quantum | b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192

Analysis

max time kernel
53s
max time network
57s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/02/2023, 02:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
Size

75KB
MD5

0706764b3963df092079d3bdef787a1f
SHA1

73c2460d59f3d0637523ca6d35425aae14358ba1
SHA256

b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192
SHA512

3af7ff3b2aa689eb4c410562b5ead74ff77417da941521928391c6fac3dcc6a75f6d866f52b12f67a41564cfa81afcda51857c0f208f9e90e8629e0f0b5d5cb4
SSDEEP

1536:9aX51pVH9hsgNGLs6BLM1frxz/HTfcKKBaJGp:OfJGLs6BwNxnfTKsG

Score

10^/10

quantum ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Family

quantum

Ransom Note

<html> <head> <title>Quantum</title> </head> <body> <h1>Your ID:</h1> <pre> 9064d8b148a0f19a9e3598a6e0b0aeb1602bd79273359845164eefdf45b6ef32 </pre> <hr/> This message contains an information how to fix the troubles you've got with your network. Files on the workstations in your network were encrypted and any your attempt to change, decrypt or rename them could destroy the content. The only way to get files back is a decryption with Key, provided by the Quantum Locker. During the period your network was under our control, we downloaded a huge volume of information. Now it is stored on our servers with high-secure access. This information contains a lot of sensitive, private and personal data. Publishing of such data will cause serious consequences and even business disruption. It's not a threat, on the contrary - it's a manual how to get a way out. Quantum team doesn't aim to damage your company, our goals are only financial. After a payment you'll get network decryption, full destruction of downloaded data, information about your network vulnerabilities and penetration points. If you decide not to negotiate, in 48 hours the fact of the attack and all your information will be posted on our site and will be promoted among dozens of cyber forums, news agencies, websites etc. To contact our support and start the negotiations, please visit our support chat. It is simple, secure and you can set a password to avoid intervention of unauthorised persons. <a href="http://tijykgureh7kqq5cczzeutaoxvmf6yinpar72o3bxome7b44vwqxadyd.onion/?cid=9064d8b148a0f19a9e3598a6e0b0aeb1602bd79273359845164eefdf45b6ef32">http://tijykgureh7kqq5cczzeutaoxvmf6yinpar72o3bxome7b44vwqxadyd.onion/?cid=9064d8b148a0f19a9e3598a6e0b0aeb1602bd79273359845164eefdf45b6ef32</a> <ul> <li>Password field should be blank for the first login. <li>Note that this server is available via Tor browser only. </ul> P.S. How to get TOR browser - see at https://www.torproject.org </body> </html>

Extracted

Path

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Family

quantum

Ransom Note

Your ID: This message contains an information how to fix the troubles you've got with your network. Files on the workstations in your network were encrypted and any your attempt to change, decrypt or rename them could destroy the content. The only way to get files back is a decryption with Key, provided by the Quantum Locker. During the period your network was under our control, we downloaded a huge volume of information. Now it is stored on our servers with high-secure access. This information contains a lot of sensitive, private and personal data. Publishing of such data will cause serious consequences and even business disruption. It's not a threat, on the contrary - it's a manual how to get a way out. Quantum team doesn't aim to damage your company, our goals are only financial. After a payment you'll get network decryption, full destruction of downloaded data, information about your network vulnerabilities and penetration points. If you decide not to negotiate, in 48 hours the fact of the attack and all your information will be posted on our site and will be promoted among dozens of cyber forums, news agencies, websites etc. To contact our support and start the negotiations, please visit our support chat. It is simple, secure and you can set a password to avoid intervention of unauthorised persons. http://tijykgureh7kqq5cczzeutaoxvmf6yinpar72o3bxome7b44vwqxadyd.onion/?cid=9064d8b148a0f19a9e3598a6e0b0aeb1602bd79273359845164eefdf45b6ef32 Password field should be blank for the first login. Note that this server is available via Tor browser only. P.S. How to get TOR browser - see at https://www.torproject.org

URLs

http://tijykgureh7kqq5cczzeutaoxvmf6yinpar72o3bxome7b44vwqxadyd.onion/?cid=9064d8b148a0f19a9e3598a6e0b0aeb1602bd79273359845164eefdf45b6ef32

Signatures

Quantum Ransomware
A rebrand of the MountLocker ransomware first seen in August 2021.
ransomware quantum

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\FormatClear.crw => \??\c:\Users\Admin\Pictures\FormatClear.crw.quantum	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File renamed	C:\Users\Admin\Pictures\GetUse.crw => \??\c:\Users\Admin\Pictures\GetUse.crw.quantum	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File renamed	C:\Users\Admin\Pictures\ImportDisconnect.png => \??\c:\Users\Admin\Pictures\ImportDisconnect.png.quantum	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File renamed	C:\Users\Admin\Pictures\MeasureSplit.tif => \??\c:\Users\Admin\Pictures\MeasureSplit.tif.quantum	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File renamed	C:\Users\Admin\Pictures\ReceiveCompress.tif => \??\c:\Users\Admin\Pictures\ReceiveCompress.tif.quantum	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File renamed	C:\Users\Admin\Pictures\SplitReset.crw => \??\c:\Users\Admin\Pictures\SplitReset.crw.quantum	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe

Deletes itself 1 IoCs

pid	Process
1736	cmd.exe

Drops desktop.ini file(s) 26 IoCs

description	ioc	Process
File opened for modification	\??\c:\Users\Admin\Contacts\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Desktop\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Favorites\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links for United States\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Desktop\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Music\Sample Music\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Pictures\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Videos\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Videos\Sample Videos\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Downloads\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Music\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Saved Games\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Searches\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Documents\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Links\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Videos\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Libraries\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Recorded TV\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Admin\Pictures\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Documents\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Downloads\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
File opened for modification	\??\c:\Users\Public\Music\desktop.ini	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe

Modifies Internet Explorer settings 1 TTPs 27 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{31B241C1-B25A-11ED-AC42-C227D5A71BE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.quantum\shell	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.quantum\shell\Open	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html"	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.quantum\shell\Open\command	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.quantum	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
324	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
324	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	324	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
Token: SeDebugPrivilege	324	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1232	iexplore.exe
1232	iexplore.exe
568	IEXPLORE.EXE
568	IEXPLORE.EXE
568	IEXPLORE.EXE
568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 324 wrote to memory of 1736	324	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe	27
PID 324 wrote to memory of 1736	324	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe	27
PID 324 wrote to memory of 1736	324	b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe	27
PID 1736 wrote to memory of 1352	1736	cmd.exe	29
PID 1736 wrote to memory of 1352	1736	cmd.exe	29
PID 1736 wrote to memory of 1352	1736	cmd.exe	29
PID 1232 wrote to memory of 568	1232	iexplore.exe	32
PID 1232 wrote to memory of 568	1232	iexplore.exe	32
PID 1232 wrote to memory of 568	1232	iexplore.exe	32
PID 1232 wrote to memory of 568	1232	iexplore.exe	32

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1352	attrib.exe

C:\Users\Admin\AppData\Local\Temp\b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe
"C:\Users\Admin\AppData\Local\Temp\b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:324
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\\006CCABF.bat" "C:\Users\Admin\AppData\Local\Temp\b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe""
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\system32\attrib.exe
    attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192.exe"
    3⤵
    - Views/modifies file attributes
    PID:1352

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\README_TO_DECRYPT.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0158fc8acae42ae6889aa1d44b3ab7c

SHA1
7cbc1e0c7016c90c748590a8b9e18918b211d350

SHA256
f9359b66a52ae12fa0dcb7cd5c2ba744f8fedeba9908af87f44392d928894f79

SHA512
8d1c06d71e0a747756dcc3ed7a19f7690872756ad0442438caed0819ca0541a4e624929a4d24770019b65e0dcecc14f3a9b71dbdafe1a7acb39ed3ed47a6a583

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79d22a0f584bbd0517cd6f9c11b820b5

SHA1
9a9498763ed52f5dbcbf7c3c314d9750cacd0fc7

SHA256
f5535c00ce345d78bbce6dc83f5004f13cd032e9790ee1f7993fb3bc536463c0

SHA512
d5f861788908e1cd88b16d20b7cb5b647576d486b95e8e8ef457afa2c0e881976ed22a020057efd8442a1fadf76cb19407b6f4bed20a93cc227a11568fff76e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
302ec4cd83af55f0abf2f00ce1f6824c

SHA1
85a4083a07aa286732450b56b737eb80952c8e48

SHA256
73479ae88f0f633b4408dd18bcf8e319723285f02fdbbc33d3c7df0b61ee6354

SHA512
21e9a89c15d09e1b8426e252db49c7230b6c42315cb961a6cd7f624ce0cddb6de18796e27ad790eb9a682077ce5e589446fee6dbb644a4f6e91663a508636a1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87d634045112e19117ccb0e7d2f90a6e

SHA1
61f3634e7114b12c6371b6f080d5f90e7ff30c58

SHA256
7138e296119737357cd558396da3f25bbb8c64a27eb99932226419d8866496cd

SHA512
c02591e02e624c677063535b2dc25e76d8bc819b990dc1addb77afd17a23bf49cb5be19c9b84e72a230dec3c054e1db81aae80012777543dcd5bf510ad7cae08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f34401c8f51bf09266587dc79dc81d4

SHA1
c6f6df8a19b281d2c6feb61442539b268e8ebb3f

SHA256
d7c17c6cbba9feaf3c15f00be4c17aa8103e67e9361435b475eb0294d05f9848

SHA512
02d1dcb4dbd6fc7d81b972152ee6dc05bffd1445fd4b0ae71d35f7d7d54e6d6fd318b6795058961c82a2ae2808bb9a62338d210561ab6c9679e8c04c16492a8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\006CCABF.bat

Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
C:\Users\Admin\AppData\Local\Temp\006CCABF.bat

Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5D30.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5E6C.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Filesize
2KB

MD5
557a3275e4a8d8782f3e3579adecf628

SHA1
49bc27e4fa9e96ed7a19ebe97f57984c8fcd574a

SHA256
9999a3b8ac4c1c59bfcd79f92c64dad69e7a7ba3e4ddf8c8aedf0f81b819c935

SHA512
97d6e689d4741220d5dde3b14b498187a52cfc4a5197a822f796e532c9916e022cfed6d5933c23ca0097387518b88bd878326b34f8a7d885586a8e2fb5063fb7

Download Submit
C:\Users\Admin\Desktop\README_TO_DECRYPT.html

Filesize
2KB

MD5
557a3275e4a8d8782f3e3579adecf628

SHA1
49bc27e4fa9e96ed7a19ebe97f57984c8fcd574a

SHA256
9999a3b8ac4c1c59bfcd79f92c64dad69e7a7ba3e4ddf8c8aedf0f81b819c935

SHA512
97d6e689d4741220d5dde3b14b498187a52cfc4a5197a822f796e532c9916e022cfed6d5933c23ca0097387518b88bd878326b34f8a7d885586a8e2fb5063fb7

Download Submit
memory/568-356-0x0000000002930000-0x0000000002932000-memory.dmp

Filesize
8KB

Download
memory/1232-355-0x0000000002750000-0x0000000002760000-memory.dmp

Filesize
64KB

Download