makop | f9c4ddad16bf3d2446639ed848334a2c1741af3fab677199c7aef6b5bf6f098e

Analysis

max time kernel
109s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d28f799d666a23fda187776242073993.exe
Size

101KB
MD5

d28f799d666a23fda187776242073993
SHA1

33228c4a1dfe34c2ddd8400300890447dc951f7c
SHA256

f9c4ddad16bf3d2446639ed848334a2c1741af3fab677199c7aef6b5bf6f098e
SHA512

85c27c26b9d322da4ea228be4b23e4b9b036ab6fa61d211c1e150fb88af556ef1c28c1f038d354fb9b34a3eb4911f8e278aa42632b2a4eacc1cf511f67962ff5
SSDEEP

3072:ef1BDZ0kVB67Duw9AMc9sKXbxGM63ikxBbcy6TwYpgI:e9X0G1x363ikxewYpJ

Score

10^/10

makop ransomware spyware stealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\readme-warning.txt

Family

makop

Ransom Note

::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted and now have the "gamigin" extension. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in bitcoins. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailbox: [email protected] or [email protected] or [email protected] .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.

Emails

[email protected]

Signatures

Makop
Ransomware family discovered by @VK_Intel in early 2020.
ransomware makop
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (8187) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3056	wbadmin.exe

Loads dropped DLL 2 IoCs

pid	Process
2064	d28f799d666a23fda187776242073993.exe
2700	d28f799d666a23fda187776242073993.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	d28f799d666a23fda187776242073993.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2064 set thread context of 624	2064	d28f799d666a23fda187776242073993.exe	28
PID 2700 set thread context of 364	2700	d28f799d666a23fda187776242073993.exe	42

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher_1.3.0.v20140911-0143.jar	d28f799d666a23fda187776242073993.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\readme-warning.txt	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101863.BMP	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Reykjavik	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-right.png	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00428_.WMF	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityMergeFax.Dotx	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\gadget.xml	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\micaut.dll.mui	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\HandPrints.jpg	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199475.WMF	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02187_.GIF	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLWVW.DLL.IDX_DLL	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR35B.GIF	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02423_.WMF	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15034_.GIF	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152884.WMF	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR4F.GIF	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\net.properties	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkDrop32x32.gif	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Bucharest	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\vlc.mo	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LABELHM.POC	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_zh_4.4.0.v20140623020002.jar	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif.[08A40263].[[email protected]].gamigin	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0177257.JPG	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR8F.GIF	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\Java\jre7\lib\management\management.properties	d28f799d666a23fda187776242073993.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\readme-warning.txt	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\20.png	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14868_.GIF	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\attention.gif	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-nodes.xml	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\calendar.css	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21340_.GIF	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME52.CSS	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_bottom.png	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01838_.GIF	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME49.CSS	d28f799d666a23fda187776242073993.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\readme-warning.txt	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\Windows Media Player\ja-JP\mpvis.dll.mui	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM	d28f799d666a23fda187776242073993.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\readme-warning.txt	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Perspective.dotx	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_hover.png	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-crescent.png	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Metlakatla	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Black Tie.eftx	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RECS.ICO	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Choibalsan	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\slideShow.js	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can03.ths.[08A40263].[[email protected]].gamigin	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)notConnectedStateIcon.png	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-explorer.jar	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files\Java\jre7\lib\classlist	d28f799d666a23fda187776242073993.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0103058.WMF	d28f799d666a23fda187776242073993.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2848	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
624	d28f799d666a23fda187776242073993.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2064	d28f799d666a23fda187776242073993.exe
2700	d28f799d666a23fda187776242073993.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeBackupPrivilege	2964	vssvc.exe
Token: SeRestorePrivilege	2964	vssvc.exe
Token: SeAuditPrivilege	2964	vssvc.exe
Token: SeBackupPrivilege	2024	wbengine.exe
Token: SeRestorePrivilege	2024	wbengine.exe
Token: SeSecurityPrivilege	2024	wbengine.exe
Token: SeIncreaseQuotaPrivilege	2612	WMIC.exe
Token: SeSecurityPrivilege	2612	WMIC.exe
Token: SeTakeOwnershipPrivilege	2612	WMIC.exe
Token: SeLoadDriverPrivilege	2612	WMIC.exe
Token: SeSystemProfilePrivilege	2612	WMIC.exe
Token: SeSystemtimePrivilege	2612	WMIC.exe
Token: SeProfSingleProcessPrivilege	2612	WMIC.exe
Token: SeIncBasePriorityPrivilege	2612	WMIC.exe
Token: SeCreatePagefilePrivilege	2612	WMIC.exe
Token: SeBackupPrivilege	2612	WMIC.exe
Token: SeRestorePrivilege	2612	WMIC.exe
Token: SeShutdownPrivilege	2612	WMIC.exe
Token: SeDebugPrivilege	2612	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2612	WMIC.exe
Token: SeRemoteShutdownPrivilege	2612	WMIC.exe
Token: SeUndockPrivilege	2612	WMIC.exe
Token: SeManageVolumePrivilege	2612	WMIC.exe
Token: 33	2612	WMIC.exe
Token: 34	2612	WMIC.exe
Token: 35	2612	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2612	WMIC.exe
Token: SeSecurityPrivilege	2612	WMIC.exe
Token: SeTakeOwnershipPrivilege	2612	WMIC.exe
Token: SeLoadDriverPrivilege	2612	WMIC.exe
Token: SeSystemProfilePrivilege	2612	WMIC.exe
Token: SeSystemtimePrivilege	2612	WMIC.exe
Token: SeProfSingleProcessPrivilege	2612	WMIC.exe
Token: SeIncBasePriorityPrivilege	2612	WMIC.exe
Token: SeCreatePagefilePrivilege	2612	WMIC.exe
Token: SeBackupPrivilege	2612	WMIC.exe
Token: SeRestorePrivilege	2612	WMIC.exe
Token: SeShutdownPrivilege	2612	WMIC.exe
Token: SeDebugPrivilege	2612	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2612	WMIC.exe
Token: SeRemoteShutdownPrivilege	2612	WMIC.exe
Token: SeUndockPrivilege	2612	WMIC.exe
Token: SeManageVolumePrivilege	2612	WMIC.exe
Token: 33	2612	WMIC.exe
Token: 34	2612	WMIC.exe
Token: 35	2612	WMIC.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 624	2064	d28f799d666a23fda187776242073993.exe	28
PID 2064 wrote to memory of 624	2064	d28f799d666a23fda187776242073993.exe	28
PID 2064 wrote to memory of 624	2064	d28f799d666a23fda187776242073993.exe	28
PID 2064 wrote to memory of 624	2064	d28f799d666a23fda187776242073993.exe	28
PID 2064 wrote to memory of 624	2064	d28f799d666a23fda187776242073993.exe	28
PID 624 wrote to memory of 2776	624	d28f799d666a23fda187776242073993.exe	30
PID 624 wrote to memory of 2776	624	d28f799d666a23fda187776242073993.exe	30
PID 624 wrote to memory of 2776	624	d28f799d666a23fda187776242073993.exe	30
PID 624 wrote to memory of 2776	624	d28f799d666a23fda187776242073993.exe	30
PID 2776 wrote to memory of 2848	2776	cmd.exe	32
PID 2776 wrote to memory of 2848	2776	cmd.exe	32
PID 2776 wrote to memory of 2848	2776	cmd.exe	32
PID 2776 wrote to memory of 3056	2776	cmd.exe	35
PID 2776 wrote to memory of 3056	2776	cmd.exe	35
PID 2776 wrote to memory of 3056	2776	cmd.exe	35
PID 2776 wrote to memory of 2612	2776	cmd.exe	39
PID 2776 wrote to memory of 2612	2776	cmd.exe	39
PID 2776 wrote to memory of 2612	2776	cmd.exe	39
PID 2700 wrote to memory of 364	2700	d28f799d666a23fda187776242073993.exe	42
PID 2700 wrote to memory of 364	2700	d28f799d666a23fda187776242073993.exe	42
PID 2700 wrote to memory of 364	2700	d28f799d666a23fda187776242073993.exe	42
PID 2700 wrote to memory of 364	2700	d28f799d666a23fda187776242073993.exe	42
PID 2700 wrote to memory of 364	2700	d28f799d666a23fda187776242073993.exe	42

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\d28f799d666a23fda187776242073993.exe
"C:\Users\Admin\AppData\Local\Temp\d28f799d666a23fda187776242073993.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Local\Temp\d28f799d666a23fda187776242073993.exe
  "C:\Users\Admin\AppData\Local\Temp\d28f799d666a23fda187776242073993.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Users\Admin\AppData\Local\Temp\d28f799d666a23fda187776242073993.exe
    "C:\Users\Admin\AppData\Local\Temp\d28f799d666a23fda187776242073993.exe" n624
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\d28f799d666a23fda187776242073993.exe
      "C:\Users\Admin\AppData\Local\Temp\d28f799d666a23fda187776242073993.exe" n624
      4⤵
      PID:364
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:2848
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:3056
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2612

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2964

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2024

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2884

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\readme-warning.txt

Filesize
1KB

MD5
7c9051a155e7889cb2c4b685bf8d2efa

SHA1
471bac8c7ec83bd2b4b73b5c01d3bdb947542141

SHA256
02f0042dbbd15881b67a8f248db23f60c5968aa82202af0044ccadcd24883990

SHA512
da20c1c975f6c0fb99e91f3fc9dba7f0fd6049acf307d8d9a8ad076fa997021e5573ca0f61c31bb96ce58bfbeed2fd57317c9d8c23019e267f50fe4f9989bde7

Download Submit
C:\Users\Admin\AppData\Roaming\867146652

Filesize
55KB

MD5
5da47c9ae569364b603f95cb2641a182

SHA1
6d08c1dae770fd38dccf41c122ac9e5bd35e4902

SHA256
65a48291f8cb6ee3a84de819241653f3d1b7a1703cdf0520330660814af17801

SHA512
74a999fe7c18c376c7f073d19a8a70711d5b5817650a6168a290f0f9017b0de5a00604e30ab4c4fbb2e92963e13525ff3307104a12893ccb18659146a11ebc11

Download Submit
C:\Users\Admin\AppData\Roaming\867146652

Filesize
56KB

MD5
2e6db06a35101b91362c4744020d836a

SHA1
3908a98168ffaf13d8fd74fc93aefa39602dd8d9

SHA256
7d59ddd9b71e2519dc9aea24782f067b9a0d873f90b0f0b1d3944547cb577b28

SHA512
cbd86769a2ad4189fd54eaef13a6a21f2bf8f78b5c63045610f3e9b10272e353229c0a00dc2a9c4ea495908f0ecd1aa38080fcf17ee1c7837a7a74969a9b0093

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\zsadsadsad\qasdadsdsd.lnk

Filesize
1KB

MD5
e3fdacacfb9bfd6b7e940eb1e77c0c71

SHA1
b268ab7e9f03cbacb20bdebd0ef9ae371c61ad35

SHA256
201b5dcd3008b5b7941dc2743466e3a7a8034e1b6c0206de07d85276e53e70a9

SHA512
793ad3e453249237a9eae49b5f8f886e1d03b1c966478ef80b70e88e02adf52c1543fb1aaac9ec9696577604607f9b0faa646248184d0eaeda6212b08acbba9e

Download Submit
\Users\Admin\AppData\Local\Temp\nst3F14.tmp\System.dll

Filesize
11KB

MD5
fccff8cb7a1067e23fd2e2b63971a8e1

SHA1
30e2a9e137c1223a78a0f7b0bf96a1c361976d91

SHA256
6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

SHA512
f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

Download Submit
memory/364-2059-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/364-718-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/364-719-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/364-2058-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/624-84-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/624-10-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/624-1975-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/624-22-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/624-8-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/624-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/624-17482-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/624-17500-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download