mountlocker | 30050b3673c720729cd6a61803059b16dd3aa526683e7342aae0261e4c78fa83

Analysis

max time kernel
104s
max time network
76s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-02-2023 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30050b3673c720729cd6a61803059b16dd3aa526683e7342aae0261e4c78fa83.msi
Size

112KB
MD5

ce3969ab935f0f5b1301cd70d2e59696
SHA1

e70d3341a6e2cc8ae0f140075837ceac4453b947
SHA256

30050b3673c720729cd6a61803059b16dd3aa526683e7342aae0261e4c78fa83
SHA512

20998be53a994d7adab2b71bafccec1eeb93e356965582161fa1fccea023fbf62b0145adf5e0621118f00a4ea12a71fbb5de2fdd129d92879502a5a3da019a36
SSDEEP

1536:y7WSmywADwaY6FIsr4XSZ32tcOGwpin2NI2F4cdJ0DLx0DL:y7WgpDwd6+srGi32tcOGwpin2NMcd

Score

10^/10

mountlocker ransomware

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\RecoveryManual.html

Ransom Note

<html> <head> <title>RECOVERY MANUAL</title> </head> <body> <h1>Your ClientId:</h1> <pre> d11ebd6225c2dd096733ff8dad28b64326c5897ac3a97e1babe00375993d6d53 </pre> <hr/> /!\ YOUR COMPANY' NETWORK HAS BEEN HACKED /!\ All your important documents have been encrypted and transferred to our premises! <hr/> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. However there is a solution for your problem! We can support you with your data decryption for a monetary reward. Also we will destroy your private data from our premises. And we can prove our decryption capabilities by decrypting couple of your files free of charge. Here are the next steps to get your valuable data back and get it wiped out from our premises: <a href="http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64326c5897ac3a97e1babe00375993d6d53">http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64326c5897ac3a97e1babe00375993d6d53</a> * Note that you need installed Tor Browser to open this kind of links. Follow the instructions to install/run Tor Browser: 1. Go to TOR Project website https://www.torproject.org using your usual browser (Chrome, Firefox, Internet Explorer or Edge) 2. Click "Download Tor Browser" and pick right version for your Operation System (this is Windows in 99.9% of cases) 3. Download and Install Tor Browser 4. After installation finished, click on "Tor Browser" link from your Desktop 5. By using Tor Browser visit <a href="http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64326c5897ac3a97e1babe00375993d6d53">http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64326c5897ac3a97e1babe00375993d6d53</a> 6. Copy your client id from the top of this document and paste it into Authorization window if requested 7. This will start a chat with our security experts. Please note, sometimes our team is away from keyboard, but make sure they will reply you back as soon as possible. Also, we kindly request you to contact with us as soon as possible. We will start publishing your private data to the Internet if you don't get in touch with us within next few days. </body> </html>

Extracted

Path

C:\Windows\Installer\6c627b.msi

Ransom Note

��ࡱ��>��

Extracted

Path

C:\Users\Admin\Desktop\RecoveryManual.html

Family

mountlocker

Ransom Note

Your ClientId: /!\ YOUR COMPANY' NETWORK HAS BEEN HACKED /!\ All your important documents have been encrypted and transferred to our premises! ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. However there is a solution for your problem! We can support you with your data decryption for a monetary reward. Also we will destroy your private data from our premises. And we can prove our decryption capabilities by decrypting couple of your files free of charge. Here are the next steps to get your valuable data back and get it wiped out from our premises: http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64326c5897ac3a97e1babe00375993d6d53 * Note that you need installed Tor Browser to open this kind of links. Follow the instructions to install/run Tor Browser: 1. Go to TOR Project website https://www.torproject.org using your usual browser (Chrome, Firefox, Internet Explorer or Edge) 2. Click "Download Tor Browser" and pick right version for your Operation System (this is Windows in 99.9% of cases) 3. Download and Install Tor Browser 4. After installation finished, click on "Tor Browser" link from your Desktop 5. By using Tor Browser visit http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64326c5897ac3a97e1babe00375993d6d53 6. Copy your client id from the top of this document and paste it into Authorization window if requested 7. This will start a chat with our security experts. Please note, sometimes our team is away from keyboard, but make sure they will reply you back as soon as possible. Also, we kindly request you to contact with us as soon as possible. We will start publishing your private data to the Internet if you don't get in touch with us within next few days.

URLs

http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64326c5897ac3a97e1babe00375993d6d53

Signatures

Detected Mount Locker ransomware 3 IoCs

resource	yara_rule
behavioral1/files/0x00080000000122f1-65.dat	RANSOM_mountlocker
behavioral1/files/0x00080000000122f1-66.dat	RANSOM_mountlocker
behavioral1/files/0x00080000000122e7-471.dat	RANSOM_mountlocker

MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
ransomware mountlocker
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\ApproveClose.png => \??\c:\Users\Admin\Pictures\ApproveClose.png.ReadManual.64BD3273	MsiExec.exe
File opened for modification	\??\c:\Users\Admin\Pictures\ApproveClose.png.ReadManual.64BD3273	MsiExec.exe
File renamed	C:\Users\Admin\Pictures\ConnectLock.raw => \??\c:\Users\Admin\Pictures\ConnectLock.raw.ReadManual.64BD3273	MsiExec.exe
File opened for modification	\??\c:\Users\Admin\Pictures\ConnectLock.raw.ReadManual.64BD3273	MsiExec.exe
File renamed	C:\Users\Admin\Pictures\ConvertSelect.crw => \??\c:\Users\Admin\Pictures\ConvertSelect.crw.ReadManual.64BD3273	MsiExec.exe
File opened for modification	\??\c:\Users\Admin\Pictures\ConvertSelect.crw.ReadManual.64BD3273	MsiExec.exe

Loads dropped DLL 1 IoCs

pid	Process
1312	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\teyefibowo\ReadMe.txt	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6539.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI65C8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6c627c.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\6c627b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6c627b.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\6c627c.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI65C8.tmp	attrib.exe
File created	C:\Windows\Installer\6c627e.msi	msiexec.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
808	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0ae40d86146d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{013360B1-B255-11ED-9CE1-7AA90D5E5B0D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074b2d77a8e7a944ea7c282b9066208cc00000000020000000000106600000001000020000000519249066a4989bb3e4e4f2e6584caa296a090c38143e46dbcd38fddc2a62b1e000000000e8000000002000020000000b88fecd3123e7a717ba60581ce0b808358289783f8b1c24e383e612b73adefa020000000da9597307036e3aa1df599c36c54cb3fb050a292fc0a653ecad91f3e1152e9a6400000000d26e62d944c8eef00701c8d3a85bc57750ecfa2c54ae2d2646d6ce9008b19dd73177ebed1b051f2df5acbffb576087c48cb27f1f19bf1252a084991ff2e0f4e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074b2d77a8e7a944ea7c282b9066208cc0000000002000000000010660000000100002000000048142bd795e992ab19570bfdab431e3d0da9b370de6a202f3354ceddc364cdac000000000e80000000020000200000002a5bea814313ccf3265b71c2829872395d2cc470e91028bfc381271eea35aac890000000c57a347efa6a4bed24c9d237c3dc7a5014ee96d625afca92d8eda534f7de6f513a668d40685e0c4424635439edb70a8029e27d43751a5b10aeb68c2b9cf91f9f1243d0b33caba54617248b35795657995b2e0652c5eb9d575c207eed03a69e454fd3bf9fde930ad704b658fb4c79993822adc325ecd22a99a5e94dbb9647a88f66338ea55650f0934622cc8bea978d9940000000a287345d5af96d47fcb8676d81d20c6bf2ed7f39c6e45afed7847b1bdb7580ceba29028d898d7684e140cc87153665ae87de4c896f2d6a3247e8c4b0a8e27091	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\.64BD3273\shell\Open	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\SourceList\Media\DiskPrompt = "zawani 3.53 Installation"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\SourceList\Media\1 = ";CD-ROM #1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\SourceList\PackageName = "30050b3673c720729cd6a61803059b16dd3aa526683e7342aae0261e4c78fa83.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\.64BD3273	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\.64BD3273\shell	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9A574297AD28B6E46A6E44B3871D80B4\iDAAAF618FF524449BD8193E4A7C12996	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7E99BE60AB9492F4EB40B1E891C24BA8	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9A574297AD28B6E46A6E44B3871D80B4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\ProductName = "zawani"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\Version = "53805056"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7E99BE60AB9492F4EB40B1E891C24BA8\9A574297AD28B6E46A6E44B3871D80B4	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\.64BD3273\shell\Open\command	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\.64BD3273\shell\Open\command\ = "explorer.exe RecoveryManual.html"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\PackageCode = "B6AA8A37A2DF03A4195563F9732E8294"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\SourceList\Media	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
980	msiexec.exe
980	msiexec.exe
1312	MsiExec.exe
1312	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1692	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1692	msiexec.exe
Token: SeRestorePrivilege	980	msiexec.exe
Token: SeTakeOwnershipPrivilege	980	msiexec.exe
Token: SeSecurityPrivilege	980	msiexec.exe
Token: SeCreateTokenPrivilege	1692	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1692	msiexec.exe
Token: SeLockMemoryPrivilege	1692	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1692	msiexec.exe
Token: SeMachineAccountPrivilege	1692	msiexec.exe
Token: SeTcbPrivilege	1692	msiexec.exe
Token: SeSecurityPrivilege	1692	msiexec.exe
Token: SeTakeOwnershipPrivilege	1692	msiexec.exe
Token: SeLoadDriverPrivilege	1692	msiexec.exe
Token: SeSystemProfilePrivilege	1692	msiexec.exe
Token: SeSystemtimePrivilege	1692	msiexec.exe
Token: SeProfSingleProcessPrivilege	1692	msiexec.exe
Token: SeIncBasePriorityPrivilege	1692	msiexec.exe
Token: SeCreatePagefilePrivilege	1692	msiexec.exe
Token: SeCreatePermanentPrivilege	1692	msiexec.exe
Token: SeBackupPrivilege	1692	msiexec.exe
Token: SeRestorePrivilege	1692	msiexec.exe
Token: SeShutdownPrivilege	1692	msiexec.exe
Token: SeDebugPrivilege	1692	msiexec.exe
Token: SeAuditPrivilege	1692	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1692	msiexec.exe
Token: SeChangeNotifyPrivilege	1692	msiexec.exe
Token: SeRemoteShutdownPrivilege	1692	msiexec.exe
Token: SeUndockPrivilege	1692	msiexec.exe
Token: SeSyncAgentPrivilege	1692	msiexec.exe
Token: SeEnableDelegationPrivilege	1692	msiexec.exe
Token: SeManageVolumePrivilege	1692	msiexec.exe
Token: SeImpersonatePrivilege	1692	msiexec.exe
Token: SeCreateGlobalPrivilege	1692	msiexec.exe
Token: SeBackupPrivilege	580	vssvc.exe
Token: SeRestorePrivilege	580	vssvc.exe
Token: SeAuditPrivilege	580	vssvc.exe
Token: SeBackupPrivilege	980	msiexec.exe
Token: SeRestorePrivilege	980	msiexec.exe
Token: SeRestorePrivilege	1740	DrvInst.exe
Token: SeRestorePrivilege	1740	DrvInst.exe
Token: SeRestorePrivilege	1740	DrvInst.exe
Token: SeRestorePrivilege	1740	DrvInst.exe
Token: SeRestorePrivilege	1740	DrvInst.exe
Token: SeRestorePrivilege	1740	DrvInst.exe
Token: SeRestorePrivilege	1740	DrvInst.exe
Token: SeLoadDriverPrivilege	1740	DrvInst.exe
Token: SeLoadDriverPrivilege	1740	DrvInst.exe
Token: SeLoadDriverPrivilege	1740	DrvInst.exe
Token: SeRestorePrivilege	980	msiexec.exe
Token: SeTakeOwnershipPrivilege	980	msiexec.exe
Token: SeRestorePrivilege	980	msiexec.exe
Token: SeTakeOwnershipPrivilege	980	msiexec.exe
Token: SeRestorePrivilege	980	msiexec.exe
Token: SeTakeOwnershipPrivilege	980	msiexec.exe
Token: SeRestorePrivilege	980	msiexec.exe
Token: SeTakeOwnershipPrivilege	980	msiexec.exe
Token: SeDebugPrivilege	1312	MsiExec.exe
Token: SeRestorePrivilege	980	msiexec.exe
Token: SeTakeOwnershipPrivilege	980	msiexec.exe
Token: SeRestorePrivilege	980	msiexec.exe
Token: SeTakeOwnershipPrivilege	980	msiexec.exe
Token: SeRestorePrivilege	980	msiexec.exe
Token: SeTakeOwnershipPrivilege	980	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1692	msiexec.exe
1692	msiexec.exe
832	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
832	iexplore.exe
832	iexplore.exe
540	IEXPLORE.EXE
540	IEXPLORE.EXE
540	IEXPLORE.EXE
540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 1312	980	msiexec.exe	32
PID 980 wrote to memory of 1312	980	msiexec.exe	32
PID 980 wrote to memory of 1312	980	msiexec.exe	32
PID 980 wrote to memory of 1312	980	msiexec.exe	32
PID 980 wrote to memory of 1312	980	msiexec.exe	32
PID 980 wrote to memory of 1312	980	msiexec.exe	32
PID 980 wrote to memory of 1312	980	msiexec.exe	32
PID 1312 wrote to memory of 808	1312	MsiExec.exe	34
PID 1312 wrote to memory of 808	1312	MsiExec.exe	34
PID 1312 wrote to memory of 808	1312	MsiExec.exe	34
PID 1312 wrote to memory of 808	1312	MsiExec.exe	34
PID 1312 wrote to memory of 1680	1312	MsiExec.exe	36
PID 1312 wrote to memory of 1680	1312	MsiExec.exe	36
PID 1312 wrote to memory of 1680	1312	MsiExec.exe	36
PID 1312 wrote to memory of 1680	1312	MsiExec.exe	36
PID 1680 wrote to memory of 1400	1680	cmd.exe	38
PID 1680 wrote to memory of 1400	1680	cmd.exe	38
PID 1680 wrote to memory of 1400	1680	cmd.exe	38
PID 1680 wrote to memory of 1400	1680	cmd.exe	38
PID 832 wrote to memory of 540	832	iexplore.exe	41
PID 832 wrote to memory of 540	832	iexplore.exe	41
PID 832 wrote to memory of 540	832	iexplore.exe	41
PID 832 wrote to memory of 540	832	iexplore.exe	41

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1400	attrib.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\30050b3673c720729cd6a61803059b16dd3aa526683e7342aae0261e4c78fa83.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1692

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 24C786A70E864342B1A0511B71AD6EBB
  2⤵
  - Modifies extensions of user files
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\SysWOW64\vssadmin.exe
    C:\Windows\system32\vssadmin.exe delete shadows /all /Quiet
    3⤵
    - Interacts with shadow copies
    PID:808
- - C:\Windows\syswow64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\\006CAF44.bat" "C:\Windows\Installer\MSI65C8.tmp""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -r -h "C:\Windows\Installer\MSI65C8.tmp"
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:1400

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:580

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000068" "0000000000000064"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1740

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RecoveryManual.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:832 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

File Deletion

T1107

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\6c627d.rbs

Filesize
7KB

MD5
268713f3b05339a45fd4c2e4c5268e59

SHA1
b4f54c141c90ce747cd7d39cc2522e9f04d31359

SHA256
c48c73d47e53c7d3d3ec48e2e15f18ca65ccf30b623bf68fffd678a6112e2df3

SHA512
80037a9ec2ff91d82d1aacc5f43cc385ec0d7295b57681bff4f3ef7761805a9cba088de649f5d93a2e2bd7fef90b148a6586f4f9a944cb4a497600155a53c7a8

Download Submit
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\RecoveryManual.html

Filesize
2KB

MD5
5e2160caffd8a9833e72bc87fb38192b

SHA1
52f8f24bfba53a3a2980d32fd54a0bd6255d9e04

SHA256
273bec0e34f198fc2bd649b254e071592460d5d141f068250796ba9d5b4ec36d

SHA512
00d69723ef3a2df9c90f6910b9cdff47f98dcf8d0cc9661669871740512a86c6fa4e3966d88513187fadac14910c3c607e273acd964c012cf7c70627e4e01c8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0c076c905955e4f375e53cca276c161

SHA1
169f21cb68b1cbdef764d14c7e01199321e9a6f0

SHA256
b1bb745734e0c2dbcd0623b1aab840294da08429cef33f423e554a8ccf0549a5

SHA512
55efc475398dfbf6ef077e7e3de5e9b0d0c447f31263a2efcb00330e0dba011d12378916ef4c73a0ac125389d604c9044a6ff40a1db7e265ddb126302380a5ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37cf3cc86c094fe104c4bb884b38d52e

SHA1
b4e8fd55dd41a794a001adf3468c7899896508c0

SHA256
a4b008cd6b9f9a2b7af29ada2d3222e647c787b7974aad68e40f3a56ee53bcac

SHA512
569e4682e66a9946e87dcd55b179bea8c565629762668a8bf0778dd92f2f2c68b1818d54a091dc1a47f7d446a08341415fe619275bdd0efdb6ffa27070e5b625

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f530463bd9b31718cc8fdbd7a889e75

SHA1
058c2cb4bc54af3cc03d32f0b78473b5d469124d

SHA256
1b2e8800ac183b45ed1baab7df1d81ba9de2392aef33b60113d5345bce034912

SHA512
6417cf359915c764eb1e61c53be5a3e9a5a7d05d3cb1f5e8516062defe805a55e75adf1f023f949ba27fa8f5c115020560de3437d28ac5f5de4f537bf96cb7cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3760a4d6e86b09b2eaf656f33c0b43c

SHA1
89a3c152f96c47377932a4bbeb31c8ea233e2f9a

SHA256
27d6881c0d7faea85a8a0740003daf45051a249900cccee53c157f91aaa66348

SHA512
e98284108d103000a2513733ba159ef926fa42c778b106612199847931a9d173186eafd9fc57cbe7f9fc6fe9dc30ac847c62ac69fccc5ac5a502d498f237d7c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1763fcb43d99a6df3c047ff783efe19b

SHA1
07cee031ce3633c782944bae37a1a96f1728e33a

SHA256
51f348ee1be45a9657622706a3944c6af3add0fa9929fb3ba23d767b6894f963

SHA512
46b922408eac7961d579b58416ce6e52c8260cb4b33cdc99d01a7c8cc789e7187dba4676ce42406626ac95f1006fbbd5ee1c2c44b195682bed850ef588829cee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99e21319f5b8136f452f634bc675ba80

SHA1
db5de92296a015a7c312b900cff84330a6609788

SHA256
2299a7746e3e1235c92b16335f36f7549f33844d5bb09c80efaec84837403faa

SHA512
af076dd4f24128e0e6a2ac7e3d284e503767876e39b4979a973490b4aa02a7d3101b99fbce75e6fdf47ffa14fb98f8511558e1a62d6625ca8a347e94d6138bb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c55cd1fd1174772fe916007f043a9daa

SHA1
fa6fdfe9b76127238d549472fdd0809b7a5a9bf5

SHA256
594b6cd2aad1cd20b2a950a23a3c827543770715c5eee3d1040805e99ca4cf08

SHA512
df5d1d5400cc7a311967c44b4c5f5d7a1eceed86d2e479d9342507a57d6c2b35bb2d2704ce9a11da70e57c7bba728b4f3049ac8ba82eba901093c7258d2f6ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\006CAF44.bat

Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
C:\Users\Admin\AppData\Local\Temp\006CAF44.bat

Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1113.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar11E3.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\Desktop\RecoveryManual.html

Filesize
2KB

MD5
5e2160caffd8a9833e72bc87fb38192b

SHA1
52f8f24bfba53a3a2980d32fd54a0bd6255d9e04

SHA256
273bec0e34f198fc2bd649b254e071592460d5d141f068250796ba9d5b4ec36d

SHA512
00d69723ef3a2df9c90f6910b9cdff47f98dcf8d0cc9661669871740512a86c6fa4e3966d88513187fadac14910c3c607e273acd964c012cf7c70627e4e01c8b

Download Submit
C:\Windows\Installer\6c627b.msi

Filesize
112KB

MD5
ce3969ab935f0f5b1301cd70d2e59696

SHA1
e70d3341a6e2cc8ae0f140075837ceac4453b947

SHA256
30050b3673c720729cd6a61803059b16dd3aa526683e7342aae0261e4c78fa83

SHA512
20998be53a994d7adab2b71bafccec1eeb93e356965582161fa1fccea023fbf62b0145adf5e0621118f00a4ea12a71fbb5de2fdd129d92879502a5a3da019a36

Download Submit
C:\Windows\Installer\MSI65C8.tmp

Filesize
77KB

MD5
0aacf2c41ba9b872a52055ffcaeaef15

SHA1
c09b509699aeef71f3e205d53c5f4ff71cb48570

SHA256
31630d16f4564c7a214a206a58f60b7623cd1b3abb823d10ed50aa077ca33585

SHA512
d259de51d22d72d27d5947530317661b97ba8fcc36e7a2ad4835e98bc311ef1aa5964f939660733171934f6aefa82d8b76a6f9f04137e1aeca63d592f0fb26ec

Download Submit
\Windows\Installer\MSI65C8.tmp

Filesize
77KB

MD5
0aacf2c41ba9b872a52055ffcaeaef15

SHA1
c09b509699aeef71f3e205d53c5f4ff71cb48570

SHA256
31630d16f4564c7a214a206a58f60b7623cd1b3abb823d10ed50aa077ca33585

SHA512
d259de51d22d72d27d5947530317661b97ba8fcc36e7a2ad4835e98bc311ef1aa5964f939660733171934f6aefa82d8b76a6f9f04137e1aeca63d592f0fb26ec

Download Submit
memory/540-474-0x0000000002F70000-0x0000000002F72000-memory.dmp

Filesize
8KB

Download
memory/832-473-0x0000000002D00000-0x0000000002D10000-memory.dmp

Filesize
64KB

Download