magniber | f3fff0e99b7e8c7a2d8988759f360dfd24b3e7108e4cba7691f40dacd7c310a3

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-01-2024 09:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f786f98ee0c469c2a7eb81cce8f44c6.dll
Size

38KB
MD5

7f786f98ee0c469c2a7eb81cce8f44c6
SHA1

e09daefa41183764a61e4a43704889cbb9172346
SHA256

f3fff0e99b7e8c7a2d8988759f360dfd24b3e7108e4cba7691f40dacd7c310a3
SHA512

039ed6272d95b73a4d6282326b1a26802ae271d005cc871911455f685ae7bfb7bb04ed0f7e30e4721331a6d5783248d12f91ab414df10608411a08bb2cabc431
SSDEEP

768:jVuj0qdq03H5RlWWLHM25c3IitrNo+3ZGMezaXNb5I6:jKZ3BHM2+wwGMezaHd

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://ecbc1228aa7c56d02ehxgpjnwi.hy5tprdl77synlgxroueyzpat4iszkkx52r4i3ufbg6l7b32zqkyc5ad.onion/hxgpjnwi Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://ecbc1228aa7c56d02ehxgpjnwi.metthe.top/hxgpjnwi http://ecbc1228aa7c56d02ehxgpjnwi.sameleg.site/hxgpjnwi http://ecbc1228aa7c56d02ehxgpjnwi.iflook.club/hxgpjnwi http://ecbc1228aa7c56d02ehxgpjnwi.keystwo.uno/hxgpjnwi Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://ecbc1228aa7c56d02ehxgpjnwi.hy5tprdl77synlgxroueyzpat4iszkkx52r4i3ufbg6l7b32zqkyc5ad.onion/hxgpjnwi

http://ecbc1228aa7c56d02ehxgpjnwi.metthe.top/hxgpjnwi

http://ecbc1228aa7c56d02ehxgpjnwi.sameleg.site/hxgpjnwi

http://ecbc1228aa7c56d02ehxgpjnwi.iflook.club/hxgpjnwi

http://ecbc1228aa7c56d02ehxgpjnwi.keystwo.uno/hxgpjnwi

Signatures

Detect magniber ransomware 2 IoCs

resource	yara_rule
behavioral1/memory/2532-1-0x0000000001E70000-0x0000000002652000-memory.dmp	family_magniber
behavioral1/memory/1148-125-0x0000000001B40000-0x0000000001B44000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 10 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	1764	cmd.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	1764	cmd.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	1764	cmd.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	1764	cmd.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	1764	cmd.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	1764	vssadmin.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	1764	vssadmin.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	1764	vssadmin.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	1764	vssadmin.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	1764	vssadmin.exe	47

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (69) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2532 set thread context of 1148	2532	rundll32.exe	13
PID 2532 set thread context of 1220	2532	rundll32.exe	15
PID 2532 set thread context of 1264	2532	rundll32.exe	14
PID 2532 set thread context of 1104	2532	rundll32.exe	21

Interacts with shadow copies 2 TTPs 5 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1724	vssadmin.exe
1640	vssadmin.exe
2348	vssadmin.exe
2088	vssadmin.exe
1748	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000000d082d24dea8bfb47d6e5e45e4f9fdbf3897c756337154207442c6cb17388d94000000000e80000000020000200000003b2067ce344a75a1a8ba87f5fc29a3d813756ba05c96eebc897d3c07fe02305290000000329c1564967e6dd7fac608272b40166e57823cc91d00d7945c7d85112f1e8d4b5e8ce77f54667b999e7b6c842842d23fe5987ed45c8fb6f3a7faef26ba5ba8eb7713544f106a5c06784972729538f51ab9468033acd5e0d97b4f1cbe7754c2cb888b106bd5a5136489f7c137829b86ae51ff33531052b872713d16944c74d0af21d5263ad18fa3ce2b8a1418f804e92c4000000094effe92c124b8c826dec50763cfc8ee518a33f0a4c08e2b4f18a29affa0fe3096554f40b4a6e58bedc674f48ad2f78cd6d34279fce45a1b9c8fcdfc1613e19d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000008aa7edd698d496d2a4478d570bc8052d217d4493228b318d07f63e84e70a263000000000e80000000020000200000001be45bba5955f7027df5c132056b4760b7004a43277f3d4113513b3b6ca964bc200000003c3225f9d95daa826ce9b4ee3e850ce8d89c66b37018cd6e6cf6487be9c6135240000000c021835f01eb13d82de9b35e48b6f0fbaa2ec1fb2de355dca0c9ce7a8c8fb19bc50290cbbceaa70ed7c407fb57ef372c235a21fd1bce779c436390a779836542	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DBF9C651-BE87-11EE-BCDB-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0fc82b19452da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412681991"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\mscfile\shell	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\mscfile\shell\open\command	DllHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\mscfile	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	DllHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\mscfile\shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\mscfile\shell\open\command	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\mscfile\shell\open	taskhost.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2428	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2532	rundll32.exe
2532	rundll32.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2532	rundll32.exe
2532	rundll32.exe
2532	rundll32.exe
2532	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1264	Explorer.EXE
Token: SeShutdownPrivilege	1264	Explorer.EXE
Token: SeShutdownPrivilege	1264	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	2172	WMIC.exe
Token: SeSecurityPrivilege	2172	WMIC.exe
Token: SeTakeOwnershipPrivilege	2172	WMIC.exe
Token: SeLoadDriverPrivilege	2172	WMIC.exe
Token: SeSystemProfilePrivilege	2172	WMIC.exe
Token: SeSystemtimePrivilege	2172	WMIC.exe
Token: SeProfSingleProcessPrivilege	2172	WMIC.exe
Token: SeIncBasePriorityPrivilege	2172	WMIC.exe
Token: SeCreatePagefilePrivilege	2172	WMIC.exe
Token: SeBackupPrivilege	2172	WMIC.exe
Token: SeRestorePrivilege	2172	WMIC.exe
Token: SeShutdownPrivilege	2172	WMIC.exe
Token: SeDebugPrivilege	2172	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2172	WMIC.exe
Token: SeRemoteShutdownPrivilege	2172	WMIC.exe
Token: SeUndockPrivilege	2172	WMIC.exe
Token: SeManageVolumePrivilege	2172	WMIC.exe
Token: 33	2172	WMIC.exe
Token: 34	2172	WMIC.exe
Token: 35	2172	WMIC.exe
Token: SeShutdownPrivilege	1264	Explorer.EXE
Token: SeShutdownPrivilege	1264	Explorer.EXE
Token: SeShutdownPrivilege	1264	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1744	WMIC.exe
Token: SeSecurityPrivilege	1744	WMIC.exe
Token: SeTakeOwnershipPrivilege	1744	WMIC.exe
Token: SeLoadDriverPrivilege	1744	WMIC.exe
Token: SeSystemProfilePrivilege	1744	WMIC.exe
Token: SeSystemtimePrivilege	1744	WMIC.exe
Token: SeProfSingleProcessPrivilege	1744	WMIC.exe
Token: SeIncBasePriorityPrivilege	1744	WMIC.exe
Token: SeCreatePagefilePrivilege	1744	WMIC.exe
Token: SeBackupPrivilege	1744	WMIC.exe
Token: SeRestorePrivilege	1744	WMIC.exe
Token: SeShutdownPrivilege	1744	WMIC.exe
Token: SeDebugPrivilege	1744	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1744	WMIC.exe
Token: SeRemoteShutdownPrivilege	1744	WMIC.exe
Token: SeUndockPrivilege	1744	WMIC.exe
Token: SeManageVolumePrivilege	1744	WMIC.exe
Token: 33	1744	WMIC.exe
Token: 34	1744	WMIC.exe
Token: 35	1744	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2320	WMIC.exe
Token: SeSecurityPrivilege	2320	WMIC.exe
Token: SeTakeOwnershipPrivilege	2320	WMIC.exe
Token: SeLoadDriverPrivilege	2320	WMIC.exe
Token: SeSystemProfilePrivilege	2320	WMIC.exe
Token: SeSystemtimePrivilege	2320	WMIC.exe
Token: SeProfSingleProcessPrivilege	2320	WMIC.exe
Token: SeIncBasePriorityPrivilege	2320	WMIC.exe
Token: SeCreatePagefilePrivilege	2320	WMIC.exe
Token: SeBackupPrivilege	2320	WMIC.exe
Token: SeRestorePrivilege	2320	WMIC.exe
Token: SeShutdownPrivilege	2320	WMIC.exe
Token: SeDebugPrivilege	2320	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2320	WMIC.exe
Token: SeRemoteShutdownPrivilege	2320	WMIC.exe
Token: SeUndockPrivilege	2320	WMIC.exe
Token: SeManageVolumePrivilege	2320	WMIC.exe
Token: 33	2320	WMIC.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2220	iexplore.exe
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1264	Explorer.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
1108	IEXPLORE.EXE
1108	IEXPLORE.EXE
1108	IEXPLORE.EXE
1108	IEXPLORE.EXE

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1264	Explorer.EXE
1264	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 2428	1148	taskhost.exe	28
PID 1148 wrote to memory of 2428	1148	taskhost.exe	28
PID 1148 wrote to memory of 2428	1148	taskhost.exe	28
PID 1148 wrote to memory of 2976	1148	taskhost.exe	30
PID 1148 wrote to memory of 2976	1148	taskhost.exe	30
PID 1148 wrote to memory of 2976	1148	taskhost.exe	30
PID 1148 wrote to memory of 2864	1148	taskhost.exe	29
PID 1148 wrote to memory of 2864	1148	taskhost.exe	29
PID 1148 wrote to memory of 2864	1148	taskhost.exe	29
PID 2864 wrote to memory of 2172	2864	cmd.exe	33
PID 2864 wrote to memory of 2172	2864	cmd.exe	33
PID 2864 wrote to memory of 2172	2864	cmd.exe	33
PID 1220 wrote to memory of 2268	1220	Dwm.exe	34
PID 1220 wrote to memory of 2268	1220	Dwm.exe	34
PID 1220 wrote to memory of 2268	1220	Dwm.exe	34
PID 1264 wrote to memory of 564	1264	Explorer.EXE	35
PID 1264 wrote to memory of 564	1264	Explorer.EXE	35
PID 1264 wrote to memory of 564	1264	Explorer.EXE	35
PID 1104 wrote to memory of 2372	1104	DllHost.exe	38
PID 1104 wrote to memory of 2372	1104	DllHost.exe	38
PID 1104 wrote to memory of 2372	1104	DllHost.exe	38
PID 2268 wrote to memory of 1744	2268	cmd.exe	45
PID 2268 wrote to memory of 1744	2268	cmd.exe	45
PID 2268 wrote to memory of 1744	2268	cmd.exe	45
PID 564 wrote to memory of 2320	564	cmd.exe	44
PID 564 wrote to memory of 2320	564	cmd.exe	44
PID 564 wrote to memory of 2320	564	cmd.exe	44
PID 2532 wrote to memory of 1936	2532	rundll32.exe	41
PID 2532 wrote to memory of 1936	2532	rundll32.exe	41
PID 2532 wrote to memory of 1936	2532	rundll32.exe	41
PID 2372 wrote to memory of 1736	2372	cmd.exe	42
PID 2372 wrote to memory of 1736	2372	cmd.exe	42
PID 2372 wrote to memory of 1736	2372	cmd.exe	42
PID 1936 wrote to memory of 996	1936	cmd.exe	43
PID 1936 wrote to memory of 996	1936	cmd.exe	43
PID 1936 wrote to memory of 996	1936	cmd.exe	43
PID 2976 wrote to memory of 2220	2976	cmd.exe	48
PID 2976 wrote to memory of 2220	2976	cmd.exe	48
PID 2976 wrote to memory of 2220	2976	cmd.exe	48
PID 2720 wrote to memory of 2576	2720	cmd.exe	63
PID 2720 wrote to memory of 2576	2720	cmd.exe	63
PID 2720 wrote to memory of 2576	2720	cmd.exe	63
PID 2132 wrote to memory of 2712	2132	cmd.exe	62
PID 2132 wrote to memory of 2712	2132	cmd.exe	62
PID 2132 wrote to memory of 2712	2132	cmd.exe	62
PID 2820 wrote to memory of 2932	2820	cmd.exe	61
PID 2820 wrote to memory of 2932	2820	cmd.exe	61
PID 2820 wrote to memory of 2932	2820	cmd.exe	61
PID 2972 wrote to memory of 1388	2972	cmd.exe	59
PID 2972 wrote to memory of 1388	2972	cmd.exe	59
PID 2972 wrote to memory of 1388	2972	cmd.exe	59
PID 2852 wrote to memory of 2580	2852	cmd.exe	60
PID 2852 wrote to memory of 2580	2852	cmd.exe	60
PID 2852 wrote to memory of 2580	2852	cmd.exe	60
PID 2712 wrote to memory of 2044	2712	CompMgmtLauncher.exe	73
PID 2712 wrote to memory of 2044	2712	CompMgmtLauncher.exe	73
PID 2712 wrote to memory of 2044	2712	CompMgmtLauncher.exe	73
PID 1388 wrote to memory of 2896	1388	CompMgmtLauncher.exe	71
PID 1388 wrote to memory of 2896	1388	CompMgmtLauncher.exe	71
PID 1388 wrote to memory of 2896	1388	CompMgmtLauncher.exe	71
PID 2932 wrote to memory of 2936	2932	CompMgmtLauncher.exe	70
PID 2932 wrote to memory of 2936	2932	CompMgmtLauncher.exe	70
PID 2932 wrote to memory of 2936	2932	CompMgmtLauncher.exe	70
PID 2580 wrote to memory of 2676	2580	CompMgmtLauncher.exe	69

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\system32\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2428
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2172
- C:\Windows\system32\cmd.exe
  cmd /c "start http://ecbc1228aa7c56d02ehxgpjnwi.metthe.top/hxgpjnwi^&2^&39667080^&69^&351^&12"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://ecbc1228aa7c56d02ehxgpjnwi.metthe.top/hxgpjnwi&2&39667080&69&351&12
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2220
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1108

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f786f98ee0c469c2a7eb81cce8f44c6.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1936
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      PID:996
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2320

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1744

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:1736

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:2576
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1660

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2676

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2936

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2896

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2044

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1748

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1724

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1640

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2348

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2088

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c80f8ae2d3188baaee5bd187913f0da

SHA1
191cd8fed583630040887a803e36eceb304384f5

SHA256
9983d2eed6c251e0f175fa014503f71add12aed3cd65eed567384fda5d602f30

SHA512
22a9a79ac101b4243cd29cae38550df0ebba8030568cd9e609e9020d2f9a2586bd84394d94a66293b285d428f6078957c14c648b2bf3b19443d35c9fcd2da0a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60946221d8bcab83cd4faa79cea5a6ad

SHA1
c37a3ec111b88b9dc79e42ca47a4e5b96e60f169

SHA256
72ba95b1c3e88bcb15417f13cbd238e5a33b6dcec008c6f37c7e7d765c2e4ac5

SHA512
44c7f8292ff43baf1f1a0b4f8e844ac7c92c1379b7276c5d8162adb1952d8c7653c094aa10cc3d39b47a6bb671ce4016c2da113386c409d25ce52e1518746ec4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
702c24e1eecf4f81bb12283bcf431f76

SHA1
81699fd64682e14112c2b58d961e386f25407fa7

SHA256
c38532f9503426a41a499c2bd19dc03999dc0719a68d6babf595d2f0484a00d5

SHA512
5c42b0ddac7d91dfb6c8bf051f29e92b4220db5d853e659b89dab8ed5564fb72f8aa0822aa3dd887d5ec963b3ebe6641b5c5569442d7922bd7aef99d99bf9f6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19fbae42ea09457c05fbe3b1aca2421a

SHA1
d8d9a6081797364d37c9c0a86e6a714c73f921aa

SHA256
6e8021738b1ea99c4a3b216f9a59202b6fe78b7600122aa56a7d6e1d5d568d43

SHA512
b4643f14a19d39ff1c01f45287637b4c0c3c488b0f3d67abe45a8e17d0899c1aa3a2ba3ae1aa2a2bda487b6eeba09e407aa1a304bdffc2928896ee79b8fff01b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bb5b8092ff3c3835c81d8521085a8dd

SHA1
88e41c06d147124dc8ee850b48d1a291df6e5a44

SHA256
405220a00f9505ffc9ed9f3742c91cdedd8972c1fc8f0ab7f177489ffa037dfd

SHA512
d8a846807c34d5a5618353a6d65a275b778c656446c31978cf1f11c37d1c741d1ffe6d9dececc3f4dee33500d68f0cb39fbc9bcefd19d8bf0f89675b99ac9f57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00c1d696179bce2f162621ef4070be83

SHA1
dd50245029d9bf5941e41336d91d9e6ee056c248

SHA256
8678792685532e733a45e48bb5025265ac8435f3811ff1593b5200f6aeb411ff

SHA512
0d5cf0904b7c88a46a53ca39daa1929747176f563cbf976c56bb4ec1872fe1ce508bc717b780ce7958cd069bfeee0d529eb699f230500ecfcf742d45cce8143a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
890a19105365342dcd9ddb3aa0a96afc

SHA1
6a90680d56ffd6b16c4d9d5c1b7475a953d4f18c

SHA256
4d0cc312735a7f7669f3c0e76c2cfcc86d5b03803db64f48fef54b974812da51

SHA512
188742445530a3ee900c379de1fcceb1aad2ebf9d351db6bbc3cb075970c3660b751ef466659120affd19c77e45bafd56941e87079a4c28c2391cb2e401e3086

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b96ce249a750c03d54b1764dfca240c

SHA1
415e0527238a759a688fd0c299009794537939ea

SHA256
f39aa63345cc5330118a06d37311838ec16953ef9626c8d23d99b459605c0ea1

SHA512
320d2a0f6c2aeefa9a850e557ac1fc83e473b239f17a092015a4c9c73923e87a65bde97ed5f1e2dbff14e6897cd849f1b1d22518f31951c9bd086337baca448e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7f2ee6b19fa8d041823aa3aec0e760f

SHA1
ed19ea5311473ee72e5ef582fd87b6fffdbf47d1

SHA256
d5dd6718cf8ace35694739395ac889bdbbdaeca270baa024b3335bcde8ad8839

SHA512
df251477e8d242429e15a8a9917f999017542b8b45d1d14199cf53ba692d8fd328d9d32679ca69ff0acc0509c4e782d99ec01208f37a22c374406a771156d912

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24042c1e7e9b9200022b35b64ba1174a

SHA1
f84f4c2e81d5acc0ec67290ad1f701d55d6f58e4

SHA256
978a0904073e99e0bc1643928d4790c50772ee0310c9a3513498196fdb4dc836

SHA512
d75d7046cb84a4b606e2ea65ee233d7d141b3b45ef650b575e1e8ad229dd758dd25d2390353e4941c51c26f5431f31b6ba608a5543a6dd5dcc0729e3a2bc9758

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
befa39f30fdfc17fee661d35b06e9c9a

SHA1
c7147e552ffc1567c8a7ccacb06bd5370a50b995

SHA256
29847fa84282abd6e215026546c2bca75f356a9cf05bf69881f9848424408d1c

SHA512
10c81ddbd282b22f8570c4b38ba3d99452a6c684ff7b241cf21578620f72682a20b9099a25c154813e8a08dc766327adaad86f7947475b393327e236c9ca1c5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c978318adb1c2a59a450989474f4ba57

SHA1
3dc9d48c0456acdf18ad857b1531702e5f673517

SHA256
377d2190f0d32ffdf42d2f7bc0b573c61b84aec11834deef7500ee23f6aa6c57

SHA512
716847447a1a64d71d025e816d53187f2aefc71ba965de4c1f0e4186e51ed54c4203cdee5f914242e078e90e38e00871899cff70136e92c2746ffab70201766c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bf13b304406f39cd49d298827f819a2

SHA1
32812c2f38003a78ef6832e1e4818c13a16117cf

SHA256
49967463ded1c45152da9d95d540f269c6f7e2f0d8e599b9156b9876976aa589

SHA512
bcade22879c9a01c2c7fa57ae059d2e30b46ac0c3f39d48279a895dde459e6b1170ac0eef8b385492b40f714b4d7dfaee868c9cc5dcff7b789708d210a500420

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc49adb4c2fa6f1643a4841da4037a28

SHA1
ba83363714312e173ca4f46493c16712172ddf12

SHA256
63a949982be68f0e166b3361864b0abdb9c883ecfbea5552fcaef7eec90da75b

SHA512
e6b655c93dbaabe79ca20427da9af199c4301021e02f24498d4a28424c6d3314306db9edaf0992861248f5a9b74618a65f0a2293df12de238e71e9d2b7bbc30c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f17d25bd9d796d2349fee3c22ca00f7

SHA1
e3fb5519be560b84ff9dba39c1d336c5407ebc66

SHA256
e163f5f2dca35ce5b883f104246c12e752d926abc1187d356e3ba136ca55db4a

SHA512
865aec500cd4af52831daff0428c8494e197c1b119024a35829b14c358e723fc3f76b52f3533bc45a5f91970d8282bdd429ba24a6818e18fd706028ad41f1a5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d6b892e8884b6dbe3d853fdbe78839d

SHA1
f8c939ddbcd4af86fb8f2abe31bc32363d256948

SHA256
180a25de937736e8f58d3cbb890b5c156531ea9b5d145ca37b9c75bb3b0858f2

SHA512
122e524db7da1b69f4fa378eb17fe61ab2cd8552cd358bfaceb3fe2e9f83f0499860bf7dce6725af4ad36cedd58ae766d2aee175da9afb0683e3ba07948d6a2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7bb7633e1305975f5c5b59a658a8c3c

SHA1
7927ee176c22eebb0c9391ceac452af944b07f21

SHA256
85e6caa240fde305af3c50a815e12cda16dc4897243a3ce122d3507c9f459bf4

SHA512
7eaacb1d9ca05fca068e10d317d6f3cd962f7c3ef7faba3c9a1225ed0e8b509c465e36fa4e2ad84311d7f50bbd1f67e6b6dda7ff63486490550bb5ae38e41106

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.log

Filesize
512KB

MD5
70778836a4692c17718d8f6cb976ae2b

SHA1
c3a26af72f6a4985b7b644cfbee4ca3c8cb8e52f

SHA256
c8433b7b86da986fd14b67cadda32169d554fdee87b143fc2beb947055eb70e5

SHA512
87ee0e195e16adf8f14736317aa43f43c9047dc1c7b79cff507a05446671fe5ab3925a8fb31f536536164de4a0195ed903731fb7c22f5038bec05f59f3783667

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab68C4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6A9B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\Desktop\AssertExpand.xlt.hxgpjnwi

Filesize
311KB

MD5
62144f4d005868268e6bf8b56c7f7d90

SHA1
b336d1b0e3e5c933ee2bf626e36155fc5428c04b

SHA256
8531a405c81ad9bf0ef923db4605fff0069374a7c04ece445cdefb561e18132f

SHA512
c9550c97f8c153b353c9ac9ff4d7771d033f9c1f2439717e9630796ca7d1c46a5aa26b5f5a9a8a1dcb498e532a6aa885607262d48b421068f3624d6e5e5aa4e5

Download Submit
C:\Users\Admin\Desktop\BlockRedo.vbs.hxgpjnwi

Filesize
162KB

MD5
9b3050af09e3ea5460b423ec4afcaa55

SHA1
9c2d27328535032edffadd60ad26ef486292c9bf

SHA256
4d1825329de0b2dfa5d5f9776b8356a315821df242fdd2b8c03d2900313ad2c1

SHA512
a98648eca3368f4ad825e197c31b887d35e336c7b0611abae4ac48267a59fd8a5bed2b4e499f6f6b9104c1f013761dffc5e427d3473f92d643298d50107e80a2

Download Submit
C:\Users\Admin\Desktop\ConnectConfirm.jtx.hxgpjnwi

Filesize
236KB

MD5
33555a6626e30c2238d035aab9926fbd

SHA1
0f29ac48b9b2888c2b8918a7bb43ebe3b5e30e54

SHA256
92b9d8d3392c0b0fe2d71866e3a4a8d935b2565e42093315a35f3a7292c2f71a

SHA512
5fbf7650b8067c7f6a7bcf4f59d32b07c0c1b99051d812c7e31c759543872b0181488a0ba19ec9f33ec23e817e891802f0c441e94e648a2e0fac672e432835bd

Download Submit
C:\Users\Admin\Desktop\DismountRepair.wav.hxgpjnwi

Filesize
286KB

MD5
84041bf166893015a16e2d342d30ce02

SHA1
d855b9ca39d46cbcf464876e7ddbcd4111b1ab90

SHA256
9c4849c48c26a830353f8600a10d64bb0e880f28e4bf2d6f584b2ee89238a21b

SHA512
512446202ad2caff8a7da03da06380de67be2a1057d041e3a7cccafbcef46974254c022ed65b19a1ac09f7484629ad583fc79a441ee4623ebae03f84bc99c535

Download Submit
C:\Users\Admin\Desktop\FindGrant.dotx.hxgpjnwi

Filesize
373KB

MD5
7b899b39f60e6a126e7291b7d25b6a66

SHA1
8dcd60c8cc8ee61b3bfe66670ffb6f769bc9241f

SHA256
28f5e26327d6789f1e1164fcc2ca09d2a14b73efc63bc7e656a1c84548749002

SHA512
fe6506442f89f5f066d78e0511db783ccd2465bdbcd312621b36721abc02a91b6c4185b6ab5a3b4b7c62e8e90c75cf0b28161b372c6d9d0e6e77a86f382a5180

Download Submit
C:\Users\Admin\Desktop\HideRename.xls.hxgpjnwi

Filesize
423KB

MD5
e0df963adde5674bea8a84c09015805a

SHA1
b587840fbeb50cea92bd582dc3420ba4d9dc5e90

SHA256
14a3a2206626fe9cf1b4aaf1f51aba987c07b52cb5d860fa266988ab29331769

SHA512
c1b938cb00fc0b265fecb43f808d35a84ccc0782f7188b72ebade69f1699c12a28e871b7f102c04047dc31898a2d4ff64c99aa456b34c910a30349c4064e6435

Download Submit
C:\Users\Admin\Desktop\JoinSwitch.pptx.hxgpjnwi

Filesize
224KB

MD5
99f82e43cf1490ba1ee7594bb21cb4b3

SHA1
ac866ab5071278e893b73b6b4f2b25ca2cc9a9ab

SHA256
dcd8957e77289c4f70311bc60a8c1fa97ce25e64632deab2949437368eceac97

SHA512
d1eb8f3370bec05bbb0e2520e0a5d8db9cbde68da69de0b0934fdd152ba12d2e7ff890be46a9e0b02d5ea10002e060c4e943e712c6c12023c9a5f89ed9d8307e

Download Submit
C:\Users\Admin\Desktop\LockOut.png.hxgpjnwi

Filesize
386KB

MD5
7d2353b365e6816e55083905840eae7b

SHA1
aeea14b2ef64c4249311c0ee576616c473273767

SHA256
af79ee41a59452217e421789dceb760857e745f288211205d657cd6a9c97f955

SHA512
d898ced876f6e4c044ff084327efd4e73e1602c2cdfd7fd5eef7a6c3fc8c8525754b8ca1aaedc8d8bd42054c961755c266af8fa880d0c8c3ba792934e0f5187d

Download Submit
C:\Users\Admin\Desktop\MeasureEnter.crw.hxgpjnwi

Filesize
149KB

MD5
c6c3e63fa8342c87be2d4bd8a6e35714

SHA1
da2e2ad9f872132d80c0551ae2345fe070ff9208

SHA256
9952883ff3092403039792b50be5b7bd9df056bbe5893abc00573df338bafbf4

SHA512
7526800025f69d17df36e895ca9040b25a00539cd5905fb8f08f56a99957107433653d79857bfa7ecc45dcd61f4d7ee90483c4f612e8f060e3ac6c0234a1addd

Download Submit
C:\Users\Admin\Desktop\MoveRepair.xltx.hxgpjnwi

Filesize
348KB

MD5
c161622658295340c94ca79add05c2eb

SHA1
4ca38e9edeee9e0d7f44f8ea76bbecba81131afa

SHA256
ed60617ce0dbe67b52d64b80808fe692ca7e958a613f6d4a55ad7cecd39d5a26

SHA512
651d838e9042f2cda0a8ecf68c7053e79de1d25c2ae78e379386baaa578721ebb02a7dfecbf9bba25ace59c99d4056f3409eafcff38c30fc2e29b9cdce7684a7

Download Submit
C:\Users\Admin\Desktop\TestUse.pdf.hxgpjnwi

Filesize
261KB

MD5
2dc9029a3e2212d2456ca10143a5ef3e

SHA1
88b89e8d83f218a0759af34571badbc848c75320

SHA256
80d6a5181ffd8cb234693bcf0b41f31c68d68ad37dba74b4932a248af32050e2

SHA512
ae7cd31d290badebccc4c5f7122e829b3313e29f1dca0784223bd9c4fcf066cfa96610cea0781e75ecf5d649e33865999aca36a38dd17f7931cc559943f82e4e

Download Submit
C:\Users\Admin\Pictures\readme.txt

Filesize
1KB

MD5
897fdfc0c55544497613f2e6127738cd

SHA1
be06fef37936f934f203abb907f3a9828eea35ac

SHA256
179a2f757b8706d3a4c7b934ae2cc38c85f97913d0309bb55da7126e56749512

SHA512
19c09934031bdaf025bf2c6d2faa97c7916aafd07abb7c8c7826cc34187102ed4f8cbfb087f401c6a3897b4d0fa38632e2793993c8d18908084dcd3ffe7fca9f

Download Submit
memory/1104-274-0x0000000001D30000-0x0000000001D40000-memory.dmp

Filesize
64KB

Download
memory/1104-286-0x0000000002400000-0x0000000002408000-memory.dmp

Filesize
32KB

Download
memory/1104-268-0x0000000000470000-0x0000000000480000-memory.dmp

Filesize
64KB

Download
memory/1148-0-0x0000000001B40000-0x0000000001B44000-memory.dmp

Filesize
16KB

Download
memory/1148-125-0x0000000001B40000-0x0000000001B44000-memory.dmp

Filesize
16KB

Download
memory/2532-124-0x0000000001CC0000-0x0000000001CC1000-memory.dmp

Filesize
4KB

Download
memory/2532-121-0x0000000001CB0000-0x0000000001CB1000-memory.dmp

Filesize
4KB

Download
memory/2532-127-0x0000000002870000-0x0000000002871000-memory.dmp

Filesize
4KB

Download
memory/2532-103-0x0000000001C90000-0x0000000001C91000-memory.dmp

Filesize
4KB

Download
memory/2532-114-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Filesize
4KB

Download
memory/2532-90-0x0000000001C60000-0x0000000001C61000-memory.dmp

Filesize
4KB

Download
memory/2532-86-0x0000000001C50000-0x0000000001C51000-memory.dmp

Filesize
4KB

Download
memory/2532-73-0x0000000001C40000-0x0000000001C41000-memory.dmp

Filesize
4KB

Download
memory/2532-56-0x0000000001C30000-0x0000000001C31000-memory.dmp

Filesize
4KB

Download
memory/2532-46-0x0000000001C20000-0x0000000001C21000-memory.dmp

Filesize
4KB

Download
memory/2532-44-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2532-23-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2532-1-0x0000000001E70000-0x0000000002652000-memory.dmp

Filesize
7.9MB

Download