wannacry | 283f40e9d550833bec101a24fd6fd6fbd9937ed32a51392e818ffff662a1d30a

Analysis

max time kernel
598s
max time network
548s
platform
windows7_x64
resource
win7-20231215-es
resource tags

arch:x64arch:x86image:win7-20231215-eslocale:es-esos:windows7-x64systemwindows
submitted
31-01-2024 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[email protected]
Size

3.4MB
MD5

84c82835a5d21bbcf75a61706d8ab549
SHA1

5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
SHA256

ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
SHA512

90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
SSDEEP

98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB

Score

10^/10

wannacry discovery persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Documents\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Drops startup file 1 IoCs

Processes:

[email protected]

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD7564.tmp	[email protected]

Executes dropped EXE 61 IoCs

Processes:

taskdl.exe@[email protected]@[email protected]taskhsvc.exetaskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exe

pid	process
2592	taskdl.exe
2864	@[email protected]
2800	@[email protected]
720	taskhsvc.exe
1600	taskdl.exe
2392	taskse.exe
2300	@[email protected]
2320	taskdl.exe
2076	taskse.exe
1216	@[email protected]
2336	taskdl.exe
3044	taskse.exe
1984	@[email protected]
2556	taskdl.exe
1572	taskse.exe
1976	@[email protected]
1544	taskdl.exe
2332	taskse.exe
2488	@[email protected]
1396	taskdl.exe
880	taskse.exe
1828	@[email protected]
1424	taskse.exe
2308	@[email protected]
2000	taskdl.exe
2268	taskse.exe
1360	@[email protected]
1096	taskdl.exe
920	taskse.exe
784	@[email protected]
2868	taskdl.exe
1736	taskse.exe
832	@[email protected]
1804	taskdl.exe
1020	taskse.exe
1724	@[email protected]
548	taskdl.exe
496	taskse.exe
2128	@[email protected]
1216	taskdl.exe
2000	taskse.exe
988	@[email protected]
1536	taskdl.exe
1096	taskse.exe
2336	@[email protected]
1752	taskdl.exe
2116	taskse.exe
924	@[email protected]
2656	taskdl.exe
832	taskse.exe
2120	@[email protected]
2004	taskdl.exe
1972	taskse.exe
1260	@[email protected]
1020	taskdl.exe
1912	taskse.exe
2040	@[email protected]
1744	taskdl.exe
2348	taskse.exe
2764	@[email protected]
2728	taskdl.exe

Loads dropped DLL 64 IoCs

Processes:

[email protected]cscript.execmd.exe@[email protected]taskhsvc.exe

pid	process
3068	[email protected]
3068	[email protected]
1492	cscript.exe
3068	[email protected]
3068	[email protected]
2804	cmd.exe
2804	cmd.exe
2864	@[email protected]
2864	@[email protected]
720	taskhsvc.exe
720	taskhsvc.exe
720	taskhsvc.exe
720	taskhsvc.exe
720	taskhsvc.exe
720	taskhsvc.exe
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2840 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2840	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\trgycfjccrcgwd282 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tasksche.exe\""	reg.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

[email protected]@[email protected]

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2196 vssadmin.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2912 reg.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

taskhsvc.exe

pid process

720 taskhsvc.exe
720 taskhsvc.exe
720 taskhsvc.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

@[email protected]

pid process

2300 @[email protected]

pid	process
2196	vssadmin.exe

pid	process
2912	reg.exe

pid	process
720	taskhsvc.exe
720	taskhsvc.exe
720	taskhsvc.exe

pid	process
2300	@[email protected]

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exeWMIC.exetaskse.exetaskse.exetaskse.exetaskse.exetaskse.exetaskse.exetaskse.exetaskse.exetaskse.exetaskse.exetaskse.exe

description	pid	process
Token: SeBackupPrivilege	2184	vssvc.exe
Token: SeRestorePrivilege	2184	vssvc.exe
Token: SeAuditPrivilege	2184	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1896	WMIC.exe
Token: SeSecurityPrivilege	1896	WMIC.exe
Token: SeTakeOwnershipPrivilege	1896	WMIC.exe
Token: SeLoadDriverPrivilege	1896	WMIC.exe
Token: SeSystemProfilePrivilege	1896	WMIC.exe
Token: SeSystemtimePrivilege	1896	WMIC.exe
Token: SeProfSingleProcessPrivilege	1896	WMIC.exe
Token: SeIncBasePriorityPrivilege	1896	WMIC.exe
Token: SeCreatePagefilePrivilege	1896	WMIC.exe
Token: SeBackupPrivilege	1896	WMIC.exe
Token: SeRestorePrivilege	1896	WMIC.exe
Token: SeShutdownPrivilege	1896	WMIC.exe
Token: SeDebugPrivilege	1896	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1896	WMIC.exe
Token: SeRemoteShutdownPrivilege	1896	WMIC.exe
Token: SeUndockPrivilege	1896	WMIC.exe
Token: SeManageVolumePrivilege	1896	WMIC.exe
Token: 33	1896	WMIC.exe
Token: 34	1896	WMIC.exe
Token: 35	1896	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1896	WMIC.exe
Token: SeSecurityPrivilege	1896	WMIC.exe
Token: SeTakeOwnershipPrivilege	1896	WMIC.exe
Token: SeLoadDriverPrivilege	1896	WMIC.exe
Token: SeSystemProfilePrivilege	1896	WMIC.exe
Token: SeSystemtimePrivilege	1896	WMIC.exe
Token: SeProfSingleProcessPrivilege	1896	WMIC.exe
Token: SeIncBasePriorityPrivilege	1896	WMIC.exe
Token: SeCreatePagefilePrivilege	1896	WMIC.exe
Token: SeBackupPrivilege	1896	WMIC.exe
Token: SeRestorePrivilege	1896	WMIC.exe
Token: SeShutdownPrivilege	1896	WMIC.exe
Token: SeDebugPrivilege	1896	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1896	WMIC.exe
Token: SeRemoteShutdownPrivilege	1896	WMIC.exe
Token: SeUndockPrivilege	1896	WMIC.exe
Token: SeManageVolumePrivilege	1896	WMIC.exe
Token: 33	1896	WMIC.exe
Token: 34	1896	WMIC.exe
Token: 35	1896	WMIC.exe
Token: SeTcbPrivilege	2392	taskse.exe
Token: SeTcbPrivilege	2392	taskse.exe
Token: SeTcbPrivilege	2076	taskse.exe
Token: SeTcbPrivilege	2076	taskse.exe
Token: SeTcbPrivilege	3044	taskse.exe
Token: SeTcbPrivilege	3044	taskse.exe
Token: SeTcbPrivilege	1572	taskse.exe
Token: SeTcbPrivilege	1572	taskse.exe
Token: SeTcbPrivilege	2332	taskse.exe
Token: SeTcbPrivilege	2332	taskse.exe
Token: SeTcbPrivilege	880	taskse.exe
Token: SeTcbPrivilege	880	taskse.exe
Token: SeTcbPrivilege	1424	taskse.exe
Token: SeTcbPrivilege	1424	taskse.exe
Token: SeTcbPrivilege	2268	taskse.exe
Token: SeTcbPrivilege	2268	taskse.exe
Token: SeTcbPrivilege	920	taskse.exe
Token: SeTcbPrivilege	920	taskse.exe
Token: SeTcbPrivilege	1736	taskse.exe
Token: SeTcbPrivilege	1736	taskse.exe
Token: SeTcbPrivilege	1020	taskse.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	process
2864	@[email protected]
2800	@[email protected]
2864	@[email protected]
2800	@[email protected]
2300	@[email protected]
2300	@[email protected]
1216	@[email protected]
1984	@[email protected]
1976	@[email protected]
2488	@[email protected]
1828	@[email protected]
2308	@[email protected]
1360	@[email protected]
784	@[email protected]
832	@[email protected]
1724	@[email protected]
2128	@[email protected]
988	@[email protected]
2336	@[email protected]
924	@[email protected]
2120	@[email protected]
1260	@[email protected]
2040	@[email protected]
2764	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

[email protected]cmd.execmd.exe@[email protected]@[email protected]cmd.exe

description	pid	process	target process
PID 3068 wrote to memory of 2872	3068	[email protected]	attrib.exe
PID 3068 wrote to memory of 2872	3068	[email protected]	attrib.exe
PID 3068 wrote to memory of 2872	3068	[email protected]	attrib.exe
PID 3068 wrote to memory of 2872	3068	[email protected]	attrib.exe
PID 3068 wrote to memory of 2840	3068	[email protected]	icacls.exe
PID 3068 wrote to memory of 2840	3068	[email protected]	icacls.exe
PID 3068 wrote to memory of 2840	3068	[email protected]	icacls.exe
PID 3068 wrote to memory of 2840	3068	[email protected]	icacls.exe
PID 3068 wrote to memory of 2592	3068	[email protected]	taskdl.exe
PID 3068 wrote to memory of 2592	3068	[email protected]	taskdl.exe
PID 3068 wrote to memory of 2592	3068	[email protected]	taskdl.exe
PID 3068 wrote to memory of 2592	3068	[email protected]	taskdl.exe
PID 3068 wrote to memory of 1740	3068	[email protected]	cmd.exe
PID 3068 wrote to memory of 1740	3068	[email protected]	cmd.exe
PID 3068 wrote to memory of 1740	3068	[email protected]	cmd.exe
PID 3068 wrote to memory of 1740	3068	[email protected]	cmd.exe
PID 1740 wrote to memory of 1492	1740	cmd.exe	cscript.exe
PID 1740 wrote to memory of 1492	1740	cmd.exe	cscript.exe
PID 1740 wrote to memory of 1492	1740	cmd.exe	cscript.exe
PID 1740 wrote to memory of 1492	1740	cmd.exe	cscript.exe
PID 3068 wrote to memory of 900	3068	[email protected]	attrib.exe
PID 3068 wrote to memory of 900	3068	[email protected]	attrib.exe
PID 3068 wrote to memory of 900	3068	[email protected]	attrib.exe
PID 3068 wrote to memory of 900	3068	[email protected]	attrib.exe
PID 3068 wrote to memory of 2864	3068	[email protected]	@[email protected]
PID 3068 wrote to memory of 2864	3068	[email protected]	@[email protected]
PID 3068 wrote to memory of 2864	3068	[email protected]	@[email protected]
PID 3068 wrote to memory of 2864	3068	[email protected]	@[email protected]
PID 3068 wrote to memory of 2804	3068	[email protected]	cmd.exe
PID 3068 wrote to memory of 2804	3068	[email protected]	cmd.exe
PID 3068 wrote to memory of 2804	3068	[email protected]	cmd.exe
PID 3068 wrote to memory of 2804	3068	[email protected]	cmd.exe
PID 2804 wrote to memory of 2800	2804	cmd.exe	@[email protected]
PID 2804 wrote to memory of 2800	2804	cmd.exe	@[email protected]
PID 2804 wrote to memory of 2800	2804	cmd.exe	@[email protected]
PID 2804 wrote to memory of 2800	2804	cmd.exe	@[email protected]
PID 2864 wrote to memory of 720	2864	@[email protected]	taskhsvc.exe
PID 2864 wrote to memory of 720	2864	@[email protected]	taskhsvc.exe
PID 2864 wrote to memory of 720	2864	@[email protected]	taskhsvc.exe
PID 2864 wrote to memory of 720	2864	@[email protected]	taskhsvc.exe
PID 2800 wrote to memory of 1092	2800	@[email protected]	cmd.exe
PID 2800 wrote to memory of 1092	2800	@[email protected]	cmd.exe
PID 2800 wrote to memory of 1092	2800	@[email protected]	cmd.exe
PID 2800 wrote to memory of 1092	2800	@[email protected]	cmd.exe
PID 1092 wrote to memory of 2196	1092	cmd.exe	vssadmin.exe
PID 1092 wrote to memory of 2196	1092	cmd.exe	vssadmin.exe
PID 1092 wrote to memory of 2196	1092	cmd.exe	vssadmin.exe
PID 1092 wrote to memory of 2196	1092	cmd.exe	vssadmin.exe
PID 1092 wrote to memory of 1896	1092	cmd.exe	WMIC.exe
PID 1092 wrote to memory of 1896	1092	cmd.exe	WMIC.exe
PID 1092 wrote to memory of 1896	1092	cmd.exe	WMIC.exe
PID 1092 wrote to memory of 1896	1092	cmd.exe	WMIC.exe
PID 3068 wrote to memory of 1600	3068	[email protected]	taskdl.exe
PID 3068 wrote to memory of 1600	3068	[email protected]	taskdl.exe
PID 3068 wrote to memory of 1600	3068	[email protected]	taskdl.exe
PID 3068 wrote to memory of 1600	3068	[email protected]	taskdl.exe
PID 3068 wrote to memory of 2392	3068	[email protected]	taskse.exe
PID 3068 wrote to memory of 2392	3068	[email protected]	taskse.exe
PID 3068 wrote to memory of 2392	3068	[email protected]	taskse.exe
PID 3068 wrote to memory of 2392	3068	[email protected]	taskse.exe
PID 3068 wrote to memory of 2300	3068	[email protected]	@[email protected]
PID 3068 wrote to memory of 2300	3068	[email protected]	@[email protected]
PID 3068 wrote to memory of 2300	3068	[email protected]	@[email protected]
PID 3068 wrote to memory of 2300	3068	[email protected]	@[email protected]

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2872 attrib.exe
900 attrib.exe

pid	process
2872	attrib.exe
900	attrib.exe

C:\Users\Admin\AppData\Local\Temp\[email protected]
"C:\Users\Admin\AppData\Local\Temp\[email protected]"
1⤵
- Drops startup file
- Loads dropped DLL
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\SysWOW64\attrib.exe
attrib +h .
2⤵
- Views/modifies file attributes
PID:2872

C:\Windows\SysWOW64\icacls.exe
icacls . /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2840

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2592

C:\Windows\SysWOW64\cmd.exe
cmd /c 26131706720552.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\cscript.exe
cscript.exe //nologo m.vbs
3⤵
- Loads dropped DLL
PID:1492

C:\Windows\SysWOW64\attrib.exe
attrib +h +s F:\$RECYCLE
2⤵
- Views/modifies file attributes
PID:900

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected] co
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864

C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
TaskData\Tor\taskhsvc.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:720

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b @[email protected] vs
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected] vs
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
4⤵
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
5⤵
- Interacts with shadow copies
PID:2196

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1600

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2300

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "trgycfjccrcgwd282" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
2⤵
PID:2164

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "trgycfjccrcgwd282" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
3⤵
- Adds Run key to start application
- Modifies registry key
PID:2912

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2320

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1216

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2076

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2336

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1984

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2556

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1572

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1976

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1544

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2332

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2488

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1396

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:880

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1828

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2308

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2000

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2268

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1360

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1096

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:920

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:784

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2868

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1736

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:832

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1804

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1020

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1724

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:548

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
2⤵
- Executes dropped EXE
PID:496

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2128

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1216

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
2⤵
- Executes dropped EXE
PID:2000

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:988

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1536

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
2⤵
- Executes dropped EXE
PID:1096

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2336

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1752

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
2⤵
- Executes dropped EXE
PID:2116

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:924

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2656

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
2⤵
- Executes dropped EXE
PID:832

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2120

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2004

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
2⤵
- Executes dropped EXE
PID:1972

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1260

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1020

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
2⤵
- Executes dropped EXE
PID:1912

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2040

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1744

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
2⤵
- Executes dropped EXE
PID:2348

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2764

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2728

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\00000000.res

Filesize
136B

MD5
5efd05092c959dfb6899423cf996ab83

SHA1
f1a9ae39f5fa291bf4b7055d0d8cedef0d9b1ec7

SHA256
d6199dd7f48ae5371ed1900e2582276c82cdd1526c01220fa106f11235fffcf2

SHA512
e8dc7b0ea23aa45a6be78d51d99fd6d72ac1978570424d4b7b86cdc28e0dfc4858916d96113e2c1f9040423a3edbf90a8c449b79f0ad3e2c5c107e8e97189149

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.WNCRYT

Filesize
439KB

MD5
88b545fcff6e6e69927b06afb77ef20b

SHA1
8c63774b91f486123e17b33b204f7e5d381d5cc5

SHA256
5a831195a8aa82a483cde7682f8cb65da95eb447bfa0a139dd74def4f9a63a0b

SHA512
3a4358267858aa8f780aeb6bf197a27d5e09123259b5fdb7ebadc6619e66f7cf991cd810b9025ef2517865d2100681d79dd52b52a728afee8193aa7f15af2baa

Download Submit
C:\Users\Admin\AppData\Local\Temp\10.WNCRYT

Filesize
11KB

MD5
565825920ac7d8a84f288c3a01ace8f5

SHA1
0455fff305a5c4ad52820131e754ce0984d06504

SHA256
6b3187ab777c4008c50f6621a0f1719b296c353b1601eeab9fe7fafc6ff85e26

SHA512
cc99be5fce6a27230ec63dbf2dc356d23589110f405b6a1bb16fe6b4c1e3cc6014e9b1d55c59d2d94fa00a8c3104d1169a64826809c074f285a6f130b77a8788

Download Submit
C:\Users\Admin\AppData\Local\Temp\11.WNCRYT

Filesize
11KB

MD5
54afb63eae58c9120504ba62817dc8aa

SHA1
df5b581921712cff11902cd9b9eab1536ce68a0a

SHA256
811a316d149282870c7eda3b56bb7df130f2a5cb3b31ca0bd6544eba3e5fc4a3

SHA512
bbe2c24ead39a47a024d8c067f678b8cf6a9aee6ffb3460a0a0a64451ff0e70d057c7ea27098165eac2f2557e80d72750428cf1c9d6e78887d8c9026a2c60127

Download Submit
C:\Users\Admin\AppData\Local\Temp\12.WNCRYT

Filesize
11KB

MD5
705bc5bd9517ce0c7d5191f5e82e8e82

SHA1
8689b5f932bdb1e3c0bf447d083179b987009be5

SHA256
7a168e01fb4601dae5d5441f0938e7c59e2579ccc7ea1e3331d2ea946717a8cc

SHA512
e3e962ac65cf39c869a519bc25aac921328d87c8b6949c16640a4ae3e7c445bd3441f3c85fec97688cda7eacb47c896ea523e28de1d9eae768c85a7a3818863f

Download Submit
C:\Users\Admin\AppData\Local\Temp\13.WNCRYT

Filesize
1.1MB

MD5
c349e3655655aecaae516fa4db4f8fc6

SHA1
64eabe21d5bb9530a421934da328cdae48553494

SHA256
f980bf3058c25817d175a72628718f05564ba691fa3ddfa94cd25fb45624cf6d

SHA512
fda7d8bf0e59d7c804fb36a5d2f9e2309902d92c7096c08822402a6bd2e2a3c719de1b4c6973a4a81d64e33905363f1b4b5fd3e9ae5da2c2becc63a23d786b58

Download Submit
C:\Users\Admin\AppData\Local\Temp\14.WNCRYT

Filesize
1.5MB

MD5
0c3533eb5fefe4795cfac940b12c0471

SHA1
daedade15cb4d771b39c791d1feaa2a0cd3ead82

SHA256
344f291f08903f6b3e68ea08836b12782602adcb47eb2b1cae8c36f644dadc39

SHA512
a8c97bae9aa26489b50b43ae5612bc63a96a3b41f211f2f1dccb4e7076c2ddfab4d1c392c3ebf6dfff61042887551c4758310a66ff382b9f36908ffdb38595af

Download Submit
C:\Users\Admin\AppData\Local\Temp\26131706720552.bat

Filesize
340B

MD5
3867f2ec82a7d77c9ffefb1aac8b7903

SHA1
06fccf19b9c498b5afa2b35da00e3ab28d56f785

SHA256
4e25c23aa5babc853889d3e1e79bb01ca7650837b250314a8d50f2e2c4b6730f

SHA512
b413994e5b9f0ecb956055c7befff14845b56bb658fd8280d3213fdfa175ff76bc56e082174f2475fdf2d1f9eff618ebfd80ee2b67c091eaf1fd9c94697da5aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\@[email protected]

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\@[email protected]

Filesize
920B

MD5
ff1916dda46daf446d4f01754c7b8ef3

SHA1
0d3992b45c3cf7506e3df2f0f6ea1930f9932cb9

SHA256
6508cc097d814a452bd29bad68975935088908d674d734ad1634263862a2365a

SHA512
5823c5860403a6db4d3c8e30312d5f57d140ffc193211f5655b31b51f65cb15eff1bb3e418536c50b374d955720633d58760c27e57f0863352a08ee9db8c236c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\LIBEAY32.dll

Filesize
411KB

MD5
d8197cdf8f46bc7bc029b50d68d153e9

SHA1
be46a23eedd1b365128229b17a147f99152168f9

SHA256
7b58112aa545ddcbd87930e7d103c4a52950f10195bdb18e9417ba960147e2e9

SHA512
70cb34b75e1febe4f748a4d5f64fc9345e8c26d89b188dc93615b1d6dd2126e48dc6d379d7d6dc18f60405e31e4b56023fb3817410878a6f952fca2fd280cc36

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\SSLEAY32.dll

Filesize
384KB

MD5
0d848937bde49b01d5b3c539bb339337

SHA1
708c0dce5d9b4b93d8f1148ece035704dbf6e77c

SHA256
0d0bcd85abacde88f9e25a7e76fb9cd3b69280c7b8fe01bbc41cf48b4721246e

SHA512
176a4009f528ed5ab567ade507df961bdb865dfa910f3853821861f64b864fecc31c18a7c101ce864251ae316d48173aad7c5b9acfd43e26bcd43e8db31ac871

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\libgcc_s_sjlj-1.dll

Filesize
510KB

MD5
73d4823075762ee2837950726baa2af9

SHA1
ebce3532ed94ad1df43696632ab8cf8da8b9e221

SHA256
9aeccf88253d4557a90793e22414868053caaab325842c0d7acb0365e88cd53b

SHA512
8f4a65bd35ed69f331769aaf7505f76dd3c64f3fa05cf01d83431ec93a7b1331f3c818ac7008e65b6f1278d7e365ed5940c8c6b8502e77595e112f1faca558b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe

Filesize
1.3MB

MD5
48a46c8074e1829a283ba5df59d2f951

SHA1
1ccb30e2cece830f8f2246f817f3d39d0a2971a3

SHA256
2b01b24c8d805b24d4ad5513b897e03c789fc4d958f20048dab16d9a7eb6f94b

SHA512
bb68b6ed5e0f7750a75ccbede2f85339caecf990f478030bc5532634f06d97bf3df07e51499f8e48d526732ff41c81c4f7543978fc294afcf4a586aeee770e3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe

Filesize
768KB

MD5
575023927c118eb97b26a9b2bc41b058

SHA1
160bd1467894c86d44666ac2d0020936dd9d9a8d

SHA256
aa1e22933a8ff04f7a2749beab887a9deddf579a02fef3275a429ca7fd1f79f1

SHA512
4ac74710cbe6cea287daac238b42a6bc8b89ce7404c0393529fd84e4673ed4d77951a13ee8d5daed9b278febe94f7b6125b4de4b59e8e5ccdb927b1e45a3555c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\zlib1.dll

Filesize
105KB

MD5
fb072e9f69afdb57179f59b512f828a4

SHA1
fe71b70173e46ee4e3796db9139f77dc32d2f846

SHA256
66d653397cbb2dbb397eb8421218e2c126b359a3b0decc0f31e297df099e1383

SHA512
9d157fece0dc18afe30097d9c4178ae147cc9d465a6f1d35778e1bff1efca4734dd096e95d35faea32da8d8b4560382338ba9c6c40f29047f1cc0954b27c64f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\b.wnry

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.wnry

Filesize
780B

MD5
93f33b83f1f263e2419006d6026e7bc1

SHA1
1a4b36c56430a56af2e0ecabd754bf00067ce488

SHA256
ef0ed0b717d1b956eb6c42ba1f4fd2283cf7c8416bed0afd1e8805ee0502f2b4

SHA512
45bdd1a9a3118ee4d3469ee65a7a8fdb0f9315ca417821db058028ffb0ed145209f975232a9e64aba1c02b9664c854232221eb041d09231c330ae510f638afac

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.wnry

Filesize
780B

MD5
e91a24c9e9eb42645969b8c6fd57a05e

SHA1
e430fe9a8f24bef404c7d51f99bdff434b87c78d

SHA256
ff2436d6e6df9e59245c3a40f8d2d07fd1a075577f4c6f5f1486f5ec54a2371f

SHA512
b3638d4834b263bed172272546a496d75924e25ca56d524a72d2c8d820da1e8d408d2d711c4076c0bbeab17a98c700b8cfcd423ee6f9ba364f2b0b200bb71f7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\m.vbs

Filesize
219B

MD5
82a1fc4089755cb0b5a498ffdd52f20f

SHA1
0a8c0da8ef0354f37241e2901cf82ec9ce6474aa

SHA256
7fbdc49f4b4ba21949eca0b16c534b4882da97e94e5ca131cec1629e60439dfa

SHA512
1573a0c7333accef2695efefe1b57cba8f8d66a0061c24420ee0a183343a9a319995267d306ee85084c95580f9855bcdf9dee559b28a200b27fc3cc353315e78

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_Spanish.wnry

Filesize
36KB

MD5
8d61648d34cba8ae9d1e2a219019add1

SHA1
2091e42fc17a0cc2f235650f7aad87abf8ba22c2

SHA256
72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

SHA512
68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\s.wnry

Filesize
2.9MB

MD5
ad4c9de7c8c40813f200ba1c2fa33083

SHA1
d1af27518d455d432b62d73c6a1497d032f6120e

SHA256
e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b

SHA512
115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskse.exe

Filesize
20KB

MD5
8495400f199ac77853c53b5a3f278f3e

SHA1
be5d6279874da315e3080b06083757aad9b32c23

SHA256
2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d

SHA512
0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

Filesize
2.3MB

MD5
3047ec779c68047abe0a90b1d0a3ba44

SHA1
590e44eb8f908ec91fcf45380cadcb7509aae2e7

SHA256
0fdb9c55498648621e6a650c1713a47a482128e3824eecb7aab69b9e1a3e5dd8

SHA512
26b6b8acf9cb22d2897d8d92a4f1b7782157ece89c3cda37827048372cc00795aef43fd0ac8ba0a007c140ba5ab295e196da9bea6802b71a1e71844bac98b431

Download Submit
C:\Users\Admin\Documents\@[email protected]

Filesize
933B

MD5
7e6b6da7c61fcb66f3f30166871def5b

SHA1
00f699cf9bbc0308f6e101283eca15a7c566d4f9

SHA256
4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e

SHA512
e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3

Download Submit
\Users\Admin\AppData\Local\Temp\TaskData\Tor\libeay32.dll

Filesize
344KB

MD5
cd0fd9bc0b06ca0d3680dacfa4c04c24

SHA1
edae2ec3f0f9273bafef5995dcb240eeeb4ddb04

SHA256
a859af447ae2dd1a9f22770a2621a34d4ff029f435f406eccfb0b65187abd775

SHA512
dfeb665edc83e75df6e8fe90e5f19ea06eb7f97a7a9a6a7621d2608ed19b08913a0ef451028a7af8b3214d913b02d1bdbc41742a59dc972e1e4765ec841d555b

Download Submit
\Users\Admin\AppData\Local\Temp\TaskData\Tor\libevent-2-0-5.dll

Filesize
702KB

MD5
90f50a285efa5dd9c7fddce786bdef25

SHA1
54213da21542e11d656bb65db724105afe8be688

SHA256
77a250e81fdaf9a075b1244a9434c30bf449012c9b647b265fa81a7b0db2513f

SHA512
746422be51031cfa44dd9a6f3569306c34bbe8abf9d2bd1df139d9c938d0cba095c0e05222fd08c8b6deaebef5d3f87569b08fb3261a2d123d983517fb9f43ae

Download Submit
\Users\Admin\AppData\Local\Temp\TaskData\Tor\libgcc_s_sjlj-1.dll

Filesize
448KB

MD5
899a17f4269f8c38d538d28c1e67ee73

SHA1
7f8347fd652c8c3d8a402887d6337a87c4483e1a

SHA256
7f12c8c8a99a6d58cbe17e96d4ebf677e5a0ea76aede29f62d860e82ff65437a

SHA512
23520bf45a9c7e543b3ea7a87fd6c8a1c69c93531c4731bd1de25051201f9093634f623d86c291382794905e4e05af307b33cf3b21ece8e38820e2be777bf169

Download Submit
\Users\Admin\AppData\Local\Temp\TaskData\Tor\libssp-0.dll

Filesize
90KB

MD5
78581e243e2b41b17452da8d0b5b2a48

SHA1
eaefb59c31cf07e60a98af48c5348759586a61bb

SHA256
f28caebe9bc6aa5a72635acb4f0e24500494e306d8e8b2279e7930981281683f

SHA512
332098113ce3f75cb20dc6e09f0d7ba03f13f5e26512d9f3bee3042c51fbb01a5e4426c5e9a5308f7f805b084efc94c28fc9426ce73ab8dfee16ab39b3efe02a

Download Submit
\Users\Admin\AppData\Local\Temp\TaskData\Tor\ssleay32.dll

Filesize
256KB

MD5
e6414b75ec4f73e00ec4fb2b8367d542

SHA1
f19ddd256282f36a16d3037a2ac08cb9ace871e7

SHA256
264234866ca3e11e4cf67edd4c3128b45db7003ead12c7de3d706c4ac160adaa

SHA512
11bd989b3661ed2767d7ae576cc3bbd73d2d33aa5d6b0447bc4cee988ed8612b39fc65a0be3b17931b5cf68b22e73bb03feca0bd58a4e1dff374289e63d13c0e

Download Submit
\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe

Filesize
1.7MB

MD5
cc511ff2690ffa4ee86f0824d5e4753c

SHA1
838cff3b5061029841fd4abb85deaa676af17435

SHA256
26d76554a2d14f7fcd1cf1bb5937bf7feee87fb9e3dd321eabed01c3029335d4

SHA512
2a2a7166caa4e0dd885732ee7c77ebc196b72d3f2dd08201ee515cdb5f49381891fd6694290a6bec77f715455dcfbdeaec3f92c7873d756919d111304568f1e8

Download Submit
\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe

Filesize
1.2MB

MD5
89f59b26d35fe07ae962c8bcd4cf3abd

SHA1
01e9f7c51af6e71e20a0d332ff50171693c410cd

SHA256
721186e8d2ef73d10119afe34767638914db060c3ea80d06e8c1fbf176e815a8

SHA512
b2aa3837c6817f0cb05cb88efed3e065a2da0a8d2993c962f9a380591032632a30fbc2bfb5f65067c17edeb3b24ddf65dcdcd7df50631f927cbb945ba91f582b

Download Submit
\Users\Admin\AppData\Local\Temp\taskdl.exe

Filesize
20KB

MD5
4fef5e34143e646dbf9907c4374276f5

SHA1
47a9ad4125b6bd7c55e4e7da251e23f089407b8f

SHA256
4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79

SHA512
4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5

Download Submit
memory/720-785-0x00000000748E0000-0x0000000074902000-memory.dmp

Filesize
136KB

Download
memory/720-891-0x00000000749A0000-0x0000000074BBC000-memory.dmp

Filesize
2.1MB

Download
memory/720-797-0x0000000074910000-0x0000000074992000-memory.dmp

Filesize
520KB

Download
memory/720-795-0x0000000074BC0000-0x0000000074C37000-memory.dmp

Filesize
476KB

Download
memory/720-794-0x00000000750C0000-0x00000000750DC000-memory.dmp

Filesize
112KB

Download
memory/720-793-0x0000000074C40000-0x0000000074CC2000-memory.dmp

Filesize
520KB

Download
memory/720-792-0x00000000011A0000-0x000000000149E000-memory.dmp

Filesize
3.0MB

Download
memory/720-781-0x0000000074C40000-0x0000000074CC2000-memory.dmp

Filesize
520KB

Download
memory/720-824-0x00000000011A0000-0x000000000149E000-memory.dmp

Filesize
3.0MB

Download
memory/720-831-0x00000000011A0000-0x000000000149E000-memory.dmp

Filesize
3.0MB

Download
memory/720-832-0x00000000011A0000-0x000000000149E000-memory.dmp

Filesize
3.0MB

Download
memory/720-836-0x00000000749A0000-0x0000000074BBC000-memory.dmp

Filesize
2.1MB

Download
memory/720-840-0x00000000011A0000-0x000000000149E000-memory.dmp

Filesize
3.0MB

Download
memory/720-844-0x00000000749A0000-0x0000000074BBC000-memory.dmp

Filesize
2.1MB

Download
memory/720-887-0x00000000011A0000-0x000000000149E000-memory.dmp

Filesize
3.0MB

Download
memory/720-796-0x00000000749A0000-0x0000000074BBC000-memory.dmp

Filesize
2.1MB

Download
memory/720-894-0x00000000011A0000-0x000000000149E000-memory.dmp

Filesize
3.0MB

Download
memory/720-898-0x00000000749A0000-0x0000000074BBC000-memory.dmp

Filesize
2.1MB

Download
memory/720-784-0x0000000074910000-0x0000000074992000-memory.dmp

Filesize
520KB

Download
memory/720-915-0x00000000011A0000-0x000000000149E000-memory.dmp

Filesize
3.0MB

Download
memory/720-922-0x00000000749A0000-0x0000000074BBC000-memory.dmp

Filesize
2.1MB

Download
memory/720-789-0x00000000011A0000-0x000000000149E000-memory.dmp

Filesize
3.0MB

Download
memory/720-787-0x0000000074910000-0x0000000074992000-memory.dmp

Filesize
520KB

Download
memory/720-786-0x00000000748E0000-0x0000000074902000-memory.dmp

Filesize
136KB

Download
memory/720-783-0x00000000749A0000-0x0000000074BBC000-memory.dmp

Filesize
2.1MB

Download
memory/720-780-0x0000000074C40000-0x0000000074CC2000-memory.dmp

Filesize
520KB

Download
memory/720-952-0x00000000749A0000-0x0000000074BBC000-memory.dmp

Filesize
2.1MB

Download
memory/720-948-0x00000000011A0000-0x000000000149E000-memory.dmp

Filesize
3.0MB

Download
memory/3068-39-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download