cf2dff2df8fabfb989cb9442dbb414d9e780a0cd34bbcfc776a532d2ef7d18a5215c3cc7b3b4b9b8847548c3f4d16a9a83980aae7d2

Download Submit
C:\Users\Admin\Desktop\UseResize.m4v.EEE-774-9F0
MD5
eb14a977839deeca18b9731b9ca7da71

SHA1
14ce34ed082b3dee1c12d98f98212a190ed234be

SHA256
b5b3740430b96e4138b3476f4fbb094786d9294a42f16598e45d36b6f555cb11

SHA512
0793d19025e5548f5d701e86fdea8686e73e6ba46752a8cb204a885480aaa6501a1ac9b8025d85881bae31f8fbf9f18f209bb05815a18ad92190b01df4005c20

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe
MD5
b130cfd3d346bd719bd1e38f051768d2

SHA1
de29701a3f0d6c24a6e10717e35379ed702db868

SHA256
4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a

SHA512
33811ddb6ff9715e337bcbb0923b23cdc0e8ee8dca1cb7d85a175e5d40e7deb3c23fbe0010b829b8289de86268440e6806ee5df06447c8102707c84e8389222e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe
MD5
b130cfd3d346bd719bd1e38f051768d2

SHA1
de29701a3f0d6c24a6e10717e35379ed702db868

SHA256
4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a

SHA512
33811ddb6ff9715e337bcbb0923b23cdc0e8ee8dca1cb7d85a175e5d40e7deb3c23fbe0010b829b8289de86268440e6806ee5df06447c8102707c84e8389222e

Download Submit
memory/292-28-0x0000000000000000-mapping.dmp

Download
memory/432-31-0x0000000000000000-mapping.dmp

Download
memory/572-20-0x0000000000000000-mapping.dmp

Download
memory/616-21-0x0000000000000000-mapping.dmp

Download
memory/848-2-0x000007FEF6B80000-0x000007FEF6DFA000-memory.dmp

Filesize
2.5MB

Download
memory/864-8-0x0000000000000000-mapping.dmp

Download
memory/864-7-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/864-30-0x0000000000000000-mapping.dmp

Download
memory/872-55-0x0000000000000000-mapping.dmp

Download
memory/872-54-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/1348-5-0x0000000000000000-mapping.dmp

Download
memory/1364-23-0x0000000000000000-mapping.dmp

Download
memory/1720-18-0x0000000000000000-mapping.dmp

Download
memory/1808-19-0x0000000000000000-mapping.dmp

Download
memory/1888-25-0x0000000000000000-mapping.dmp

Download
memory/1908-29-0x0000000000000000-mapping.dmp

Download
memory/1956-22-0x0000000000000000-mapping.dmp

Download