buran | 63067c7050bab69e0903ed3887710e4fa50d30d5865c765941df579ddb9b4ab3

Analysis

max time kernel
149s
max time network
130s
platform
windows10_x64
resource
win10v20201028
submitted
02-04-2021 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.Encoder.33750.22954.16449.exe
Size

216KB
MD5

75c1ff39aac846286257e7186dc0096e
SHA1

2e953e5958353e2590fd14300a492a786d6930d5
SHA256

63067c7050bab69e0903ed3887710e4fa50d30d5865c765941df579ddb9b4ab3
SHA512

ac3875fc6eb8721c020365522e70f3e94464dc63fd7ba20d10c0c6baae41ab3d403c68d0a6785ee6b571d28647470548b79e07c13e19f69d207944f5581f16d8

Score

10^/10

buran persistence ransomware

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: kokolozombisam@gmail.com and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: kokolozombisam@gmail.com Telegraml: @Karla404 Your personal ID: 2D0-876-029 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

kokolozombisam@gmail.com

Signatures

Buran
Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
ransomware buran
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Executes dropped EXE 2 IoCs

Processes:

TrustedInstaller.exeTrustedInstaller.exe

pid process

3180 TrustedInstaller.exe
1512 TrustedInstaller.exe
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
ransomware

Processes:

TrustedInstaller.exe

description ioc process

File opened for modification C:\Users\Admin\Pictures\EnterApprove.tiff TrustedInstaller.exe
Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

3268 notepad.exe

pid	process
3180	TrustedInstaller.exe
1512	TrustedInstaller.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\EnterApprove.tiff	TrustedInstaller.exe

pid	process
3268	notepad.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

SecuriteInfo.com.Trojan.Encoder.33750.22954.16449.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run	SecuriteInfo.com.Trojan.Encoder.33750.22954.16449.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\TrustedInstaller.exe\" -start"	SecuriteInfo.com.Trojan.Encoder.33750.22954.16449.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

TrustedInstaller.exe

description	ioc	process
File opened (read-only)	\??\M:	TrustedInstaller.exe
File opened (read-only)	\??\J:	TrustedInstaller.exe
File opened (read-only)	\??\B:	TrustedInstaller.exe
File opened (read-only)	\??\Z:	TrustedInstaller.exe
File opened (read-only)	\??\X:	TrustedInstaller.exe
File opened (read-only)	\??\Q:	TrustedInstaller.exe
File opened (read-only)	\??\H:	TrustedInstaller.exe
File opened (read-only)	\??\F:	TrustedInstaller.exe
File opened (read-only)	\??\Y:	TrustedInstaller.exe
File opened (read-only)	\??\T:	TrustedInstaller.exe
File opened (read-only)	\??\I:	TrustedInstaller.exe
File opened (read-only)	\??\W:	TrustedInstaller.exe
File opened (read-only)	\??\G:	TrustedInstaller.exe
File opened (read-only)	\??\E:	TrustedInstaller.exe
File opened (read-only)	\??\R:	TrustedInstaller.exe
File opened (read-only)	\??\P:	TrustedInstaller.exe
File opened (read-only)	\??\O:	TrustedInstaller.exe
File opened (read-only)	\??\N:	TrustedInstaller.exe
File opened (read-only)	\??\L:	TrustedInstaller.exe
File opened (read-only)	\??\V:	TrustedInstaller.exe
File opened (read-only)	\??\U:	TrustedInstaller.exe
File opened (read-only)	\??\S:	TrustedInstaller.exe
File opened (read-only)	\??\K:	TrustedInstaller.exe
File opened (read-only)	\??\A:	TrustedInstaller.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 geoiptool.com

flow	ioc
5	geoiptool.com

Drops file in Program Files directory 64 IoCs

Processes:

TrustedInstaller.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms.@Karla404.2D0-876-029	TrustedInstaller.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\osm.x-none.msi.16.x-none.boot.tree.dat	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-36_altform-unplated_contrast-white.png	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-60_contrast-black.png	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_delete@1x.png	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\selector.js	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar.@Karla404.2D0-876-029	TrustedInstaller.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\surprised.png	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\ui-strings.js.@Karla404.2D0-876-029	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\cs-cz\ui-strings.js	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.swt.nl_ja_4.4.0.v20140623020002.jar.@Karla404.2D0-876-029	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.Xaml.Toolkit\Assets\Buttons\Menu\Menu-press.png	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-48_altform-unplated.png	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-200.png	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-96.png	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Protect_R_RHP.aapp.@Karla404.2D0-876-029	TrustedInstaller.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\tr-tr\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	TrustedInstaller.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-cn\ui-strings.js.@Karla404.2D0-876-029	TrustedInstaller.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL104.XML.@Karla404.2D0-876-029	TrustedInstaller.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\RedAndBlackLetter.dotx.@Karla404.2D0-876-029	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\contrast-black\iheart-radio.scale-200_contrast-black.png	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailSmallTile.scale-200.png	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_scale-100.png	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_altform-unplated_contrast-white.png	TrustedInstaller.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe.@Karla404.2D0-876-029	TrustedInstaller.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms	TrustedInstaller.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.@Karla404.2D0-876-029	TrustedInstaller.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe\Assets\contrast-white\iheart-radio.scale-150_contrast-white.png	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\cs_get.svg	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-up-pressed.gif	TrustedInstaller.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-140.png.@Karla404.2D0-876-029	TrustedInstaller.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\PIXEL.ELM.@Karla404.2D0-876-029	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\Particles\fireworks.respack	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Classic\mask\1s.png	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.scale-200.png	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\WindowsPhoneReservedAppInfo.xml	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter-hover_32.svg.@Karla404.2D0-876-029	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\pmd.cer	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyoptionaltools.jar	TrustedInstaller.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Square150x150Logo.scale-125.png	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteSectionWideTile.scale-150.png	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleSplashScreen.scale-125.png	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailMediumTile.scale-400.png	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe\resources.pri	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\files_icons.png	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\check-mark-2x.png	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\css\main.css	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-snaptracer.xml.@Karla404.2D0-876-029	TrustedInstaller.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms.@Karla404.2D0-876-029	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe\Assets\Office\ProjectionPlanar.scale-140.png	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageBadgeLogo.scale-125.png	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-40.png	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Redact_R_RHP.aapp	TrustedInstaller.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml	TrustedInstaller.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\makeup.png	TrustedInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\GenericMailLargeTile.scale-400.png	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\adobepdf.xdc.@Karla404.2D0-876-029	TrustedInstaller.exe

Drops file in Windows directory 1 IoCs

Processes:

TrustedInstaller.exe

description ioc process

File created C:\Windows\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT TrustedInstaller.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2548 3180 WerFault.exe TrustedInstaller.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2384 vssadmin.exe

description	ioc	process
File created	C:\Windows\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	TrustedInstaller.exe

pid	pid_target	process	target process
2548	3180	WerFault.exe	TrustedInstaller.exe

pid	process
2384	vssadmin.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

SecuriteInfo.com.Trojan.Encoder.33750.22954.16449.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	SecuriteInfo.com.Trojan.Encoder.33750.22954.16449.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	SecuriteInfo.com.Trojan.Encoder.33750.22954.16449.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2548	WerFault.exe
2548	WerFault.exe
2548	WerFault.exe
2548	WerFault.exe
2548	WerFault.exe
2548	WerFault.exe
2548	WerFault.exe
2548	WerFault.exe
2548	WerFault.exe
2548	WerFault.exe
2548	WerFault.exe
2548	WerFault.exe
2548	WerFault.exe
2548	WerFault.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

Processes:

SecuriteInfo.com.Trojan.Encoder.33750.22954.16449.exeWMIC.exevssvc.exeTrustedInstaller.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	4764	SecuriteInfo.com.Trojan.Encoder.33750.22954.16449.exe
Token: SeDebugPrivilege	4764	SecuriteInfo.com.Trojan.Encoder.33750.22954.16449.exe
Token: SeIncreaseQuotaPrivilege	2268	WMIC.exe
Token: SeSecurityPrivilege	2268	WMIC.exe
Token: SeTakeOwnershipPrivilege	2268	WMIC.exe
Token: SeLoadDriverPrivilege	2268	WMIC.exe
Token: SeSystemProfilePrivilege	2268	WMIC.exe
Token: SeSystemtimePrivilege	2268	WMIC.exe
Token: SeProfSingleProcessPrivilege	2268	WMIC.exe
Token: SeIncBasePriorityPrivilege	2268	WMIC.exe
Token: SeCreatePagefilePrivilege	2268	WMIC.exe
Token: SeBackupPrivilege	2268	WMIC.exe
Token: SeRestorePrivilege	2268	WMIC.exe
Token: SeShutdownPrivilege	2268	WMIC.exe
Token: SeDebugPrivilege	2268	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2268	WMIC.exe
Token: SeRemoteShutdownPrivilege	2268	WMIC.exe
Token: SeUndockPrivilege	2268	WMIC.exe
Token: SeManageVolumePrivilege	2268	WMIC.exe
Token: 33	2268	WMIC.exe
Token: 34	2268	WMIC.exe
Token: 35	2268	WMIC.exe
Token: 36	2268	WMIC.exe
Token: SeBackupPrivilege	2568	vssvc.exe
Token: SeRestorePrivilege	2568	vssvc.exe
Token: SeAuditPrivilege	2568	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2268	WMIC.exe
Token: SeSecurityPrivilege	2268	WMIC.exe
Token: SeTakeOwnershipPrivilege	2268	WMIC.exe
Token: SeLoadDriverPrivilege	2268	WMIC.exe
Token: SeSystemProfilePrivilege	2268	WMIC.exe
Token: SeSystemtimePrivilege	2268	WMIC.exe
Token: SeProfSingleProcessPrivilege	2268	WMIC.exe
Token: SeIncBasePriorityPrivilege	2268	WMIC.exe
Token: SeCreatePagefilePrivilege	2268	WMIC.exe
Token: SeBackupPrivilege	2268	WMIC.exe
Token: SeRestorePrivilege	2268	WMIC.exe
Token: SeShutdownPrivilege	2268	WMIC.exe
Token: SeDebugPrivilege	2268	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2268	WMIC.exe
Token: SeRemoteShutdownPrivilege	2268	WMIC.exe
Token: SeUndockPrivilege	2268	WMIC.exe
Token: SeManageVolumePrivilege	2268	WMIC.exe
Token: 33	2268	WMIC.exe
Token: 34	2268	WMIC.exe
Token: 35	2268	WMIC.exe
Token: 36	2268	WMIC.exe
Token: SeDebugPrivilege	3180	TrustedInstaller.exe
Token: SeDebugPrivilege	3180	TrustedInstaller.exe
Token: SeRestorePrivilege	2548	WerFault.exe
Token: SeBackupPrivilege	2548	WerFault.exe
Token: SeDebugPrivilege	2548	WerFault.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

SecuriteInfo.com.Trojan.Encoder.33750.22954.16449.exeTrustedInstaller.execmd.execmd.exe

description	pid	process	target process
PID 4764 wrote to memory of 3180	4764	SecuriteInfo.com.Trojan.Encoder.33750.22954.16449.exe	TrustedInstaller.exe
PID 4764 wrote to memory of 3180	4764	SecuriteInfo.com.Trojan.Encoder.33750.22954.16449.exe	TrustedInstaller.exe
PID 4764 wrote to memory of 3180	4764	SecuriteInfo.com.Trojan.Encoder.33750.22954.16449.exe	TrustedInstaller.exe
PID 4764 wrote to memory of 3268	4764	SecuriteInfo.com.Trojan.Encoder.33750.22954.16449.exe	notepad.exe
PID 4764 wrote to memory of 3268	4764	SecuriteInfo.com.Trojan.Encoder.33750.22954.16449.exe	notepad.exe
PID 4764 wrote to memory of 3268	4764	SecuriteInfo.com.Trojan.Encoder.33750.22954.16449.exe	notepad.exe
PID 4764 wrote to memory of 3268	4764	SecuriteInfo.com.Trojan.Encoder.33750.22954.16449.exe	notepad.exe
PID 4764 wrote to memory of 3268	4764	SecuriteInfo.com.Trojan.Encoder.33750.22954.16449.exe	notepad.exe
PID 4764 wrote to memory of 3268	4764	SecuriteInfo.com.Trojan.Encoder.33750.22954.16449.exe	notepad.exe
PID 3180 wrote to memory of 372	3180	TrustedInstaller.exe	cmd.exe
PID 3180 wrote to memory of 372	3180	TrustedInstaller.exe	cmd.exe
PID 3180 wrote to memory of 372	3180	TrustedInstaller.exe	cmd.exe
PID 3180 wrote to memory of 696	3180	TrustedInstaller.exe	cmd.exe
PID 3180 wrote to memory of 696	3180	TrustedInstaller.exe	cmd.exe
PID 3180 wrote to memory of 696	3180	TrustedInstaller.exe	cmd.exe
PID 3180 wrote to memory of 1076	3180	TrustedInstaller.exe	cmd.exe
PID 3180 wrote to memory of 1076	3180	TrustedInstaller.exe	cmd.exe
PID 3180 wrote to memory of 1076	3180	TrustedInstaller.exe	cmd.exe
PID 3180 wrote to memory of 1252	3180	TrustedInstaller.exe	cmd.exe
PID 3180 wrote to memory of 1252	3180	TrustedInstaller.exe	cmd.exe
PID 3180 wrote to memory of 1252	3180	TrustedInstaller.exe	cmd.exe
PID 3180 wrote to memory of 1372	3180	TrustedInstaller.exe	cmd.exe
PID 3180 wrote to memory of 1372	3180	TrustedInstaller.exe	cmd.exe
PID 3180 wrote to memory of 1372	3180	TrustedInstaller.exe	cmd.exe
PID 3180 wrote to memory of 1512	3180	TrustedInstaller.exe	TrustedInstaller.exe
PID 3180 wrote to memory of 1512	3180	TrustedInstaller.exe	TrustedInstaller.exe
PID 3180 wrote to memory of 1512	3180	TrustedInstaller.exe	TrustedInstaller.exe
PID 372 wrote to memory of 2268	372	cmd.exe	WMIC.exe
PID 372 wrote to memory of 2268	372	cmd.exe	WMIC.exe
PID 372 wrote to memory of 2268	372	cmd.exe	WMIC.exe
PID 1372 wrote to memory of 2384	1372	cmd.exe	vssadmin.exe
PID 1372 wrote to memory of 2384	1372	cmd.exe	vssadmin.exe
PID 1372 wrote to memory of 2384	1372	cmd.exe	vssadmin.exe
PID 3180 wrote to memory of 2656	3180	TrustedInstaller.exe	notepad.exe
PID 3180 wrote to memory of 2656	3180	TrustedInstaller.exe	notepad.exe
PID 3180 wrote to memory of 2656	3180	TrustedInstaller.exe	notepad.exe
PID 3180 wrote to memory of 2656	3180	TrustedInstaller.exe	notepad.exe
PID 3180 wrote to memory of 2656	3180	TrustedInstaller.exe	notepad.exe
PID 3180 wrote to memory of 2656	3180	TrustedInstaller.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Encoder.33750.22954.16449.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Encoder.33750.22954.16449.exe"
1⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe" -start
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3180

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
3⤵
- Suspicious use of WriteProcessMemory
PID:372

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2268

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
3⤵
PID:696

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
PID:1076

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
3⤵
PID:1252

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe" -agent 0
3⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1512

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
3⤵
- Suspicious use of WriteProcessMemory
PID:1372

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:2384

C:\Windows\SysWOW64\notepad.exe
notepad.exe
3⤵
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 1560
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2548

C:\Windows\SysWOW64\notepad.exe
notepad.exe
2⤵
- Deletes itself
PID:3268

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2568

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
MD5
86685952b3e8f4ad691050c954d6250c

SHA1
1705baba558a84967c186cedb11b4d895470ee22

SHA256
762c1ada3a9117b1e0e382e692e37b8d84d4d037bcfad28c65f05fdc15008072

SHA512
c9fdcf79f2bbcc40dbb9445ca63eb9760fd2f0884ef3fc6a580e10957ec0f6e7499a3f088e80c3074db8d7d3501bd2d56d70c1bc597329ac03d78ba742dced45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
MD5
885b4461e133e1db2d88f0cdbcd5afb2

SHA1
15d84bcc041e330ef0d260252461c57bc51c3b29

SHA256
84796726a64dd846ffd7d6a322e24c76509d5b77ec67a01101c5a0ed4ae71a92

SHA512
3582be2c43f40e683e116cd18ac8b7edbb640ecad17ea50c541c80b384111839e42dfe16a00b8c94725a866f7254147314797bc7f79b1f34d3f439411fdfc0ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
f8e8cecf0e7b87ca9655876c74e4448f

SHA1
81cbbc8e89acc2b46ce23b876d68af4e4ea6e984

SHA256
5be90bfc1b0198d64016dabee198906523ce5b9719fb57233f0b4f9738e3bf36

SHA512
9c4d3e8fcd76e0886ada78d131c713ce038ed2fba350d43f63c123d08b824c1c38f93ebd5ab25d715947765e1f88c4d7264701c37d2ef514136b76c53b03f2b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
MD5
b98d5c39383ccabac1887d57a86411cc

SHA1
25188e7ac8ee60190222649b3568664d5f5144f6

SHA256
80b9c314cd208887ad2abcc7696a59977c567933cca01a20cbba406bdb79a32c

SHA512
2e8f864fc2400212da39dd763b7b86652d95b51f141371f911887f7f49857fc9aeabf0c69ba2af4518ea6e24da1e23c72410038b07d29930e1ad30c43efc6629

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
MD5
3d2519422c5d03e6b29b56fd35ece499

SHA1
59cd09e16c389d6cf3777c2ce8dab57b0812006a

SHA256
802913ebfb4eb7d7bfecdd44955e3067d0cc8815200f1db55416863a46dbeaf1

SHA512
75510bbd292925d6368cd72ea11090e5101cfca2c47d60d02d1116411ad2814a26f0f640676336b1c53f931c18a34a098b9d9163697c637539354f40e86db5fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
e332d0e2556f624018856cf9ddf890b1

SHA1
54162117167c2700b521fc1139a05400e0494030

SHA256
70bd6abc9c9e1ab3f5c9b77c2dfcddf5db48ebe6891ad0149fb6c5a5909029fa

SHA512
84671ca058c1d5983d63c7a5862d86cd8fa4e551e6da551a55f24bafcee7cd4685b97b587262b49ee3892a036e0466360c5f4300e136932a49a04e211122ac42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JGAO043J\0JLZ8SBP.htm
MD5
6b17a59cec1a7783febae9aa55c56556

SHA1
01d4581e2b3a6348679147a915a0b22b2a66643a

SHA256
66987b14b90d41632be98836f9601b12e7f329ffab05595887889c9c5716fbeb

SHA512
3337efd12b9c06b7768eb928a78caae243b75257c5aabe7a49e908a2f735af55f7257a40bd2330dc13865ead18ed805b54a6c5105740fdcbbaccacf7997bcbc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S7PGJ114\Z2WVTBX0.htm
MD5
b1cd7c031debba3a5c77b39b6791c1a7

SHA1
e5d91e14e9c685b06f00e550d9e189deb2075f76

SHA256
57ba053f075e0b80f747f3102ed985687c16a8754d109e7c4d33633269a36aaa

SHA512
d2bbefdc1effb52a38964c4cec5990a5a226248eca36f99e446c0c5704436f666bf1cb514e73b8991411d497d3325ecc646cbd5065c364e92ab6b9c5f1ad4a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
MD5
75c1ff39aac846286257e7186dc0096e

SHA1
2e953e5958353e2590fd14300a492a786d6930d5

SHA256
63067c7050bab69e0903ed3887710e4fa50d30d5865c765941df579ddb9b4ab3

SHA512
ac3875fc6eb8721c020365522e70f3e94464dc63fd7ba20d10c0c6baae41ab3d403c68d0a6785ee6b571d28647470548b79e07c13e19f69d207944f5581f16d8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
MD5
75c1ff39aac846286257e7186dc0096e

SHA1
2e953e5958353e2590fd14300a492a786d6930d5

SHA256
63067c7050bab69e0903ed3887710e4fa50d30d5865c765941df579ddb9b4ab3

SHA512
ac3875fc6eb8721c020365522e70f3e94464dc63fd7ba20d10c0c6baae41ab3d403c68d0a6785ee6b571d28647470548b79e07c13e19f69d207944f5581f16d8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
MD5
75c1ff39aac846286257e7186dc0096e

SHA1
2e953e5958353e2590fd14300a492a786d6930d5

SHA256
63067c7050bab69e0903ed3887710e4fa50d30d5865c765941df579ddb9b4ab3

SHA512
ac3875fc6eb8721c020365522e70f3e94464dc63fd7ba20d10c0c6baae41ab3d403c68d0a6785ee6b571d28647470548b79e07c13e19f69d207944f5581f16d8

Download Submit
C:\Users\Admin\Desktop\AssertUndo.raw.@Karla404.2D0-876-029
MD5
7fa19a71a20402795eb001d975eccb31

SHA1
c9c345d7be83ba71c27e674195a84a505827f585

SHA256
a307bf798e2243bf678dc0d73587468d3341e51bf058950588478787996c459b

SHA512
1e428ece5f247ee2ba246483e69f46e024c545771606853beac07476ca154fd1f6729bf65ca250f58fd6749ee3841e16d485e517abe1e92866f7a713150ff860

Download Submit
C:\Users\Admin\Desktop\BlockMeasure.TS.@Karla404.2D0-876-029
MD5
ac6ce8600d56c24dcb74a5fd7c3aae65

SHA1
2d375f8572e2f67641ae8c2b0064555429ec11e9

SHA256
ae932034a7901bbc66936e4c18d9ab39e84ca0dc0eb159377f9547bee84784d2

SHA512
f63da17eea58ab815530341d81434a2d2ead18ae61955da0b2c001f3b4dcd3c3ddb1bbd7a5ef5b3894d75cd6fd656d7b67e84b01510bee90a779ef443870222d

Download Submit
C:\Users\Admin\Desktop\CompareProtect.eprtx.@Karla404.2D0-876-029
MD5
a359563f832e37f31967bc96bb0e62b3

SHA1
96c56de5df55994ab44a16cd69e619620bb7b62b

SHA256
6d0f506868873d075fc6512e692d1697b4618111edc59f791cca85970caa04b2

SHA512
c17334e4ad368589385e124e3ed7f61807640113ced9d59fb8dea4ed3f81b0f6c43b43ea4369842124a36464de506029ad71f4d4dd0145abe307213ab0e82e52

Download Submit
C:\Users\Admin\Desktop\ConnectWatch.raw.@Karla404.2D0-876-029
MD5
134ebc26ee64eba84eac1659d9741001

SHA1
c2b1b0abe85b97b32eff7a4ffef2e643d45c2fe2

SHA256
513a199f9ae1758e4a9a9bf7167863608bc76ccbc4fbb4c5ffd4910dd0d16d14

SHA512
9eeed8cb3ef396b732104db311695866a6d1c8513fce0d905529010be5985b8224839231c58bcacbdb4991506fa0df6d4d186971becd65bb0180a979e8f688eb

Download Submit
C:\Users\Admin\Desktop\DebugExport.mpg.@Karla404.2D0-876-029
MD5
28debd2787fd3d125f5aa0855396cd0f

SHA1
c9fb6e17f3503a2a1df9d3028388c585e9da109d

SHA256
34e40db79c0dc92f5d36fe0a1209214480f5282f0b350595a23d76144a0f194d

SHA512
b7d59f3d2e4c278315ed3b9a43b30f9e289ab5bfbe03b96c848a78b55d5977ffc672c9cb8d22567b4dc72ba89cfc1c168139fb6b4fdf37db16f62953091116dd

Download Submit
C:\Users\Admin\Desktop\DisconnectGroup.png.@Karla404.2D0-876-029
MD5
0b0993038637cc1be4c7a09fef1fd1ac

SHA1
a2d190b4994984ad780b3c1d911597f22b653dcd

SHA256
290cb47f6140ff875d0826c95ed078ee151f8c389709c242d8d56c72f920427c

SHA512
2746e0370c964a36c4a96ed16db941bacbc9d384bae41e81991c6f19acb61204d526243227c9397ffe66ca540bc23e26ca3a049faf0c7c4f7165550a2da4503b

Download Submit
C:\Users\Admin\Desktop\EnterWait.tif.@Karla404.2D0-876-029
MD5
5b25dc7bd5b627f4f9c7e6b863363e52

SHA1
74b10321941d37cbf882234b6cf2c035dcbaca3c

SHA256
84e3a8d17de223c8079bca3ddd75677f6fe9b1899b7a17e284687e7e29867814

SHA512
9e842db7be2a3a5b7790df009e61320450d30ce073eac5520c312339c10182e6345f2c91b23b194c1b1f6105c9e5eda8b48c759b7f245053bfb29f5b5e8d3881

Download Submit
C:\Users\Admin\Desktop\ExitSend.pptx.@Karla404.2D0-876-029
MD5
5b3dfa356a91ec559eeea7260ae47e5d

SHA1
2f088edbf736bc9c73c213e69bc48a21e797aa22

SHA256
3ff5721831df22f5ddb1a4fdbb234b6bc4de7fcc69844958d728b89e4e6c5944

SHA512
73d2fc3c49e21e3f37f38b775c9c0234f3ad0fc69f92e83547e587e778277850194de8be4087307f3f5e964d442847318f303662a8b2edf1c1a088a100f303c5

Download Submit
C:\Users\Admin\Desktop\GetGroup.pptx.@Karla404.2D0-876-029
MD5
1739137896c0a563c16c2a5b47da5019

SHA1
7640e57b73d1c111314be60d354af931406d0bac

SHA256
b72df25fe9c7e8a82328bd4426e62f6a7afa976a3ab438197f7fb9df5e79f816

SHA512
36031144d0a17a402d7b90e239af7fd66fdd79a4570eb3da9b9f73a94ecd0375d6cf805dd5ca2576cd8da0cc1f321a6f5bcc3dfd7939f16ab8bec3300d48efdf

Download Submit
C:\Users\Admin\Desktop\GrantUnpublish.vb.@Karla404.2D0-876-029
MD5
5be53af1c898294a586127de408db1d5

SHA1
52cd76c7754b007a271685b483c6432eb6ec8c1e

SHA256
560d3fdb86ac426e0b6bbe9f0e9f8d50be98fbb2eef41053edd29d60a4360f0a

SHA512
7b0ace85a55dfc8e56e59bc2347d2045ab5baaf059176098dbf881208db4fde426e6eb90591fe58091a72df4986a057d1a1b0b9ddfcf857cbe19050c4e8ae374

Download Submit
C:\Users\Admin\Desktop\GroupResume.i64.@Karla404.2D0-876-029
MD5
fd96bbc631a7c2183583c1e7d36006f1

SHA1
3346083a711ed97a1f602fd87d41853cfbe8fbdf

SHA256
16c37b8af2b58acae1bf30b55f0112bedb22dd8eb045071ca4c579847aeab5b5

SHA512
f2e9847b80c734f2dc97ae769659f3193fb8c4fd678d8a0c17fd917faa3a163cd476a53fe012b4e79a75ac122c04eba910610132a92eb686d2065b0db86e9424

Download Submit
C:\Users\Admin\Desktop\HideProtect.js.@Karla404.2D0-876-029
MD5
b7782cc76fef9d607d5cc0a0f38cad94

SHA1
695cd19f9ae93877380696893e65d64a0cb6a7e2

SHA256
0a16dfaf3d36f27bccb8f2a34016e5ab3fc131608ca26eeb31bb5dac2622e161

SHA512
7ce048676321f9edea2731458a72205efdbe5d87ee8f553180fd52ca8c3a703318629e6728b484ba912fc15473b43bbd1cf932c55af96e25eb4c26143353cc0f

Download Submit
C:\Users\Admin\Desktop\LimitReceive.xps.@Karla404.2D0-876-029
MD5
0a77ab8a65f30e9c505367c665a47de7

SHA1
7e6213f61a697e3a29bcebe5b70a4f9d42b26e81

SHA256
749db50e7949dfc9f806ed1b21dcb8591bdd99176676c704358011719c3da705

SHA512
03ef7aa6712a44cfc682b9aa723bd8199a3876ce72be673df62e0ebf36007fa149401bf24c8ba8826ad9ff977b1d63b08d61bbfc44da11af9f8922bd23da487d

Download Submit
C:\Users\Admin\Desktop\MeasureConvertFrom.html.@Karla404.2D0-876-029
MD5
2a3c05d83098e91d537e49752038cf2c

SHA1
107cfe68b3c278a3595fb0bff5a3e1569591e7db

SHA256
d95afb4b3a771b2a97fcb20ba5612e1b88e09c18bb147d3b60eb1187795b44bb

SHA512
ef0efcce8ff5a9ecd38d1b0714867fe646fe20cb00a7fce3841ca6f13c35d108a0fcb5d511cad082c55f7c84bef34a2c5920cccb169f726904a1d69c74d27c38

Download Submit
C:\Users\Admin\Desktop\OptimizeReceive.inf.@Karla404.2D0-876-029
MD5
b86804e2effcfe15f82325730ca2c47f

SHA1
df467545626651700d5e72cac01d6c23427e4dd1

SHA256
df62ecc353a062f411bb2d7fbbfffb311f163b044b18dea88efff6c13070b980

SHA512
9b116469faf2e87957ac104d6f16955d74377039414923e51649dda86817586db8a0d8c05579a0c0162799ec111a507cdf3ccd4bcb8dac3735105b687922fdc4

Download Submit
C:\Users\Admin\Desktop\OptimizeSync.m4v.@Karla404.2D0-876-029
MD5
9ccec8c18975abb157de92e146d4a7e0

SHA1
05c0683320b21e9eea543be5d1eebc787004331e

SHA256
2dc541a8885ce94e1764214ac537ac5010ab53f2bc97e40e1181fc5774570173

SHA512
bc340d1d83d8bf6e06264b0d414a85aa48d69c0b202a0ae1484eb1f6df885178eab2ec61e31af86d5600c25d06796c59aba0798f84702211e6506fbb31c82b32

Download Submit
C:\Users\Admin\Desktop\OutFormat.php.@Karla404.2D0-876-029
MD5
d9aa7322340e2079be30951cc191e70f

SHA1
36071f2aad777371883ac1f863cda44f6e4d914f

SHA256
3dc86c9f2701882f3d871812e355f21f5385610f0eae942d4c7bebb113579432

SHA512
dab71cba45d8d7ffbc22af76c0e2a68ddebf62d3a1740c1afbbba0f560d5a9a8e40670dfca5ab8d4f5175db0f62b7c777357138b0c1fe7ba41f8800bfa0e633b

Download Submit
C:\Users\Admin\Desktop\PublishCompare.exe.@Karla404.2D0-876-029
MD5
5a4186cfe55b3437a6b0bddfdf67dc88

SHA1
e6b6fc55ee70007627ea3277da5e491ffa66add5

SHA256
0a01f8a752af844a0fc8ce0bc2a4048fb54c6565f953d6f9ce950bcc2d020e0d

SHA512
2d2f2aa89917dff74cd6bbf86d1073acfe15f7fa55696ed13a9bcc32e0fa9f379b67a18d01766154ba838bc611cfe6ba3633ff82d14ec3130adca8e729c0015e

Download Submit
C:\Users\Admin\Desktop\PushUnprotect.midi.@Karla404.2D0-876-029
MD5
1eedece3f8f2bdf4479b7caf11b03cae

SHA1
db3dbdebda4c72401e9aefaea7ac19a4b8a4f118

SHA256
0c571c99e3c59390bfeb03cb04cc23f651fde7d06e8be4714baf5b7bc85a65e0

SHA512
41e3f05a8fbec2fd30e83d42288984132469b7e4a5103871b1997bc550a210d3764ba3bb3be5397ece946cee7121f61819c8077fe550564aac22888c60a5b7ec

Download Submit
C:\Users\Admin\Desktop\RequestRestart.lock.@Karla404.2D0-876-029
MD5
185c264b2a3d55f2e1dfd0f59029ffc5

SHA1
d1c38520904f65d0b5f1decd43319f36d3159912

SHA256
78dc60a0304b8628d46ba3603713ae04694ab9441062f6741c6cca4adefe5053

SHA512
5c55281860dc6f0b3695e4c994a960610a0122a56d82e84a713c52979187c0a4db1c8c69b894ba03d0e2f4a9979e34d17882d8aa9f9e701a0a3128ab3d543955

Download Submit
C:\Users\Admin\Desktop\ResolveConfirm.mht.@Karla404.2D0-876-029
MD5
100c496a80a6c7640ca85a0cd2e98392

SHA1
1cbf48a171e9ec69ba34e5bc0ef27906b2918c74

SHA256
1e8e717ff76347d80e96ea2e24d4beeb927d2f45c4bb4dd533a746a127b61287

SHA512
3662bcb7f3b3b8fe08efbb42718400b63efb9b2f196bf263018c7c39516693471906299bc6c5760d667cccc248bcc77882eb43a7eef9c9e7f156f5e388bdd39f

Download Submit
C:\Users\Admin\Desktop\ResolveMeasure.xltm.@Karla404.2D0-876-029
MD5
16986a76561cc414e0694b11b02338a2

SHA1
ab201ae6de32ec8780eb16152edc627155bbf3fa

SHA256
5e2fbdd6003848d2fafb30a4955aa551b290c734fdeafbe6a4123a112c9ddda5

SHA512
e6a1254be9f8adc775f9daff3df60b031a507971ab9f573d960d78efb5261d85669056276270f7321ad232d59344bea8b7ea00e542ae5934ca19f9bf9abb5bb0

Download Submit
C:\Users\Admin\Desktop\ResumeCompress.jpeg.@Karla404.2D0-876-029
MD5
bdd7e1cf43c38148a641849cf804a239

SHA1
6cb99cb63189f59402d7cbca7fb93856fe017d11

SHA256
f7b254dafe76ad4f5e23c3ede9e34e887d4a8beb19aba00725afbe5ed299cba3

SHA512
e107994dc0a7c9d3b53df75d5d25fd601a955fcffcf19dfd8ca6d2869d217eaf656c113df7bc9a93b00249bc2fcfbf884049b69a8a00f8ef78a27d5ebf28d635

Download Submit
C:\Users\Admin\Desktop\SkipProtect.dwg.@Karla404.2D0-876-029
MD5
3c37337599f03461f94a0db98dcc73c9

SHA1
75060782f155f90bbb8e8fba77713fd98a5ea52e

SHA256
4352512f85a7759943169681b563dcee074e02aad3446bf8b94dce476c04e60a

SHA512
ff0a5b96045a3fd1622a05bdc96c0b86cd384a7f845e4b8248b6171d91bcf6aa10bbc46f70a9c09c91f1d009bc1f5f093bdfb0d3f83319b4a317743b86ad0350

Download Submit
C:\Users\Admin\Desktop\SyncDismount.zip.@Karla404.2D0-876-029
MD5
c5b7c56e6320a4c88f835b6b57a13c91

SHA1
334ab74f8ead187fc1a2c527b9e9d7ee51ef0919

SHA256
557f09066af329bc0e0f85d9363116fd3491aa4fd55a19b5fa20bc91ea2b1240

SHA512
5962ec660f682f0a9dd2e377e2baf30215ee15ea185e813ff318654f933a96cbdcb67eee49308515ebb2eb75cb56650223bad7db1b5e202e8c641e055fb80ebd

Download Submit
C:\Users\Admin\Desktop\TestInitialize.vssx.@Karla404.2D0-876-029
MD5
227085c73f7a5e325d417bccfa534a9e

SHA1
5c255b84e8098dccd16a437e32144fbaa4877643

SHA256
5c75927833f9728f24466204270cad71a6652061b0d6ff12472ba6c25010dde3

SHA512
edb5bd7774bf33da5259981d01937d4be1f36cb82bfba68254c67c16735ade7151b6ae1a4da06e948dabd3a716062213d3e35a29395fe86e99d259f0eac7030d

Download Submit
C:\Users\Admin\Desktop\UninstallSkip.ppsm.@Karla404.2D0-876-029
MD5
e911fe72f0f0d5ccc5e5e15186b5ea7e

SHA1
b9ae20190af9caef05dbf7d4101e1beff8a9533c

SHA256
a84c2b4e5f12cedc62771a7aa2309e47b069a2849b0b061fd8d33e0145c0ffd5

SHA512
32f61e10b1165465b86ffca3fc7da652eaf15ac6a761100ea499b99099ffddb4f8503939f2b6dc8533035cb95d15ee73c923111aa51eca37bc0fd902d32409eb

Download Submit
C:\Users\Admin\Desktop\UnregisterSuspend.wpl.@Karla404.2D0-876-029
MD5
eb9de2f8f9b9a65101ae3d90dee40828

SHA1
2ff48e260d8c36940ab9fb035082adce7c8cddb9

SHA256
a2b81d4ee913e9fe57a148ce7d2337679169ce4e5ec0c469fcb6a625ebf77790

SHA512
ce54ea48a5d5b19ad21aa8f0a509be629c9541bbd55c7da43c136bf53a8930fbc02ade0281ebf9260aef1b533aa55ab10fd6b0cdcf5645bae3a0b3a40d256ea5

Download Submit
C:\Users\Admin\Desktop\UpdateWait.emf.@Karla404.2D0-876-029
MD5
727140a01e8d175b8af1fa9d069f95d7

SHA1
2759ab77034604af65da9d29ff75792987b96edf

SHA256
a9147a3887f8dce62a58039b7336d7a4f093a247bda04a0a292bf6f2282d6feb

SHA512
23decedc5f2d4d63a8e2b71536b18d2c421ae1860ec02a2117a5f8bcf4ff6cd6495cba6c6db361d7216605c3d9e103146c4c6244d0c0be91ef86781a1f434906

Download Submit
memory/372-16-0x0000000000000000-mapping.dmp

Download
memory/696-17-0x0000000000000000-mapping.dmp

Download
memory/1076-18-0x0000000000000000-mapping.dmp

Download
memory/1252-19-0x0000000000000000-mapping.dmp

Download
memory/1372-20-0x0000000000000000-mapping.dmp

Download
memory/1512-21-0x0000000000000000-mapping.dmp

Download
memory/2268-23-0x0000000000000000-mapping.dmp

Download
memory/2384-24-0x0000000000000000-mapping.dmp

Download
memory/2548-56-0x0000000004770000-0x0000000004771000-memory.dmp

Filesize
4KB

Download
memory/2548-57-0x0000000004770000-0x0000000004771000-memory.dmp

Filesize
4KB

Download
memory/2656-54-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download
memory/2656-55-0x0000000000000000-mapping.dmp

Download
memory/3180-2-0x0000000000000000-mapping.dmp

Download
memory/3268-6-0x0000000000000000-mapping.dmp

Download
memory/3268-5-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download